IPsec a kan WAN mai zaman kansa: iyakokin manufar SRX da za a duba

WAN mai zaman kansa na iya ɗaukar fakitin waje na tunnel ɗin IPsec, don haka adiresoshin peer ba dole ba ne su zama adiresoshin intanet na jama'a. Abin da ke canzawa shi ne hanyar da waɗannan fakitin waje suke bi da izini a kan interface ɗin da ke karɓar su. A kan SRX, hanyar sarrafawa ta waje, haɗin interface ɗin tunnel da manufar zirga-zirgar da ake turawa abubuwa ne uku daban. Gyara ɗaya yayin da sauran biyun ba su daidai shine dalilin da ya saba sa tunnel ya kasance a ƙasa.

Da farko rubuta hanyar IKE ta waje

Rubuta ƙima huɗu kafin ka taɓa manufar: adireshin peer, interface ɗin gida da ke karɓar IKE, mahallin turawa da ke isa ga peer da hanyar da ke zaɓar wannan interface. Ana aika fakitin IKE zuwa SRX da kansa, don haka suna buƙatar izinin host-inbound a yankin karɓa, ba manufar zirga-zirgar da ake turawa ba. Adireshin WAN mai zaman kansa ba ya kawar da wannan buƙatar, domin fakitin yana ƙarewa a na'urar har yanzu.

Duba yanayin da aka shigar da show security ike sa da kuma saitin da show configuration security ike. Na farko yana faɗin ko mataki 1 ya wanzu; na biyu yana faɗin abin da na'urar ke tsammani ya kamata ta yi.

Haɗa interface ɗin tunnel da manufar da ta dace

VPN da ke dogaro da turawa yana haɗa interface ɗin tunnel da abin VPN, kuma ana tura prefixes ɗin da aka kare zuwa wannan interface. Rubuta wanne interface, wace hanya da wace manufa ke ba da izinin aikace-aikace tsakanin yankunan da abin ya shafa. Yanki mai suna trust kwandon manufa ne, kuma sunan ba ya tabbatar da cewa an ba da izinin fakitin sarrafawa ko bayanai da ake buƙata.

Karanta haɗin da aka yi a zahiri maimakon tsohon zane: show configuration security ipsec vpn don saitin haɗi da interface da show configuration security policies don ƙa'idodin da ke nuni ga yankin tunnel.

Idan hanyar da aka kare ta nuna wani wuri, tunnel ɗin na iya kasancewa a sama yayin da zirga-zirga ba za ta taɓa shiga ba. Wannan matsalar turawa ce sanye da kayan IPsec.

Riƙe hanyar peer a kan underlay

Hanyar zuwa peer ɗin waje dole ne a warware ta ta hanyar underlay, ba a maimaita ta hanyar tunnel ɗin da take kafa ba. Idan hanyar peer ta nuna interface ɗin tunnel, fakitin IKE suna bin tunnel ɗinsu kuma mataki 1 ba zai taɓa kammala ba. Hanyar amsa don zirga-zirgar da aka kare tana buƙatar nata hanya da manufar daidai, kuma yawanci ita ce rabin da ya ɓace lokacin da wata hanya ke aiki. Karanta shigarwar teburin hanya don adireshin peer kuma tabbatar interface ɗin fita shine interface ɗin WAN.

Duba shi da show route 198.51.100.10, ka maye gurbin adireshin peer na gaske, ka tabbatar hop na gaba ba interface ɗin tunnel ba ne.

Tabbatar da sarrafawa da sabis a jere

Yi aiki zuwa sama: yanayin mataki 1, yanayin mataki 2, sannan kwararar aikace-aikace ta gaske. show security ipsec sa yana lissafta ƙungiyoyin tsaro, kuma show security flow session destination-prefix 10.60.0.0/16 yana nuna ko ana ƙirƙirar zamukan da aka tura don hanyar sadarwar da aka kare.

Kyakkyawar dangantakar sarrafawa da hanyar bayanai mai aiki sakamako biyu ne daban-daban, kuma wucewar mataki 2 ba ta faɗin komai game da ko manufar ta yarda da aikace-aikacen. Gwada kwarara ɗaya da aka yarda da kuma ɗaya da manufar ya kamata ta ƙi, domin bambancin ya bayyana.

Rubuta tare hanyar peer, izinin host-inbound, haɗin tunnel, hanyar ciki da manufar aikace-aikacen. Waɗannan rikodin biyar suna nuna wane matakin ne zai mallaki gazawar gaba ba tare da dogaro da alamar tashar jiragen ruwa ba.