ASA: dekedda VPN iyo PAT-taagan ee DMZ ee hal IP dadweyne
Hal cinwaan dadweyne, laba adeeg. Liis-garee cinwaanka, gaadiidka iyo dekedda dhageystaha VPN iyo PAT-ta DMZ ka hor inta mid aanu qaadan gelinta kan kale.
Laba adeeg, hal cinwaan dadweyne, iyo magac DNS oo u eg inuu deked kaydsanayo. Ma yeelo. Ka hor inta aadan daabicin server DMZ oo ku xiga gelinta VPN ee ASA, qor tuplalka gelinta oo si taxane ah u hubi; goobta ugu horreysa ee la jaanqaadaya adeeg jira ayaa ah meesha qorshuhu joogsado. Waxa hoose oo dhan waxay u malaynayaan in VPN-ku ku dhammaado qalabka laftiisa, ma aha server gudaha ah.
Qor shanta goobood ka hor inta aadan qorin amarka
Gelitaan kasta oo dadweyne, diiwaangeli qoyska cinwaanka, cinwaanka dadweynaha, gaadiidka, dekedda dadweynaha iyo milkiilaha. Milkiiluhu waa adeeg maxalli ah oo ASA ah ama server gudaha ah oo la tarjumay. Laba gelitaan ayaa wadaagi kara cinwaan oo weli noqon kara tuplal kala duwan, laba gelitaanna waxay u muuqan karaan kuwo kala duwan jaantuska iyagoo ku dhacaya qalabka.
Hayso tiir labaad oo loogu talagalay dekedda dhabta ah, tii server guduhu runtii dhageysto. Dekedda dadweynaha iyo dekedda dhabta ah waa xulashooyin madax-banaan, daqiiqadda aad isku darana hal tiir waxaad lumisaa awoodda aad mar dambe u akhrido tarjumaaddaada.
| Public entry | Owner | Real side |
|---|---|---|
| TCP 443 on the outside address | ASA VPN listener | Appliance-local, no translation |
| TCP 8443 on the outside address | Static PAT | DMZ server TCP 443 |
| UDP 443 on the outside address | Check the effective listeners | Possibly the VPN data path |
Akhri si sax ah boosaska dhabta ah iyo kuwa khariidadaysan
Ka bilow tuplalka aad hore u haysato, ma aha server-ka aad rabto inaad ku darto. Qaybin tusaale ah ayaa gelinta VPN la ansixiyay ku haysa TCP 443 dadweyne oo daabacda server DMZ HTTPS oo ku yaal TCP 8443 dadweyne iyadoo serverkaasi weli dhageysto 443:
Public TCP 443 -> ASA VPN listener
Public TCP 8443 -> DMZ server TCP 443Amarka la dhaqan geliyay, adeegga dhabta ah iyo adeegga khariidadaysan waxay ku yaallaan boosas go'an, roganaantooduna waxay qeexdaa khariidad kale ma aha mid jabay. Tani waa habka ugu badan ee tarjumaad shaqaysa ay u noqoto halxiraale: qaabeyntu waa sax, waxay uun tilmaamaysaa meel kale.
Hagaha NAT ee ASA 9.16 ee Cisco wuxuu diiwaangelinayaa PAT taagan, isticmaalka cinwaanka interface-ka iyo macnaha dekedda dhabta ah iyo tan khariidadaysan. Akhri qaybta nooca aad runtii waddo; amarka laga xusuusto madal hore ma aha qaabeyn buuxda oo hadda jirta.
Tiri gaadiidka qayb ka mid ah kaydinta
TCP 443 iyo UDP 443 waa tuplal kala duwan, farqigaasuna si bilaash ah kuuma siiyo UDP. VPN waxay yeelan kartaa dhageysteyaal TLS iyo DTLS gooni ah, adeegyo kale oo qaabaysan ayaana laga yaabaa inay hore u hayaan gaadiidka aad rabto. Liis-garee dhageysteyaasha wax ku oolka ah iyo siyaasadda gelitaanka halkii aad ka malayn lahayd in bogga webku yahay gelinta VPN oo dhan.
Magac kale oo martigeliyaha ah oo isla cinwaankaas u xalliya ayaa isna ma xalliyo isku dhac heer gaadiid. DNS waa khariidad magac-ilaa-cinwaan, ma aha dillaaliyaha dekedda, daabacaadda server via PATna ma aha isla hawsha rarista dhageystaha VPN deked kale.
Haddii gelinta VPN runtii ay tahay inay dhaqaaqdo, afar shay ayaa wada beddelma: profile-ka macmiilka, URL dadweyne, shaandhaynta kor ku xusan iyo gaadiid kasta oo daabacaaddu isticmaasho. Ku samee hal shaybaar halkii mid mid loo samayn lahaa. Hayso waddo maamul gooni ah oo qalabka laga gaaro oo furan ka hor inta aadan taaban adeegga aad ku gaarto. Waddo labaad la'aan, dhaqaaqku waa isbeddel aadan dib uga noqon karin dibadda.
Xaqiiji dibadda isku-xirnaansho cusub
Oggolow kaliya codsiga DMZ ee loogu talagalay marka la eego siyaasadda gelitaanka wax ku oolka ah, ka dib hubi nidaamka tarjumaadda u dhigma, waddada soo noqoshada server-ka iyo magaca martigeliyaha ee shahaadada. PAT waxay beddeshaa goobta shabakada; ma bixiso gelitaan codsi mana hagaajiso shahaado magacawda martigeliyaha kale.
Tijaabi labada adeeg isku-xirnaansho cusub oo ka imanaya martigeliyaha dibadda ee la oggolaaday: VPN waa inuu weli dhisma, codsiga DMZna waa inuu gaaro dhageystaha loogu talagalay. Kulan dhisan ayaa hayn kara xaalad hore, sidaas darteed waxba kama caddaynayo khariidad aad beddeshay daqiiqad ka hor.
Xir wareegga adigoo cusboonaysiinaya liiska gelinta waxa aad daabacday, oo ay ku jiraan dhageyste kasta oo aad heshay halkii aad abuuri lahayd. Qofka xiga ee adeeg ku daabici doona cinwaankaas wuxuu ka bilaabmi doonaa shaxdaada, saf khaldanna halkaas ku kacaa wixii ka badan amarka khaldan halkan.