VGW ko TGW? Inda tunnel ɗin IPsec na AWS Site-to-Site yake ƙarewa

Mutane suna tambaya inda VPN na AWS Site-to-Site ya daina kare fakiti kuma suna tsammanin amsa ɗaya: a ƙofar. Sigar amsar da ke da amfani tana ambaton wace ƙofa, domin ƙofar sirri ta kama-da-wane da ƙofar wucewa tsari ne daban-daban da abubuwan haɗi daban-daban, kuma mai bitar da ya ɗauka ba daidai ba yana gina sauran kimantawa a kan zanen da babu shi. Yi gwaje-gwaje uku da ke ƙasa bisa tsari. Kowanne ko yana tabbatar da iyaka ko yana gaya maka cewa amsar da ta gabata ta shafi wata hanya dabam.

Ambaci matakan ƙarshe guda uku kafin ka tantance kome

Bitar ɓoyewa ta wannan hanya tana buƙatar abubuwa uku da aka ambata: ƙofar abokin ciniki, maƙasudin VPN na AWS da ke ƙare IPsec, da matakin ƙarshe na aikace-aikacen da ke karɓar fakiti na ciki. Rubuta su tare da gano masu albarkatun kafin ka buɗe ko ɗaya shafin na'ura, domin duk abin da ke bayan wannan batu magana ne game da ɗaya daga cikin waɗannan uku.

Ƙofar abokin ciniki naka ce kuma tsarinta a bayyane yake gare ka. Maƙasudin AWS albarkace mai sarrafawa ce, kuma kuskure ne a ɗauka ta: haɗin VPN na iya haɗawa da ƙofar sirri ta kama-da-wane ko kai tsaye da ƙofar wucewa, kuma ɗayan baya nufin ɗayan. Mataki na ƙarshe na uku shine wanda mutane ke tsallakewa, kuma shine kaɗai wanda ke amsa ainihin tambaya game da bayanan aikace-aikacen.

Bincike 1: wace ƙofa ce a zahiri ke ƙare tunnel ɗin

Ana goyon bayan duka tsare-tsaren biyu kuma jagorar gine-ginen Site-to-Site VPN tana bayyana su gefe da gefe, don haka tambayi API maimakon zane wanda sau da yawa ya cika shekara. Binciken karatu kawai akan haɗi ɗaya yana mayar da filayen maƙasudin VPN:

aws ec2 describe-vpn-connections --region eu-west-1   --vpn-connection-ids vpn-0123456789abcdef0   --query 'VpnConnections[0].{VGW:VpnGatewayId,TGW:TransitGatewayId,CGW:CustomerGatewayId,Category:Category}'

Bambanci shine TransitGatewayId, ba VpnGatewayId ba. Haɗin da TransitGatewayId ba komai a ciki yana ƙarewa a kan ƙofar sirri ta kama-da-wane mai zaman kanta, yayin da haɗin da aka saita wannan filin yana ƙarewa a kan haɗin VPN na ƙofar wucewa, kuma VpnGatewayId na iya kasancewa cike a wannan yanayin domin yana iya ambaton ƙofar da ke goyan bayan haɗin. Karanta filin TGW da farko, sannan ka tabbatar da nau'in haɗin daga jerin haɗe-haɗe maimakon daga sunan fili, domin haɗin VPC a waccan ƙofar wucewa ba shine haɗin VPN ba. Samun misalin da ake nufi a cikin VPC da aka haɗa ba ya gaya maka kome game da wane haɗin VPN ne ya ɗauki fakiti.

Yayin da kake can, duba ramukan. Haɗin yana ɗaukar ramukan IPsec biyu don sakewa, kuma haɗin da rami na biyu bai taɓa tashi ba abin ganowa ne na gaske don samuwa ko da bai canza kome ba a kan iyakar ɓoyewa:

aws ec2 describe-vpn-tunnels --region eu-west-1   --filters Name=vpn-connection-id,Values=vpn-0123456789abcdef0   --query 'VpnTunnels[].{Outside:OutsideIpAddress,State:State,Status:Status}'

Bincike 2: me fakiti na ciki har yanzu yake ɗauka

Da zarar IPsec ya ƙare, AWS yana tura fakitin da aka buɗe ta hanyar da ta dace da shi. Daga wannan batu zirga-zirgar ta zama ta VPC ta yau da kullum, kuma kariyar VPN ta ƙare. Wannan ba gibin sabis ba ne; wannan shine ma'anar iyaka, kuma abin da ke cikin jerin duba shine a faɗe shi a fili maimakon barin "VPN ɗin an ɓoye shi" ya tsaya a madadin "bayanan an ɓoye su daga ƙarshe zuwa ƙarshe".

