Me yasa mai amfani na ASA mai nisa ya isa yankin cibiyar amma ba manhajar ba
Hanyoyi suna tabbatar da cewa ramin yana aiki, ba cewa mai amfani zai iya buɗe manhajar ba. Karanta tacewar da zaman ya karɓa, sannan gwada haɗi da aka yarda da shi da wanda aka ƙi.
Mai amfaninka ya haɗa, ya sami adireshi, ya yi ping ga uwar garke a yankin cibiyar manhajar, amma har yanzu ba ya iya buɗe sabis ɗin da ke kanta. Wannan haɗin ya zama al’ada a kan ASA, domin ramin da ya yi nasara da izini mai amfani ana yanke su da saituna daban-daban. Jerin ramin da aka raba ya zaɓi waɗanne wurare suka shiga ramin; tacewar VPN da ka’idojin shiga na wurin da kansu suna yanke abin da buƙatar da aka buɗe sirri za ta iya isa. Bi shawarwari uku a jere maimakon faɗaɗa jerin hanyoyi har sai wani abu ya canza.
Shawarwari uku da ke da sauƙin rikicewa
Karɓa yana amsa ko mai amfani zai iya kafa ramin kwata-kwata: takardun shaidar asali, takardar shaida da kowane ma’auni na biyu. Zaɓin hanya yana amsa waɗanne wurare abokin ciniki ke turawa cikin wannan ramin. Ba da izini yana amsa ko buƙatar da aka buɗe sirri za ta iya isa sabis ɗin. Na uku ne kawai ke haifar da kuskuren da mai amfani ke bayarwa.
Hanya mai sauri ta rarrabe su ita ce tambayar abin da canji zai karye. Cire hanya daga jerin raba yana dakatar da zirga-zirga zuwa wannan yankin ba tare da ba da komai ba; ƙara ACE a tacewar VPN yana ba da wuri ba tare da canza abin da abokin ciniki ke ramawa ba.
| Setting | What it decides | Symptom when it is wrong |
|---|---|---|
| Connection profile and authentication | Whether the tunnel is built | Login fails, no address assigned |
| Split-tunnel network list | Which destinations the client routes into the tunnel | Subnet unreachable from the client, everything else fine |
| VPN filter (ACL) | Which decrypted flows are permitted | Tunnel up, ping may work, TCP service refused or dropped |
Karanta tacewar da zaman ya karɓa da gaske
Fara daga zaman mai rai maimakon tsarin da kake tsammanin yana aiki. show vpn-sessiondb detail anyconnect yana buga manufofin rukuni da aka ba da sunan tacewar da ke haɗe da wannan zaman. Idan filin babu kome, babu tacewa da ke tilasta wani abu kuma toshewar tana zuwa daga wani wuri.
Sannan karanta manufar da ke da darajar, gami da tsoffin ƙima, domin tacewa na iya zama gadon gado maimakon rubuta a inda kake kallo:
show run all group-policy <policy-name>
show run access-list <acl-name>
show run webvpn
Kwatanta sunan tacewar da ke kan zaman da ACL ɗin da ka gyara yanzu. ACL mai kama da suna wanda mai amfani bai taɓa karɓa ba ba zai iya canza manufar albarkatun wannan zaman ba, kuma wannan shine dalilin da ya fi yawa da canjin da ya yi kama da daidai ba ya da tasiri.
Fifiko yana bayanin sauran. Ga saitin tacewa, rikodin DAP yana fifita kan halayen sunan mai amfani, kuma halayen sunan mai amfani suna fifita kan manufar rukuni. Lokacin da zaman ya nuna tacewar da ba ka yi tsammani ba, nemi manufar DAP da ta dace da wannan mai amfani kafin ka taɓa rukuni.
Jerin raba da tacewa filaye ne daban
A kan ASA 9.x manufar rukuni tana riƙe split-tunnel-network-list da vpn-filter a matsayin saituna daban-daban, kuma jagorar manufofin rukuni ta 9.22 ta rubuta su daban saboda wannan dalili. Jerin cibiyar alama ce ta hanya ga abokin ciniki; tacewa jerin kula da shiga ne da ake amfani da shi ga zirga-zirgar da aka buɗe sirri.
Wannan bambanci yana da muhimmanci lokacin da mai amfani ke buƙatar sabis ɗin HTTPS guda a yankin cibiyar. Saka yankin a jerin raba domin fakitin su shiga ramin, sannan ka yarda da wannan sabis ɗin kawai a cikin tacewa. Faɗaɗa jerin hanyoyi ba ya ba da izinin komai, kuma rage shi ba hanya ce ta tilastawa ba.
Duba ko ACL na fuskar ma’aikata ma yana cikin hanya
Zirga-zirgar shiga nesa da aka buɗe sirri ba koyaushe ke wucewa ta ACL na fuskar waje kamar yadda mutane suke tsammani ba. Inda sysopt connection permit-vpn ke aiki, ASA tana amfani da kewayenta na VPN da aka rubuta ga wannan zirga-zirga, yayin da tacewar VPN da suka dace har yanzu suna aiki bayan haka. Duba saitin da show run all sysopt maimakon yin tunani daga zanen tsarin.
Ko ta yaya, bangon wuta na uwar garken da aka nufa da izinin manhajar suna kasancewa cikin hanya. Dokar ASA da ke yarda da TCP 443 ba ta sa manhajar ta karɓi mai amfani.
Karɓi canjin tare da haɗin da aka ƙi ma
Gwajin da aka yarda shi kaɗai ba ya tabbatar da komai, domin ramin da ke aiki yana haifar da fakitin farko ɗaya ko akwai tacewa ko babu. Buɗe sabis ɗin da aka nufa daga abokin ciniki, sannan gwada wurin da ya kamata ya kasance a rufe kuma tabbatar ya kasa saboda ainihin dalili.
Rubuta abubuwa huɗu lokacin da kake rufe tikit ɗin: asalin da aka karɓa, manufa da tacewar da zaman ya karɓa da gaske, wuraren da ke cikin jerin raba, da albarkatun da aka ba mai amfani izinin isa. Waɗannan huɗu suna bayanin inda ake sarrafa zirga-zirga ba tare da mai da jerin hanyoyi zuwa bangon wuta ba.
Idan sabis ɗin har yanzu ya ƙi bayan tacewa ta yarda da shi, koma ga uwar garke: adireshin sauraro, bangon wuta na uwar garke da taswirar masu amfani na manhajar kanta. Ramin ya yi aikinsa a wannan lokacin, kuma ƙarin canje-canje a ASA suna ƙara haɗari ne kawai.