AWS Site-to-Site VPN: dibadda, gudaha iyo prefix-ka LAN

Inta badan khaladaadka AWS Site-to-Site VPN waa khaladaad cinwaan, waxaana la sameeyaa ka hor inta aan xitaa hal xidhmo dhaqaaqin. Cinwaannada dibadda ee tunnel-ka waxay gaaraan IPsec peers, cinwaannada gudaha waxay sameeyaan xiriirka jihaynta dhexdooda, iyo prefix-yada la ilaaliyay waa waxa xiriirkaas loo jiro. Koobi hal door mid kale, tunnel-ku wuu soo baxaa iyada oo aan waxba la jihayn. Waa tan isku xigxiga akhri-hubin-dejiso ee aan ku isticmaalo gateway-ga macmiilka BGP, qiimayaashuna waxay ka yimaadaan dejinta qalabka la soo dejistay, ma aha xusuusta.

Saddex door oo cinwaan, hal tunnel

Cinwaannada dibadda waa dadweyne oo waxay leeyihiin IPsec peers: mid tunnel kasta oo ku yaal dhinaca AWS, iyo aqoonsiga la gaari karo ee gateway-ga macmiilka dhinacaaga, oo la waafajiyay habka NAT ee aad dhab ahaan haysato. Cinwaannada gudaha waa gaar oo waxay leeyihiin xiriirka macquulka ah, oo AWS u diiwaangeliso /30 laga soo qaatay 169.254.0.0/16. Prefix-yada la ilaaliyay waa shabakadaha VPC, gudaha ama transit ee aad ku jihayso oo ku dhawaaqdo xiriirkaas.

U yeelashada prefix LAN cinwaanka interface-ka tunnel-ka waa qaabka caadiga ah ee khaladkan. Interface-ku wuxuu u eg yahay mid la dejiyay, LAN lama dhawaaqo, dhinaca kalena ma laha waddo loo maro. Tunnel-ku xitaa wuu dhaafi karaa ping-giisa gudaha, halka magac kasta oo application-ku waqti ka baxo. Tixraaca ikhtiyaarada tunnel-ka waxay taxdaa xaddidaadda CIDR gudaha, oo ay ku jirto baaxadda cinwaanka ay tahay inuu ka yimaado.

Akhri qiimayaasha dejinta la soo dejistay

Ka soo dejiso dejinta qaabka qalabkaaga gaar ah xiriirka, ka dibna u qaado shaxda cinwaankiisa sida isha runta. Console-ku wuxuu muujiyaa isla qiimayaasha tunnel kasta: IP dibadda, CIDR gudaha iyo cinwaanka BGP peer-ka dhinaca AWS. Labada tunnel waa walxo gooni ah oo leh dhammaadka dibadda gooni ah iyo /30 gudaha gooni ah, in kasta oo labaduba qaadaan isla shabakadaha la ilaaliyay.

aws ec2 describe-vpn-connections --vpn-connection-ids vpn-0123456789abcdef0 \
  --query 'VpnConnections[0].Options.TunnelOptions[].[OutsideIpAddress,TunnelInsideCidr]'
aws ec2 describe-customer-gateways --customer-gateway-ids cgw-0123456789abcdef0 \
  --query 'CustomerGateways[0].[IpAddress,BgpAsn]'

Haddii faylka la soo dejistay iyo console-ka tooska ahi aanay is waafaqin, faylku wuu duugoobay. Mar kale soo dejiso halkii aad cinwaannada gacanta ku tirito, sababtoo ah is waafaqla'aanta lammaanaha gudaha iyo deriska la dejiyay ee peer-ka waa guuldarro BGP oo aamusan.

