VPN IPsec Dual-WAN a Junos: daidaita hanyar tushe da ƙofar da ta dace

Hanyoyin WAN biyu a kowane wuri suna kama da ajiya sai ka yi ƙoƙarin tabbatar da wace dabi'ar adireshi wani kwarara ya yi amfani da ita. A kan SRX, ƙofar IKE ɗaya tana ɗauke da muƙamin waje ɗaya da adireshin gida ɗaya; jerin 'yan takara na nesa ba ya ƙirƙirar tushe na gida na biyu. Shi ya sa wannan jagora ya fara da matrix na dabi'u ba da saitin ba, domin Junos yana commit da sauƙi wani tsari da ya rufe rabin haɗaɗɗun da ka nufa kawai. Na ci karo da wannan a kan SRX345s guda biyu: ramin ajiya ya tashi tsaf kuma har yanzu ya jawo zaman ƙasa a lokacin komawa.

Bi matakan a jere: lissafa dabi'un da za ka tallafa, gina ƙofa ɗaya ga kowane tushe na gida, tabbatar da wace ƙungiya ce ta ɗauki zirga-zirgar, sannan ka yanke shawara kan abin da kowane irin gazawa zai iya canzawa.

Yi taswirar dabi'u kafin ka taɓa CLI

Idan wurin A zai iya fitowa daga A1 ko A2 kuma wurin B zai iya karɓa a kan B1 ko B2, kana da dabi'un adireshin waje huɗu. Yawancin tsare-tsare suna buƙatar biyu daga cikinsu a kai a kai kuma suna ɗaukar sauran biyun a matsayin zaɓi. Rubuta matrix ɗin ka yi wa kowace layi alama, domin kowace layin da ka yi alkawari zai biya ka ƙofa, muƙamin rami da shawarar hanya daga baya.

Kowace dabi'ar da ake buƙata tana buƙatar abubuwa uku a lokaci ɗaya: underlay da ake iya kaiwa tsakanin waɗannan adiresoshin, karɓuwar juna na asalin abokin tarayya da adireshin tushe a ƙarshen biyu, da hanyar dawowa mai kariya. Dabi'ar da ke aiki a hanya ɗaya kawai za ta nuna rami duk da haka, kuma gazawar za ta bayyana daga baya a matsayin zirga-zirgar manhaja ta hanya ɗaya.

Ƙofa ɗaya ga kowace tushe na gida, ba ga kowane wuri na nesa ba

Jerin adiresoshin nesa na ƙofa ɗaya ne, haka ma tushen gida. bayanan ƙofofin IKE yana riƙe adiresoshin nesa, muƙamin waje, adireshin gida da gano abokin da ya mutu a matsayin saiti daban-daban, kuma wannan shi ne ainihin maganar: tushe biyu na gida na nufin ƙofofi biyu a kan rukunin st0 biyu. Raba manufar IKE tsakaninsu ba laifi ba ne; riƙe ƙofa ɗaya da fatan ita kaɗai za ta zaɓi wani tushe ba haka ba ne.

set security ike policy IKE-P1 mode main
set security ike gateway GW-A1 ike-policy IKE-P1
set security ike gateway GW-A1 address 198.51.100.20
set security ike gateway GW-A1 address 198.51.100.21
set security ike gateway GW-A1 external-interface ge-0/0/0
set security ike gateway GW-A1 local-address 203.0.113.10
set security ike gateway GW-A1 version v2-only
set security ike gateway GW-A2 ike-policy IKE-P1
set security ike gateway GW-A2 address 198.51.100.20
set security ike gateway GW-A2 external-interface ge-0/0/3
set security ike gateway GW-A2 local-address 192.0.2.10
set security ike gateway GW-A2 version v2-only

Sannan ka haɗa ramukan ka ba wa prefik ɗin nesa next hop biyu, ɗaya ga kowane rami:

set interfaces st0 unit 1 family inet
set interfaces st0 unit 2 family inet
set security ipsec policy IPSEC-P1 perfect-forward-secrecy keys group14
set security ipsec vpn VPN-A1 bind-interface st0.1
set security ipsec vpn VPN-A1 ike gateway GW-A1 ipsec-policy IPSEC-P1
set security ipsec vpn VPN-A2 bind-interface st0.2
set security ipsec vpn VPN-A2 ike gateway GW-A2 ipsec-policy IPSEC-P1
set routing-options static route 10.20.0.0/16 qualified-next-hop st0.1 preference 10
set routing-options static route 10.20.0.0/16 qualified-next-hop st0.2 preference 20

Shin ƙofa ɗaya za ta iya riƙe umarni biyu na nau'in address ya dogara da sigar da kuma wace tsarin IKE na'urar ke gudanarwa. Tsohon Junos mai tushen kmd yana karɓar adireshin nesa ɗaya ga kowace ƙofa; sabbin builds suna kula da 'yan takara da yawa amma suna ƙara nasu iyakoki, kuma gungun samun sama da ƙarfi wuri ne da yawa inda wannan tallafi ke ƙunci. Duba bayanan fitarwa don ainihin build ɗinka kafin ka kwafa wannan daga tsohuwar chassis.

