VPN goob-ilaa-goob AWS ilaa Azure: marka hore qor wadada soo noqoshada
Tunnel isku xiran oo u dhexeeya laba daruuro ma caddeeyo wax ilaa subnetwork kasta oo shaqo u jiheeyo prefix-ka fog. Ku soco qorshaha si taxane ah, ka dibna tijaabi adeegga.
Tunnel-ku wuu soo bixi doonaa. Sida caadiga ah sidaas ayuu dhacaa, sababtoo ah IKE wuxuu u baahan yahay oo keliya soo jeedinno is waafajinaya iyo cinwaan saaxiib la gaari karo. Waxa ka dib guuldarraysta waa wadada soo noqoshada: shaqada AWS waxay u dirtaa baakadaha tunnel, laakiin wax Azure dhinaciisa ah ma oga sida looga jawaabo 10.10.0.0/16, ama wadada Azure waxay ku jirtaa shax aan subnetwork-ka shaqadu isticmaalin. Qor qorshaha wadooyinka ka hor inta aadan taaban wax console ah, tunnel-kuna wuxuu noqon doonaa qaybta ugu xiisaha yar ee shaqada.
Tallaabo 1: xajiso qorshaha cinwaannada
La shaqee qiyamyo cad. Shaqada AWS waxay ku taal 10.10.1.20 gudaha 10.10.0.0/16 waxayna u baahan tahay TCP 443 oo ku socota adeegga Azure ee 10.20.1.30 gudaha 10.20.0.0/16. Labada baaxadood waa in aanay is dul saarnaan, tijaabada aqbaalkuna waa lammaanaha adeegga, ma aha tunnel-ka.
Qor afartaas xaqiiqo ka hor wax kasta oo kale, sababtoo ah tallaabo kasta oo xigta waa lagu hubiyaa iyaga.
Tallaabo 2: magacaab albaabka leh labada gees
AWS Site-to-Site VPN wuxuu ku dhammaan karaa albaab gaar ah oo macmal ah ama albaab transit, kuwaasina waa milkiilayaal wadooyin oo kala duwan. Azure waxay bixisaa VPN Gateway maamulkeeda iyo, si gooni ah, qalab ku salaysan VM oo macaamiishu ay iyagu maamulaan. Diiwaangeli lammaanaha aad haysato, sababtoo ah boodhka xiga wuu ku kala duwan yahay isku darkasta.
Albaab maamulan, ha koobiyeen wado u jeedda cinwaan qalab gaar ah oo la qiyaasay. Qalab, ha u malayn in faafinta wadooyinka daruurta ay habayso nidaamka hawlgalka martida, sababtoo ah sidaas ma samayso.
Halkan qaladku wuxuu soo saaraa qorshe u eg mid dhamaystiran oo baakadaha u dira cinwaan aan waligii jawaabin.
Tallaabo 3: qor wadada ay shaqo kastaa runtii isticmaasho
Xad kasta oo hoose waa raadin gooni ah, wadada mid ka mid ahna ma aha wado baakadda. Buuxi shaxda qiyamkaaga ka hor inta tunnel-ku shaqayn.
| Boundary | Must reach | Owner to inspect |
|---|---|---|
| AWS workload subnet | 10.20.0.0/16 | the subnet's VPC route table |
| AWS transit gateway, if used | 10.20.0.0/16 via the VPN attachment | the table associated with that attachment |
| Azure workload subnet | 10.10.0.0/16 | effective routes on the NIC, whatever their source |
| VPN scope | both prefixes, agreed | static connection ranges or BGP advertisements |
AWS dhexdeeda, shaxda wadooyinka subnetwork-ka shaqadu adigaa leh inaad cusboonaysiiso xitaa ka dib marka BGP ama tunnel-ku caafimaad qaato; guudmarka wadooyinka waxay taas u qaddarisaa qayb ka mid ah xidhiidhka. Azure dhexdiisa, shaxda wadooyinka isticmaaluhu qeexay waxay la xidhiidhaa subnetwork halkii ay la xidhiidhi lahayd shabakadda macmalka ah, markaa hubi wadada waxtarka leh NIC-ka shaqada ee ma aha VNet-ka.
Albaabka Azure ee maamulan wuxuu bartan karaa prefix-ka fog iyada oo loo marayo faafinta albaabka, UDR-na waxay diidi kartaa go'aankaas. Ku dar UDR marka aad sabab haysato, ma aha caado. Haddii aad ku darto, u jihee boodhka xiga ee albaabku u soo bandhigo wadada VPN halkii aad abuuri lahayd cinwaan qalab. Kadib dib u akhri wadooyinka waxtarka leh ee NIC-ka, sababtoo ah go'aanka runtii halkaas ayaa lagu qaataa.
Tallaabo 4: is waafaji baaxadda
BGP, isbarbardhig waxa dhinac kastaa ku dhawaaqo iyo waxa dhinaca kale runtii bartay, prefix prefix. Wadooyinka joogtada ah, isbarbardhig baaxadaha fog ee la habeejey iyo wadooyinka shaqada ee aad ku qortay tallaabo 3.
Xidhiidhka IKE ee ku heshiiya cryptografia ma aha caddayn in dhinac kastaa bartay 10.10.0.0/16 ama 10.20.0.0/16. Laba tunnel ayaa kici kara iyada oo dhinac ku dhawaaqayo hal /24 halkii /16 aad qorshaysey. Hubi prefix-ka shaxda wadooyinka, ma aha xaaladda tunnel-ka. Ismaandhaafka wuxuu ka muuqdaa markii dambe sida hal subnetwork shaqeeya iyo mid aan waligii jawaabin.
Tallaabo 5: tijaabi adeegga isha dhabta ah
U oggolow socodka loogu talagalay kooxaha amniga AWS iyo ACL-yada shabakadda, NSG-yada Azure, iyo shaandhaynta qalab kasta oo jidka ku yaal. Kadib fur hal xidhiidh laga bilaabo 10.10.1.20 oo u socda cinwaanka iyo dekedda adeegga la ansixiyey oo xaqiiji in jawaabtu ku soo noqoto isla ishaas.
Kooxaha amniga daruurta iyo NSG-yada labaduba waa stateful, markaa baakad soo noqosho la diiday waa calaamad wadooyin, ma aha sharci aad illowday inaad qorto dhanka kale.
Ping ka imanaya albaab kasta waxba ma go'aamiyo. ICMP cinwaanka albaabka wuxuu tababaraa jidka kontoroolka, ma aha adeegga TCP ee la gudbiyey ee shaqadu u baahan tahay.
Dib u noqosho iyo diiwaanno
Diiwaangeli milkiilayaasha wadooyinka agtooda aqoonsiga tunnel-ka, oo kaydi shaxaha wadooyinka ka hor isbeddelka. Haddii isbeddelka la bixiyo, ka saar wadooyinka shaqada ka hor inta aadan dumiyin tunnel-ka, si aan subnetwork u hadhin oo u jeedda boodhka xiga oo aan hadda jirin.
Markaas guuritaan subnetwork dambe ama isku xidhka spoke wuxuu leeyahay hal meel oo go'an oo lagu cusboonaysiiyo, halkii tunnel shaqeeya oo qaada eedda wado uusan waligii lahaan.