Haɗa shiga ofis da asali, ba da tashar switch ba
Rarraba, shigar da izinin sabis ayyuka ne daban-daban. Sharuɗɗa uku ne ke yanke shawara ko shiga bisa asali ya fi VLAN na kowace tasha.
Akwai tsare-tsare biyu a kan tebur. Ɗaya yana riƙe ma'aikata a cikin VLAN na bisa matsayi kuma yana gyara tashoshin switch lokacin da mutane suka ƙaura. Ɗayan kuma yana tabbatar da zaman kuma yana barin manufa ta yanke shawara abin da za ta iya kaiwa. Zaɓin ba game da zamani ba ne; game da ko sharuɗɗa uku sun tabbata a ginin ku ne. Idan ɗayansu ya kasa, tsarin bisa tasha ba wauta ba ne, shi ne wanda za ku iya gudanarwa da gaske.
Sharuɗɗan uku su ne tilastawa, ingancin asali da halin kasawa.
Sharaɗi 1: shin na'urorin shiga za su iya tilasta manufar da aka mayar
802.1X dangantaka ce tsakanin mai nema a ƙarshen hanya, mai tabbatarwa a cikin switch ko wurin shiga, da uwar garken tabbatarwa da ake samu ta RADIUS. Uwar garken na iya mayar da VLAN ko wani sakamakon manufa, kuma RFC 3580 ya bayyana wannan sigina. Switch ɗin dole ne ya aiwatar da sakamakon da kuke dogaro da shi.
Nemi iyawa, ba yarjejeniya ba: rabon VLAN mai motsi, ACL ɗin da za a sauke, ko turawa zuwa tashar rijista.
Sharaɗi 2: shin tushen asali mai iko ne kuma mai saurin canzawa
Kasancewa cikin ƙungiya a cikin jagorar yana taimakawa ne kawai idan shi ne filin da kasuwancin ke gyara tuni lokacin da matsayi ya canza. Idan rabon matsayi yana rayuwa a cikin tebur da ake kwafa cikin ƙungiyoyi kowane wata, shiga bisa asali yana sarrafa tsohon bayani kawai. Duba jinkirin kuma, domin sabon ma'aikaci da ba zai iya aiki kwana ɗaya ba sakamako ne mafi muni fiye da canza tasha da hannu. Tabbatar da na'ura, tabbatar da mai amfani da duka biyu tare zaɓuɓɓuka ne daban, kuma firintoci suna buƙatar tsari bayyananne maimakon kewayawa marar bayani.
Rubuta taswirar: wace ƙungiya ke ba da wace manufa, kuma wa zai iya canza ta.
Sharaɗi 3: yanke shawarar halin kasawa kafin gwajin
Kowace turawa tana da yanayin da ba a tabbatar ba da yanayin da uwar garken ba ta samuwa, kuma manufar duka biyu shawarar tsaro ce. Faɗuwa cikin shiru zuwa wani yanki abin dogaro yana lalata tsarin; kasawa mai tsanani tana toshe aiki yayin tsayawa. Matsakaicin da aka saba shi ne yanki iyakance tare da shiga intanet kawai da hanyar da ta bayyana zuwa teburin taimako. Gwada faɗuwar a kan ainihin switch ko dandalin mara waya, domin tsoffin ƙayyadaddun masu siyarwa sun bambanta.
Idan babu wanda zai iya kwatanta faɗuwar a jumla ɗaya, tsarin bai ƙare ba.
Inda VPN ya dace
VPN tana tabbatar da shiga ta hanyar da ba a amince da ita ba, kuma buƙatar ta a LAN na ofis ma na iya zama shawarar amincewa da gangan. Ba ta kawar da buƙatar taswirar ƙungiya ko izinin uwar garken fayil da kanta ba. Tana kuma ƙara ƙarfin ƙofa, manhajar abokin ciniki da sarrafa zaman zuwa nauyin aiki.
VPN da aka saya don guje wa gyaran VLAN ya warware matsalar da ba daidai ba kuma ya ƙara sababbi biyu.
Tebur ɗin, da abu ɗaya da ya kamata a riƙe
| Condition | Holds? | Design |
|---|---|---|
| Devices enforce returned policy | Yes | 802.1X with dynamic policy, stable segments |
| Devices cannot enforce it | No | Keep segments, add an application gateway |
| Identity source lags role changes | No | Fix provisioning before admission |
| No acceptable unauthenticated state | No | Restricted segment with a portal |
| Departures must lose access quickly | Yes | Dynamic disconnect plus credential revocation |
Riƙe yankuna don uwar garken, baƙi, na'urori da fasahar aiki. Waɗannan iyakoki game da zirga-zirga ne ba game da sunayen aiki ba, kuma suna jure duk wani sake tsari. Sanya haƙƙin ma'aikaci a cikin manufar asali, inda canjin matsayi gyara ɗaya ne, kuma yi amfani da hanyar cire haɗin da aka tallafa lokacin da cirewa ya kamata ya yi sauri.
Gwajin tsarin shine motsin tebur: ya kamata ya motsa mutum da kayan aikinsa, ba sake gina izininsa a kusa da wata mahaɗa ba.