Split tunnel ba ya keɓe baƙon jama’a daga dokokin NAT na ASA

Ana bayyana split tunneling a matsayin hanyar ajiye zirga-zirgar kamfani a cikin rami da sauran intanet a wajen bangon wuta. Dukkan rabin wannan bayanin kuskure ne a hanya ɗaya. Split tunneling shawara ce ta hanya da abokin ciniki ke yi, kuma shawarar hanya ba ta faɗin komai game da abin da zai faru da fakiti bayan ya isa headend.

Sabis ɗin abokin tarayya guda ɗaya a adireshin jama’a, wanda ya dage ya ga adireshin babban ofishinka, ya isa ya rushe labarin.

Tatsuniya: split tunnel yana cire bangon wuta daga hanya

Imani shi ne cewa duk wata manufa da ke wajen jeri na sirri tana kan haɗin intanet na gida, don haka bangon wuta ba ya ganinta kuma ba ya buƙatar ƙa’ida dominta. Wannan yana aiki ne kawai muddin manufar ba ta cikin jerin rami. A lokacin da mai aiki ya ƙara baƙon jama’a cikin ACL split-include, abokin ciniki yana aika wannan zirga-zirgar cikin rami, kuma ASA dole ta yi mata hanya, tacewa da fassara kamar kowace kwarara da aka yanke. Babu abin da ya canza a kan abokin ciniki sai jerin manufofin.

Abokin ciniki bai zama mai ba da hanya ba. Ya bi manufar da ka ba shi.

Abin da hanyar split-include take yi a haƙiƙa

A cikin tsarin shiga nesa na Cisco ASA, manufar rukuni tana ɗauke da split-tunnel-policy tunnelspecified da split-tunnel-network-list wanda ke ambaton daidaitaccen ACL. Kowace layin permit a cikin wannan ACL manufa ce da abokin ciniki ya kamata ya aika cikin rami, kuma duk sauran suna ci gaba da amfani da hanyar da ba ta dace ta gida.

Ƙara baƙo ɗaya layi ɗaya ne, kuma shi ne kawai ɓangaren canjin da abokin ciniki zai iya gani: access-list RA-SPLIT standard permit host 203.0.113.20.

Sake haɗa abokin ciniki bayan haka. Ana musayar manufar a lokacin haɗi, don haka zaman da aka riga aka kafa yana riƙe da tsohon jerin kuma yana sa canjin ya zama kamar bai yi komai ba.

Fakitin yana shigowa kuma yana fita a kan muƙala ɗaya

Yanzu bi kwararar bayan yankewa. Fakitin ya shiga ta muƙalar waje ta hanyar ramin VPN, manufarsa adireshin jama’a ne, kuma teburin hanya yana mayar da shi ta wannan muƙalar waje zuwa intanet. Zirga-zirgar da ke shigowa da fita a muƙala ɗaya ana jefar da ita sai dai idan an ba ASA izinin barinta, kuma abin da same-security-traffic permit intra-interface ke yi ke nan. Idan babu shi haɗin yana gazawa ta hanyar da take kama da matsalar hanya amma ba ita ba ce.

Wannan saitin na duniya ne. Yana ba da izinin hairpinning ga kowace kwarara da take buƙatarsa, ba don wannan baƙon abokin tarayya kaɗai ba, don haka ya kamata ya kasance cikin canji da aka duba ba cikin gwaji mai sauri ba.

Me ya sa PAT mai iyaka ga manufa ba zaɓi ba ne

Adireshin tushe a cikin fakitin da aka yanke har yanzu adireshin VPN ne na abokin ciniki, yawanci daga tafki kamar 10.77.0.0/24. Wannan adireshin ba shi da hanya a intanet na jama’a, don haka abokin tarayya ko ba ya amsa ko kaɗan ko kuma yana amsa a banza.

Fassarar tana gyara tushen kuma tana barin manufar ba a taɓa ta ba. Tun da an riga an bayyana abubuwan a wani wuri, ƙa’idar hannu mai iyaka ga wannan manufa tana da wannan siffa:

same-security-traffic permit intra-interface

object network RA_POOL
 subnet 10.77.0.0 255.255.255.0
object network PARTNER_HOST
 host 203.0.113.20

nat (outside,outside) source dynamic RA_POOL interface destination static PARTNER_HOST PARTNER_HOST

Sashin destination static yana da muhimmanci. Idan ka bar shi, ƙa’idar ta zama fassara mai faɗi wadda za ta iya dacewa da zirga-zirga da yawa fiye da yadda aka yi niyya, kuma ƙa’idar identity mai faɗi da ta gabata a cikin tsari za ta iya doke wannan gaba ɗaya. Duba show nat detail da tsarin sassan kafin ka ɗauka cewa ƙa’idarka ce ke dacewa.

PAT na muƙala kuma yana nufin abokin tarayya yana ganin adireshin muƙalar ASA, wanda za a iya sake fassara shi a sama. Idan kwangilar ta ambaci adireshi, tabbatar da shi daga ƙarshe zuwa ƙarshe maimakon a tsalle ɗaya.

Tabbatar da shi da madaidaicin manufar gwaji

Yi amfani da baƙon abokin tarayya da kansa, ba wani shafin what-is-my-ip na gama gari ba. Wannan shafin kusan tabbas yana wajen jerin split, don haka yana bayar da adireshin intanet na gidanka kuma ba ya faɗin komai game da wannan hanya. Buɗe sabon haɗi zuwa sabis ɗin abokin tarayya kuma ka tambaye su wane tushe suka gani, ko ka gudanar da packet-tracer input outside tcp 10.77.0.10 12345 203.0.113.20 443 detailed ka karanta matakan NAT da hanya layi-layi. Traceroute daga abokin ciniki gwaji ne mafi rauni, domin yana nuna hanyar da ta riga ta faru maimakon manufar da ta zaɓe ta.

Sannan duba abin da bai kamata ya canza ba. Wurin yanar gizo na yau da kullum dole ya ci gaba da fita daga haɗin gida, kuma dole wata hanya mai sirri a cikin jerin rami ta ci gaba da kasancewa mai isa. Canjin da ya gyara abokin tarayya kuma ya karya ɗaya daga cikin waɗannan kuskure ne daban.

Sigar da ke aiki ta wannan ƙira gajera ce: baƙo ɗaya a cikin ACL split, izinin hairpin, ƙa’idar PAT ɗaya mai iyaka ga manufa. Duk sauran da ke cikin labarin tatsuniya ce.