Macaamiisha VPN ee ASA waxay cinwaanno ka helaan barkada DHCP ee qaldan

Akhri dhcp-server iyo dhcp-network-scope ee ASA sidii laba goobood oo kala duwan, dhig scope-ka cinwaan la marayo oo ka baxsan barkada, kadib hubi wadada.

Macaamiisha AnyConnect waxay u soo baxaan shabakad-hoosaad khaldan, ama server-ka DHCP wuu diiday inuu waxba bixiyo, halka siyaasadda kooxdu ay u muuqato mid sax ah marka hore. ASA waxaa ku yaal laba goobood oo laba meelood, oo labaduba u eg «cinwaannadu meeye ka yimaadaan», oo midka khaldan dhigistiisu waxay keentaa sidaan. Profaylka isku xirka wuxuu magacaabaa server-ka DHCP; siyaasadda kooxdu waxay magacaabaa shabakad-hoosaad uu serverkaasi ka dooranayo. Midkoodna ma abuuro barkad.

Saddex shay, saddex su'aal

Marka hore kala sooc qaabka qoondaynta iyo barkada, maxaa yeelay labada qaab ma wadaagaan habaynta. Haddii ASA uu isagu qaybiyo cinwaannada, waxaad qeexdaa barkad gudaha ah oo siyaasadda kooxda u jeediso. Haddii server DHCP dibadeed uu qaybiyo, profaylka isku xirku wuxuu magacaabaa serverkaas, siyaasadda kooxduna waxay bixisaa tilmaan scope. Labada isku darista waa sababta caadiga ah ee cinwaanku waligiis uusan u soo muuqan.

IntentObjects involved
ASA allocates from its own poolip local pool plus the group policy's address-pool
External DHCP allocatesdhcp-server on the tunnel group, dhcp-network-scope on the group policy

Akhri qiyamka shaqaynaya ka hor intaadan mid beddelin

Sadar la dhaafay ma la mid aha none cad. Habaynta socota waxay tusinaysaa waxaad qortay; show run all group-policy wuxuu tusinayaa waxa siyaasaddu runtii ku xallinayso, oo ay ku jiraan kuwa caadiga ah ee la dhaxlay. Hubi labadaba ka hor intaadan go'aansan in scope-ku khaldan yahay, maxaa yeelay siyaasad koox oo ka dhaxasha siyaasad caadi ah waxay bixin kartaa qiime aan waligiis ka muuqan liiska gaaban.

show running-config group-policy RemoteStaff
show run all group-policy RemoteStaff
show running-config tunnel-group RemoteStaff
group-policy RemoteStaff attributes
 dhcp-network-scope ?

? soo-saarku waa qiimo leh in laga akhriyo nooca aad rakibtay, maxaa yeelay qiyamka la aqbalay iyo qoraalka caawimaaddoodu way kala duwan yihiin noocyada. Tixraaca Cisco ASA 9.24 ee siyaasadda kooxda wuxuu sifaynayaa astaantan sidii cinwaan la mari karo oo ku yaal shabakad-hoosaadka loo baahan yahay, ka baxsan barkada qoondaynta, iyadoo cinwaanka interface-ka la doorbidayo. Ma aha baaxadda barkada, mana aha lambarka shabakadda.

Dhig scope-ka cinwaan, ma aha baaxad

Ka soo qaad in barkada aad rabto in serverku isticmaalo tahay 10.50.30.50 ilaa 10.50.30.200 oo ku yaal /24, iyo interface-ka ASA ee qaybtaas oo ah 10.50.30.1. Qiimaha scope-ku waa 10.50.30.1. Qorista 10.50.30.0 way guuldareysataa maxaa yeelay waa lambarka shabakadda, qorista baaxadduna way guuldareysataa maxaa yeelay astaantu waxay qaadataa hal cinwaan. Haddii cinwaanka aad dooratay uusan ahayn cinwaanka interface-ka, wuxuu u baahan yahay waddo joogto ah si jawaabta server-ka DHCP ay u gaadho.

group-policy RemoteStaff attributes
 dhcp-network-scope 10.50.30.1

Qaybtani waxay samaysaa hal shay oo keliya. Ma habayso server-ka DHCP, kama abuurto barkad halkaas, mana ka dhigto profayl gelitaan fog oo qayb ahaan shaqaynaya mid shaqeeya. Habdhaqanka halkan lagu diiwaangeliyay waa IPv4 oo keliya; ha filan inuu maamulo DHCPv6 ama delegashka prefix-ka.

Ku beddel barta dib u noqoshada

Marka hore qaado snapshot, si dib u noqoshadu u noqoto amar ee ma aha dib u dhis. Kaydi habaynta la xiriira fayl ka hor tafatirka, oo ogow waxa no ku soo celiyo noocaaga: wuxuu astaanta ku celiyaa qiimaheeda caadiga ah ama la dhaxlay, oo laga yaabo inuu none yahay halkii siyaasadda ka sarreeya.

copy running-config flash:pre-dhcp-scope.cfg
conf t
 group-policy RemoteStaff attributes
  no dhcp-network-scope
  dhcp-network-scope 10.50.30.1
 end
write memory

Ka saarista astaantu waa tallaabo cilmi-baaris sidoo kale. Marka scope aan la qeexin, server-ka DHCP wuxuu ku raadiyaa barkadihiisa cinwaan aan la qoondeyn, sidaas darteed macmiilku wuxuu ku dhici karaa meel lama filaan ah laakiin ugu yaraan wuu isku xiraa. Natiijadaas waxay sheegaysaa in wadada codsigu shaqayso iyo in doorashada barkadu tahay tan guuldareysata.

Hubi cinwaanka, wadada iyo ogolaanshaha

Qoondaynta ka akhri shaxda kulamada ee ha ka akhrin wada-hadalka macmiilka, kadib xaqiiji in cinwaanku uu dib ugu laabanayo tunnel-ka oo la mari karo iyo in filtarada siyaasadda kooxdu ay ogolaadaan taraafikada aad filayso. Go'aanka qoondayntu ma aha go'aan marrin, macmiilka hela cinwaan ka yimid barkada saxda ah weli wuu ku guuldareysan karaa codsi kasta.

show vpn-sessiondb detail anyconnect filter name testuser
show ip local pool
show route | include 10.50.30
ping 10.50.30.61 source inside

Haddii kulanku muujiyo cinwaankii aad doonayay laakiin taraafikadu dhimato, scope-ku wuu dhammaaday isagoo tuhman. Eeg wadada dib u noqoshada, habaynta split-tunnel ama filtarada ku yaal siyaasadda kooxda, iyo in scope-ka DHCP uu ku yaal qaybta ASA runtii u maro.

Maqaallo la xiriira