Dhis xiriirka cinwaanka saxda ah

Gateway-ga Linux tunnel-ku waa interface VTI ama XFRM, /30 gudahana waxa uu dul yaallaa interface-kaas. Laba tunnel waxay ula jeedaan laba interface iyo laba deris BGP, mid kasta oo AWS endpoint ah. Habka AWS ku daabacdo dejinta qalabka la soo dejistay wuxuu gateway-ga gaarka ah ee virtual dhigaa cinwaanka koowaad ee /30 kasta oo gudaha ah, gateway-ga macmiilkaagana kan labaad, sidaas darteed waxaad qaadataa cinwaanka sare oo waxaad la peer-garaysaa kan hoose. Waxba halkan uma baahna cinwaan LAN.

ip tunnel add tun0 mode vti local 203.0.113.10 remote 18.230.1.1 key 42
ip addr add 169.254.10.2/30 dev tun0
ip link set tun0 up mtu 1400
ip tunnel add tun1 mode vti local 203.0.113.10 remote 18.230.2.1 key 43
ip addr add 169.254.10.6/30 dev tun1
ip link set tun1 up mtu 1400

Haddii faylka qaabka qalabkaagu daabaco lammaanaha lidka ku ah, isticmaal tirooyinkiisa oo xaji qaanuunka: cinwaanka interface-ka adigaa leh, cinwaanka peer-ka AWS ayaa leh. Lidka ku samaynta waxay soo saartaa tunnel aan waligiis gaarin Established, sababtoo ah deriska aad dejisay waa cinwaanka interface-kaaga horey u haysto.

Hayso calaamadda iyo fure VTI oo la jaanqaadaya waxa IKE daemon u isticmaalo inuu SA ilmo ku xiro interface-ka, haddii kale taraafikadu waxay ku timaaddaa tunnel-ka iyada oo aan interface la degi karo. Hubi MTU marka la barbardhigo waddada iyo dejinta IKE daemon-ka laftiisa halkii aad lambar ka koobi lahayd goob kale.

Hubi BGP ka hor inta aadan hubin waddooyinka

IPsec oo soo baxa wuxuu caddeeyaa in peers-ku ay ku heshiiyeen urur ammaan ah iyo wax kale ma aha. Fadhiga BGP waa wada-hadal gooni ah oo ku saabsan xiriirka gudaha, sidaas darteed akhri xaaladda deriska iyo tiriyayaasha prefix-yada, ka dibna la barbardhig waxa aad doonayay inaad ku dhawaaqdo.

ip -s addr show dev tun0
vtysh -c 'show bgp summary'
vtysh -c 'show bgp neighbors 169.254.10.1'
vtysh -c 'show ip bgp neighbors 169.254.10.1 advertised-routes'

Xaaladda Established oo leh eber prefix oo la helay waa mushkilad siyaasad ama dhawaaq, ma aha mushkilad tunnel. Ku celi hubinta oo dhan tunnel-ka labaad; tunnel-ka koowaad ee shaqeeya wuxuu kuu sheegaa in cinwaannadu macquul yihiin, ma aha in tunnel-ka labaad la dejiyay.

Raac xidhmo la jihayay, ka dib jooji

Marka fadhigu qaado prefix-yada, tijaabi waddada labada jiho laga bilaabo gateway-ga: cinwaanka isha, tallaabada xigta iyo siyaasadda ammaanka ee u oggolaanaysa taraafikada. Fadhiga BGP wuu sarreeyi karaa halka prefix-ka gaarka ah ee application-kaagu u baahan yahay la shaandheeyay, la soo koobay ama u jeediyay interface khaldan.

Reachability Analyzer waa qalabka dhinaca AWS ee qaata isha, meesha loo socdo iyo waddada, kadibna soo sheega qaybta keenta ee ku xannibtay dejinta la taageeray. Isticmaal si aad u tijaabiso waddada VPC ilaa cinwaanka gateway-ga macmiilkaaga, ma aha laga bilaabo martigeliyaha application-ka. Wuxuu falanqeeyaa dejinta mana u diri xidhmo dhanka firewall-ka gudaha, sidaas darteed ka sooc go'aankiisa tiriyayaasha interface-kaaga iyo qabashada xidhmadaada.

Diiwaangeli lammaanaha dibadda, /30 gudaha iyo prefix-yada la dhawaaqay tunnel kasta shax ku yaal. Shaxdaas ayaa ka dhigta isbeddelka xiga mid dib loo eegi karo.