Failback ku yaal ASA: waxa dhab ahaan dhaqaaqa marka marinka soo noqdo
Marinka oo ku soo laabta marinka koowaad macneheedu maaha in qulqullada hore dhaqaaqeen. Eeg si wadajir ah uplink, tunnel, shaxda xiriirka iyo natiijada barnaamijka.
ASA leh laba uplink, failback ma aha lidka failover. Marinka peer-ka ayaa is beddela, ka dibna platformadu waa in ay isku waafajiso saddex mishiin oo xaalad ah oo kala duwan: shaxda marinnada, ururada amni ee IKE iyo IPsec, iyo shaxda xiriirka. Mid kastaa wuu ka dib mari karaa kuwa kale, waana dib u dhacaas waxa dadka badankiisu u tilmaamaan tunnel soo noqon waaya.
Waxa failback dhab ahaan beddelo
Raadinta marinka waa qaybta la arki karo. Marka shayga la ilaalinayo soo kabsado, marinka la ilaalinayo ee ciwaanka dibadda ee peer-ka ayaa soo noqda, baakadda xigta ee ASA dirto waxay mar kale raacdaa xiriirka koowaad. Wax kasta oo ka dambeeya waxay ku xiran yihiin haddii xaaladda jirta ay la socoto marinka cusub.
ARP iyo NAT waa ku-tiirsanaanta aamusan. Next hop cusub wuxuu u baahan yahay irrid la xallin karo iyo turjumaad wali la socota darafka fog, haddii kale baakadaha ugu horreeya ee failback ka dib meelna ma tagaan, marrinkuna wuu fiican yahay isagoo waxna shaqaynayn.
Afar aragti oo ku yaal hal khadka waqtiga
Qor isla afartaas shay ka hor isbeddelka, inta lagu jiro iyo ka dib, maxaa yeelay hal sawir ma sheegi karo lakabka dhaqaaqay.
| View | What to record |
|---|---|
| Uplink and route | Interface state, the tracked object result, the route selected for the outer peer address |
| IKE and IPsec | The live peer, IKE version, security associations, protected-traffic counters |
| Connection table | Interface and endpoint pair for old flows and for flows created after the change |
| Application | One pre-existing operation and one fresh request, each marked success, reset, stall or recovered |
Marin aan waligiis isbeddelin iyo marin isbeddelay iyadoo xiriir hore uu hayo xaaladdiisa gudbinta waxay soo saaraan isla cabasho iyo caddaymo gabi ahaan kala duwan.
Sababta xiriirka hore ugu sii jiraan marinka kaydka
ASA ma jebiyo qulqul sababta oo ah marrin isbeddelay. Xiriirka la aasaasay waxay hayaan go'aanka gudbinta ee lagu abuuray, platformaduna waxay bixisaa kontoroolo gooni ah oo ku saabsan inta waqti ee la oggol yahay: floating-connection timeout iyo connection holddown. Hagaha dejinta xiriirka ASA 9.24 ee Cisco waxay u arkaan su'aalo kala duwan, waana sida ay dhab ahaan u dhaqmaan. Mid wuxuu maamulaa badbaadada qulqulka jira; kan kalena goorta qulqullada cusub ay isticmaali karaan marinka la doorbido.
Ka hor inta aadan beddelin midkoodna, akhri qiyamka dhaqan gal ah ee noocaaga. Hoos u dhigistoodu waxay xidhaa fadhiyada dadku wali isticmaalayaan. Kor u qaadistoodu waxay failback ka dhigtaa mid aan waligiis dhicin, maxaa yeelay xiriirka cusub ayaa sii wada marinka hore muddada oo dhan.
Tunnel ma dib u gorgortamo furaha sababta oo ah marrin soo noqday
Ururrada amni ee IPsec waxay qaataan cimrigooda la gorgortamay oo waxay ka badbaadaan isbeddelka marinka ee qaaday. Sidaas darteed tunnel wuu sii joogi karaa failback inta lagu jiro, iyadoo ciwaanka dibadiisa aanu hadda la socon marinka la isticmaalayo; taas waa doodda DPD iyo naqshadaha xajiya ciwaanka peer-ka halkii ay u oggolaan lahaayeen inuu sabbeeyo.
Naqshadaha crypto-map iyo VTI si kale ayay u dhaqmaan halkan, iyo dukumeentiga Cisco ee 9.24 VTI wuxuu sharraxayaa ikhtiyaarka ku salaysan marinnada. Sheegashada guud ee hore ee ah in ASA aanu karin VPN ku salaysan marinnada lagu maamulo noocyada la taageeray.
Akhri caddaymaha sidaan u kala horreeya
Ka bilow heerka kontoroolka: show route marinka la doortay, show interface xaaladda xiriirka, iyo tireyaasha SLA monitor-ka ee shayga la ilaalinayo. Kadib akhri show crypto ikev2 sa, ama u dhigma IKEv1, si aad u aragto peer-ka nool, kadibna show crypto ipsec sa qulqullada la ilaaliyay. Kadib ku yaree shaxda xiriirka show conn address <host> oo isbarbar dhig tiirka interface-ka ee gelitaanka hore iyo kan cusub. Qor wax soo saarka oo leh sumadaha waqtiga, maxaa yeelay nidaamkoodu waa ogaanshaha.
Ku dhammee tijaabo barnaamij: hal qulqul oo hore u jiray iyo mid la abuuray ka dib markii marrinku soo noqday. Haddii qulqulka hore guul darro yeesho oo kan cusub shaqeeyo, waxaad haysataa sheeko xaalad xiriir. Haddii labaduba guul darro yeeshaan, tunnel ama siyaasadu waa khalad oo shaxda xiriirku waa mashquul.
Hayso diiwaankaas qaab isku mid ah saddexda weji, oo qor nooca saxda ah. Marka khadka waqtiga uu sii tilmaamayo hal isbeddel oo keliya, u dir diiwaanka taageerada halkii aad ka mala-awaali lahayd aqoonsiga khaladka.