Me ya sa Azure Point-to-Site VPN ba ya canza IP ɗinka na jama'a
Tunel ɗin point-to-site yana ɗaukar hanyoyin cibiyar sadarwar kama-da-wane kawai, don haka IP ɗinka na jama'a yana zama na gida har sai tunel ɗin tilas da SNAT na wutar bango sun koma hanyar fita zuwa Azure.
Ina haɗa abokin ciniki na Azure VPN a kan kwamfutar tafi-da-gida ta Windows, in buɗe shafin amsa adireshi kuma in ga adireshin jama'a ɗaya da na'urar gidanmu ta bayar. A cikin haka, akwatin tsalle a 10.20.0.4 yana amsawa kuma ana warware sunan ƙarshen wuri na sirri, don haka tunel ɗin bai karye ba. Ƙofar point-to-site tana yin daidai abin da tsarin sa na asali ya faɗa: tana ɗaukar prefixes na sirri kuma tana barin sauran komai a kan hanyar gida. Samun adireshin fita mallakar Azure canji ne a tsarin turawa, ba gyara ba.
Abin da ƙofar ke sanarwa ta asali
Ƙofar tana tura hanyoyi don sararin adireshin cibiyar sadarwar kama-da-wane, da cibiyoyin sadarwa na tsara inda aka yarda da wucewar ƙofa da prefixes na gida da aka koya ta hanyar haɗin site-to-site ko BGP. Babu 0.0.0.0/0 a cikin wannan saitin. Tsarin aiki naka yana riƙe hanyarsa ta asali a Wi-Fi ko Ethernet, don haka fakiti zuwa API na jama'a ba ya shiga tunel ɗin kwata-kwata.
Adireshin da abokin ciniki ke samu a cikin tunel ɗin hayar sirri ce daga tafkin point-to-site. Yana gane abokin ciniki ga albarkatu a cikin VNet; ba adireshi ba ne da intanet za ta iya gani, kuma ba zai taɓa bayyana a matsayin tushen buƙatar fita zuwa API na SaaS ba. Shigar da ke cikin jerin izini da aka gina a kan wannan hayar ba zai iya aiki ba, duk tsawon lokacin da za ka jira ya bayyana a cikin rajistan mai sayarwa.
Tunel ɗin raba da tunel ɗin tilas gefe da gefe
| Split tunnel, the default | Forced tunneling | |
|---|---|---|
| Internet traffic exits through | local ISP or office router | firewall or appliance inside Azure |
| Source address the API sees | your home or office IP | the firewall public IP |
| Inspection and logging in Azure | none | policy rules plus flow logs |
| Ongoing cost | gateway only | gateway, firewall hours, data processing |
| What usually breaks | nothing on the egress path | DNS, on-premises routes, overlapping local ranges |
Layi na biyu ne kaɗai ke canza adireshin da sabis mai nisa ke gani. Duk sauran a cikin wannan tebur kuɗi ne da saman aiki da kake karɓa lokacin da dole ne a duba ko a fassara hanyar fita a cikin Azure. Idan wani ya ce ka sa IP na jama'a ya canza, yana neman dukan ginshiƙin dama ne, ba gyara ƙarami a abokin ciniki ba.
Akwai wani zaɓi na tsakiya da ya cancanci ambata kafin ka sake gina wani abu. VM na wakili ko ƙofa a cikin VNet yana ba ka adireshin tushe mai sarrafawa ga aikace-aikacen da za a iya turawa zuwa gare shi, ba tare da motsa hanyar asali ta abokin ciniki ba. Wannan yana barin bincike na yau da kullum a gida kuma har yanzu yana gamsar da abokin tarayya wanda kawai yake buƙatar kira ɗaya na API ya zo daga Azure. Yana kasawa lokacin da buƙatar ta shafi duk zirga-zirga da gaske, domin duk abin da ya yi watsi da saitin wakili yana fita a gida.
Sa tunel ɗin ya ɗauki hanyar asali
A kan ƙofar cibiyar sadarwa ta kama-da-wane, hanyar da aka goyi bayan turawa duk zirga-zirgar intanet na abokin ciniki cikin tunel ita ce ƙara hanyoyi na al'ada a tsarin point-to-site. Rabi biyu sun rufe dukan sararin IPv4, kuma kowanne ya fi hanyar asali ta gida takamaimai, don haka abokin ciniki yana fifita su ba tare da share komai ba:
Set-AzVirtualNetworkGateway -VirtualNetworkGateway GWOBJ -CustomRoute 0.0.0.0/1,128.0.0.0/1Wannan layin misali ne ba cikakke don kwafi ba: da farko ka samo abin ƙofar da Get-AzVirtualNetworkGateway ka maye gurbinsa da GWOBJ, kuma ka tabbatar SKU da tsarin turawa suna karɓar hanyoyi na al'ada kafin ka gudanar da shi. Ƙa'idodin guda ɗaya suna bayyana a cikin falo a shafin tsarin point-to-site, wanda shine wuri mafi aminci don saita su idan ba ka riga ka yi rubutun ƙofar ba.
