Me ya sa na’urar VPN a cikin VM ta Azure ke rasa hanyar dawowa
Na’urar VPN a cikin VM ta Azure na bukatar UDR, tutar tura kaya a kan katin cibiyar sadarwa da manufofin baƙo su daidaita. Bi buƙatar reshe ɗaya ta cikin ukun.
VM ta Azure da ke gudanar da na’urar VPN tana cikin tsarin yanke shawara guda biyu masu zaman kansu. Azure yana yanke shawarar inda fakiti ke barin wata ƙaramin cibiya, ta amfani da allunan hanya da saitin tura kaya na katin cibiyar sadarwa. Tsarin aiki na na’urar da kansa yana yanke shawarar ko zai tura fakiti da aka buɗe zuwa gaba. Wurin da ya tashi daidai zai iya kasawa a tsarin na biyu, kuma a nan ne yawancin irin waɗannan turawa suke tsayawa.
Masu hanya guda uku
Ɗauki cibiyar reshe 192.168.50.0/24 da ƙaramin cibiyar aikin yi 10.0.10.0/24, na’urar kuma tana a 10.0.0.4 a cikin nata ƙaramin cibiya. Buƙata ɗaya tana taɓa saituna uku daban-daban.
| Decision | Configured in | How it fails |
|---|---|---|
| Where the workload subnet sends branch traffic | Azure route table entry | Traffic leaves the subnet and never reaches the appliance |
| Whether a NIC may accept traffic not addressed to it | Azure NIC IP forwarding | Packets arrive and disappear at the interface |
| Whether the guest forwards decrypted traffic | Guest OS or vendor appliance policy | Tunnel is up, workload is unreachable |
| Whether the workload accepts the source | NSG and service policy | Requests delivered, replies refused |
Kowane layi wata ƙungiya ce ta daban ke mallakarsa a yawancin ƙungiyoyi, shi ya sa wannan matsala yawanci tana zuwa a matsayin tikiti uku maimakon ɗaya.
Hanyar da ke nuni ga na’urar
Haɗa allon hanya da ƙaramin cibiyar aikin yi kuma ba wa gaban reshe mataki na gaba na nau’in Virtual appliance tare da 10.0.0.4 a matsayin adireshi. Yi amfani da adireshin sirri da ake iya samu na na’urar, kada ka taɓa wurin shigarta na VPN na jama’a. Mataki na gaba dole ne ya zama adireshin da ƙaramin cibiyar aikin yi ke iya isa gare shi tukuna. Bar sauran turawar aikin yi yadda take, sai dai idan ka yanke shawara da gangan ka maye gurbin hanyar da aka saba.
Riƙe na’urar a cikin nata ƙaramin cibiya, kuma tabbatar da cewa hanyar da ke tura zirga-zirgar reshe zuwa na’urar ba ta kama hanyar fita ta na’urar kanta ba. Irin wannan madauki yana kama da ingantaccen wuri mara amsa, kuma wannan abu ne mai matuƙar wahala a gyara a ƙarfe 2 na dare.
Tutar katin cibiyar sadarwa da kowa ke mantawa
Azure na da saitin tura IP ga kowane katin cibiyar sadarwa, kuma a kashe yake bisa tsoho. Yana wanzu saboda katin da ke tura kaya yana karɓar fakiti da aka aika wa wani abu daban, kuma jefar da su cikin shiru shine amintaccen tsoho ga kowa.
az network nic update --resource-group rg-net --name appliance-nic --ip-forwarding true yana kunna shi ga muƙala ɗaya. Jagorar Microsoft kan tura kaya a katin cibiyar sadarwa tana buƙatar saitin a kowane katin da aka haɗa da ke tura zirga-zirga, don haka na’ura mai kati ɗaya tana buƙatarsa a kan wannan katin.
Tutar ba hanya ba ce kuma ba ƙa’idar bangon wuta ba ce. Kunna ta yana ba da izini kawai.
Abin da baƙo ke yi da fakiti da aka buɗe
Da zarar wurin ya ƙare, tarin na’urar da kanta yana yanke shawara ta gaba. A kan baƙon Linux, tura IPv4 saitin lokacin aiki ne, kuma sysctl -w net.ipv4.ip_forward=1 yana dawwama har zuwa tashi na gaba. Ajiye shi a cikin fayil a ƙarƙashin /etc/sysctl.d/ maimakon haka. Na’urar mai sayarwa tana da nata kwatankwacin, kuma umarnin Linux da aka liƙa a dandalin mai sayarwa yawanci ba sa yin komai.
Manufofin bangon wuta na baƙo daban ne kuma, haka ma ƙungiyar tsaron cibiyar sadarwa ta aikin yi. Ba da izinin UDP 500 da 4500 zuwa adireshin jama’a na VM yana kare wurin; ba ya faɗin komai game da ko buƙatar reshe da aka buɗe za ta iya isa tashar aikin yi.
Bi buƙata ɗaya da amsarta
Zaɓi kwarara ɗaya da aka halatta ka bi ta daga farko zuwa ƙarshe. Reshe yana buƙatar hanya don 10.0.10.0/24 ta hanyar haɗin wurin, na’urar tana buƙatar hanyar isar da kaya zuwa ƙaramin cibiyar aikin yi, kuma ƙaramin cibiyar aikin yi tana buƙatar hanyar dawowa zuwa reshe.
Yanke shawara da wuri ko tsarin yana kiyaye adireshin tushen reshe ko yana fassara shi. NAT yana canza abin da aikin yi ke gani, don haka ƙa’idodinsa na shiga ya kamata su bayyana tsarin da ka zaɓa da gaske ba adireshin ƙofa da aka yi tsammani ba.
Musafaha mai nasara yana tabbatar da hali ɗaya na wannan sarƙa. Hanyar ta cika lokacin da amsar ta dawo ta cikin wannan na’urar kuma manufofin aikin yi da kansa ya halatta shi.