Yanzu duba abin da ke ciki. Idan fakitin ciki ka'idar aikace-aikace ce a rubutu bayyananne, babu abin da ke ƙasa yana ƙara sirri har sai wani abu ya ɓoye shi. Idan fakitin ciki yana ɗauke da zaman TLS tuni, cire IPsec na waje bai canza kome ba ga wannan zaman: yana kasancewa mai kariya har zuwa matakinsa na ƙarshe, duk inda wannan matakin yake.

Gyaran wuce gona da iri da aka saba shine a kammala cewa duk abin da ke bayan ƙofar a bayyane yake. Ba haka ba ne. Jigilar sabis, ɓoyewar ajiya da TLS na aikace-aikace hanyoyi ne daban-daban da sharuɗɗa daban-daban, kuma kowanne dole a tantance shi bisa sharuɗɗansa maimakon a yi hasashe daga siffar VPN. Shigarwar log ɗin kwarara da ke nuna ACCEPT tana tabbatar da cewa turawa ta yi aiki kuma ba ta faɗi kome game da sirri, wanda shine ainihin kuskuren da wannan jerin duba ya ke don hana shi.

Bincike 3: me ke ƙare TLS a bayan ƙofar

Bi mai saurare, ba adireshin ba. Idan mai daidaita nauyi ko wakili ya ƙare TLS, haɗin da abokin cinikinka ke riƙe yana ƙarewa a can, kuma wakilin yana buɗe haɗi na biyu zuwa bayan da zai iya zama rubutu bayyananne ko TLS da wata sarkar amincewa. Adireshin IP na sirri da hanyar da ta dace ba hujja ba ne game da wannan haɗi na biyu.

Gwada matakin ƙarshen da kake damu da shi da gaske daga cikin VPC, da sunan da aikace-aikacen ke amfani da shi maimakon IP da ka warware sau ɗaya:

openssl s_client -connect internal.example:443 -servername internal.example -verify_return_error

Maimaita hakan ga kowane tsalle da buƙatar ke wucewa. Idan amsar ta bambanta tsakanin sunan da ke fuskantar abokin ciniki da sunan bayan, ka sami daidai ɓangaren da VPN bai taɓa rufewa ba, kuma wannan shine abin ganowar da za a rubuta.

Yi rikodin sakamakon a matsayin ɓangarori, ba a matsayin hukunci ba

Fitowar wannan jerin duba ƙaramin tebur ne da jere ɗaya ga kowane ɓangare: ƙofar abokin ciniki zuwa maƙasudin VPN na AWS, ƙofa zuwa nauyin aiki, nauyin aiki zuwa ajiyar bayanai, da duk wani tsallen wakili a tsakiyar. Kowane jere yana faɗin abin da ke kare shi da abin da wannan kariyar ta dogara da shi. "An ɓoye" ba tare da hanya kuma ba tare da matakin ƙarshe ba ba jere ba ne.

Sannan ka amsa buƙatar asali a cikin kalmomin da aka yi ta. Idan buƙatar ita ce bayanai su kasance cikin sirri har sai nauyin aiki ya karɓe su, VPN yana biyan ɓangaren farko kawai, kuma sauran jerin suna buƙatar jigilar aikace-aikace, TLS na sabis ko ɓoyewar ajiya da aka tsara kuma aka tabbatar daban.

Riƙe gano haɗe-haɗe, yanayin ramuka da batutuwan takardar shaida a cikin rikodin. Idan wani ya dawo kan ƙirar bayan wata shida, waɗannan kayan tarihi uku suna amsa tambayar iyaka cikin mintuna maimakon sake fara muhawara daga zane.