Canza waɗannan prefixes yana ɓata fakitin abokin ciniki. Sake saukar da fakitin abokin ciniki na VPN ka sake shigar da shi, domin hanyoyin suna tafiya a cikin bayanin martaba. Abokin ciniki da ya sake haɗawa da tsohon bayanansa yana riƙe da tsohon saitin hanyoyi, kuma za ka iya rasa awa ɗaya wajen gyara canjin da bai taɓa isa gare shi ba.
A cikin hub na WAN kama-da-wane mai tsaro, daidai yake hanyar asali a teburin hanyoyin hub ɗin da ke da alaƙa da ƙofar point-to-site, tare da Azure Firewall a cikin hub ɗin yana ɗaukar zirga-zirgar. Wutar bango tana fassara haɗin da ke zuwa intanet zuwa adiresoshin IP na jama'a nata, kuma daga wannan fassarar ne sabon adireshin fita ke zuwa. Lokacin da wutar bango ke da IP na jama'a da yawa, kowanne daga cikinsu na iya bayyana a matsayin tushe, don haka jerin izini dole ne ya riƙe su duka.
Dukansu ƙirar biyu na sama IPv4 ne. Prefixes biyun /1 ba su yin komai ga IPv6, kuma tallafin IPv6 na point-to-site ɗinƙure ne don ka gwada haɗin kafin ka yi alkawarin daidaito.
Duba hanyar, sannan dubi hanyar fita
Bayan sake shigar da fakitin da sake haɗawa, tabbatar abokin ciniki ya shigar da rabin biyu da gaske. A Windows, Get-NetRoute -DestinationPrefix 0.0.0.0/1 da tambayar guda ɗaya don 128.0.0.0/1 ya kamata su ambaci hanyar tunel, kuma route print yana nuna dukansu kusa da hanyar asali ta asali. A Linux, ip route show dole ne ya jera prefixes biyun; idan bai yi ba, bayanin martaba bai taɓa ɗaukar su ba.
Sannan sake duba adireshin jama'a daga abokin ciniki ka karanta rajistan wutar bango don wannan haɗin. Tushen ya kamata ya zama IP na jama'a na wutar bango tare da tashar da aka fassara. Abokin ciniki da har yanzu yake fita a gida alhali duk hanyoyin biyu suna nan yana nufin fakiti sun isa Azure kuma sun fita ta wata hanya: hanyar da mai amfani ya ayyana a kan subnet ɗin ƙofar, wutar bango da ita kanta aka tilasta ta tunel zuwa cibiyar gida, ko manufar da ke watsar da kwararar kafin fassarar.
Sake gwada wata manufa ta sirri a cikin zaman guda. Mai karɓar bakuncin tsalle da ya daina amsawa bayan canjin shine alamar da aka saba cewa sabbin prefixes sun kori wani abu, ko dai wata hanya ta gida mafi ƙunci da aka sanar a baya ko warware suna da yanzu ke zuwa mai warwarewa marar tura gaba don yankunanka na sirri.
Yaushe za ka bar tunel ɗin raba shi kaɗai
Idan manufar ita ce kawai isa ga API na sirri, ƙarshen wuri na sirri ko shafin gudanarwa na ciki, halin asali ya fi arha kuma ya fi shiru. Tunel ɗin tilas yana ƙara awanni na wutar bango da kuɗin sarrafa bayanai, hanya mai tsawo, da wani wuri da kowace kwararar abokin ciniki za ta iya kasawa. Hakanan yana kama zirga-zirga da yawa fiye da manufa ɗaya da ka damu da ita.
Ka kai gare shi lokacin da aka faɗi buƙatar a fannin fita: abokin tarayya dole ya ga tabbataccen adireshin Azure, tsaro yana son a yi rajista da duba haɗin, ko bayanai dole su fita ta wuri ɗaya mai sarrafawa. Ko a lokacin ƙirar tana ba kowane mai amfani hanyar fita ta tarayya, don haka lissafin kowane mai amfani dole ya fito daga ainihi a cikin aikace-aikacen ba daga adireshin tushe ba.
Kafin ka rufe canjin, tabbatar da abubuwa huɗu: fakitin abokin ciniki da aka shigar sabo ne, hanyoyin /1 guda biyu suna kan hanyar tunel, wata manufa ta sirri har yanzu tana amsawa, kuma rajistan sabis mai nisa yana nuna adireshin wutar bango.