Tabbatar da wace ƙungiya ce ta ɗauki fakitin

SA biyu da ramuka biyu ba sa faɗin wanne ne ya tura zaman gaba. Tambayi na'urar kai tsaye ka kwatanta filayen da dabi'ar da ka nufa:

show security ike sa detail
show security ipsec sa detail
show security flow session destination-prefix 10.20.1.0/24
show interfaces st0.1 | match packets

Bayanin dalla-dalla yana ambaton ƙofar gida da ta nesa ga kowace ƙungiya, wadda ita ce hanya mafi sauri ta gano ramin da aka yi shawara daga tushen da ba ka tsammani ba. Sannan ka lura da ma'aunin fakiti ga kowane rukuni a kan st0.1 da st0.2 yayin da kake tura zirga-zirgar; ramin da ba ya ɗaukar komai yana riƙe SA ɗinsa kuma yana kama da lafiya a taƙaitaccen bayani.

Ba kowane irin gazawa nasa na'urar ganowa

Rayuwar abokin tarayya, asarar hanyar sama ta gida, janye hanyar da aka kare da karyewar manhaja abubuwa huɗu ne daban-daban. DPD yana amsa na farko kawai, don haka saita shi da tazara da iyaka da za ka iya karewa maimakon barin tsoho ka ɗauka cewa yana rufe sauran:

set security ike gateway GW-A1 dead-peer-detection interval 10
set security ike gateway GW-A1 dead-peer-detection threshold 3
set security ipsec vpn VPN-A1 vpn-monitor source-interface st0.1
set security ipsec vpn VPN-A1 vpn-monitor destination-ip 10.20.0.1

Sa ido kan rami da ke gwada wata manufa a cikin ƙananan hanyar nesa yana rufe yanayin da DPD ba ya gani: IKE yana raye, ƙofar tana amsawa, kuma prefik ɗin da aka kare ba ya isa duk da haka. Zaɓi wanne daga cikinsu ya kamata ya ja fifiko, domin idan duka biyu suka kunna lokaci ɗaya ana samun guguwar canje-canje maimakon sauyawa mai tsafta.

Kar ka manta ƙarshen nesa. Hanyar da aka fi so da ta tsaya a wurin nesa tana ci gaba da nuna ramin da ka riga ka watsar, kuma babu wani mai ƙididdige lokaci na gida da zai gyara hakan. Buga wannan dabarar fifiko a kan abokan biyu, ka rubuta ko hanyar da ta dawo za ta iya ɗaukar zirga-zirgar da kanta ko dole a juya ta da hannu.

Sake adireshin hanya ɗaya ba tare da taɓa ɗayan ba

Lokacin da ISP ya ba ka sabon toshe, canza dangantaka ɗaya a lokaci guda. Sabunta address ko local-address a kan abokan biyu don wannan dabi'ar, yi commit, ka share ƙungiyoyin da abin ya shafa kawai ta index maimakon share duk SA a na'urar. Sharewa gaba ɗaya yana ɗauke da ramin lafiya kuma yana mai da taga kulawa ya zama tsayawa.

Ajiye kwarara ɗaya da ta kasa da bayanan zamanta a matsayin hujja kafin ka share komai, sannan ka sake gudanar da gwaje-gwajen da ke sama a kan sabuwar dabi'ar adireshi. Maido da hanya shawara ce ta hanya, don haka ɗauki komawa a matsayin mataki da aka gwada daban maimakon ɗauka cewa tsohon fifiko zai dawo da kansa.

Rufe canjin da ɗan gajeren jerin dubawa

Tsarin ramin dual-WAN yana kammala lokacin da za ka iya ambaton dabi'ar da ke bayan kowane zama, ba lokacin da duka SA biyu suka tashi ba. Bi jerin da ke ƙasa a kan na'urar da ka canza da gaske:

• Kowace dabi'ar da aka yi alkawari tana da ƙofa, rukunin st0 da shigarwar hanya.
• An ga kowane rami yana ɗaukar fakiti, ba kawai riƙe SA ba.
• Ƙarshen biyu sun yarda a kan ganowa da kuma wace gefe ke maido da fifiko.
• An rubuta hanyar dawowar kowace dabi'a kusa da hanyar tafiyarta.

Idan wani layi ya kasa, gyara wannan dabi'ar kafin ka ƙara ta gaba; ɗora ramuka biyu da ke aiki rabi a kan juna yana mai da ma'auni marasa ma'ana da halin failover wanda ba za a iya hango shi ba.