Sida AWS looga bilaabo tunnel Site-to-Site VPN
Ficilka bilowga iyo ficilka waqtiga DPD waxay ka jawaabaan su'aalo kala duwan. Deji tan AWS ka bilowda, ka dib hubi cinwaanka lamaanaha iyo wadada abka.
Sida caadiga ah, AWS Site-to-Site VPN waxay sugtaa in customer gateway bilaabo wada-hadalka. Caadigaas waa dejinta, ma aha sharci, dejintana waxaa la yiraahdaa Startup action. Kahor intaadan u gacan galin, kala sooc laba su'aal oo had iyo jeer isku dhaca: yaa dhisaya tunnel-ka, iyo haddii baakadaha aad danaynayso ay leeyihiin waddo dhex mara. Kaliya tan hore ayaa ku jirta xulashooyinka tunnel-ka.
Kala sooc ficilka bilowga iyo ficilka waqtiga DPD
Laba xulasho oo tunnel kastaa waxay maamulaan laba dhacdo oo kala duwan, dejinta midna wax kama sheegto tan kale.
| Event | Option | Useful values |
|---|---|---|
| A new or modified VPN connection needs a tunnel | Startup action | add waits for the peer; start asks AWS to initiate |
| Dead peer detection times out | DPD timeout action | clear ends the session, restart reinitiates, none does nothing |
Haddii AWS ay tahay inay dhiso tunnel cusub ama la beddelay, dooro start. Haddii AWS ay sidoo kale tahay inay dib u bilaabato wada-hadalka ka dib waqtiga DPD, si gaar ah u habee restart dhacdaas. Midkoodna maahan siyaasadda isku-dayga abka, midna maahan inta u dhaxaysa beddelka furaha: DPD waxay hubisaa in lamaanaha nool yahay, halka beddelka furaha uu beddelo security associations tunnel firfircoon.
Abka waqtigiisu dhamaado halka tunnel-ku wali soo sheegayo up waxay leedahay dhibaato wadada xogta. Soo-gaabinta timer-ka DPD ma hagaajinayso arrintaas, waxayna ku dari kartaa qalalaasaha aad hadhow sharraxdo.
Hubi in AWS uu leeyahay meel uu wada-hadalka u diro
Bilowga dhinaca AWS wuxuu kaliya ku shaqeeyaa IKEv2, AWS-na waxay u baahan tahay cinwaanka guud ee customer gateway si ay u ogaato halka soo jeedinta loo diro. Kiiska ugu xanuunka badan waa kheyraad customer gateway oo shahaado lagu xaqiijiyey oo la abuuray cinwaan la'aan: dukumeentiga AWS wuxuu qeexayaa abuurista kheyraad cusub oo customer gateway leh cinwaanka ka dibna beddelka xiriirka VPN si uu u tilmaamo.
Shahaadadu waxay caddaynaysaa yaa lamaanaha. Kama sheegto AWS halka lamaanuhu joogo, kuwaana waa laba shuruudood oo kala duwan. Sidaas darteed xalku maahan shahaado cusub, waa kheyraad cusub oo customer gateway. Beddelka shahaadadu waxay AWS uga tagtaa isla bartilmaameedka maqan.
Haddii customer gateway uu ka dambeeyo NAT, AWS waxay sidoo kale u baahan tahay responder identity la habeeyey, IDr, si aqoonsiga lamaanaha uu u dhaco waxa qalabku filan yahay. Xaqiiji qiimahaas iyo wadada dab-demiska ee oggolaata socodka IKE kahor intaadan eedayn xulashada aad hadda beddeshay. Doorashada start ma qasbi karto lamaan aan la gaari karin ama si khaldan loo aqoonsaday inuu aqbalo soo jeedin.
Ku dabaq isbeddelka hal tunnel oo filo hakad
Xiriirka VPN wuxuu leeyahay laba tunnel oo leh xulashooyin madax-bannaan, sidaas darteed cinwaanka dibadda ku xaqiiji midka aad wax ka beddelayso. AWS waxay oggolaataa in hal tunnel la beddelo mar, xiriirka tunnel-ka la doortayna wuu go'i karaa dhowr daqiiqo.
- Dooro xiriirka Site-to-Site VPN oo fur Modify VPN tunnel options.
- Dooro tunnel-ka cinwaanka IP dibadda oo xaqiiji nooca IKE iyo kheyraadka customer gateway.
- Deji ficillada bilowga iyo DPD ee aad runtii rabto, ka dibna kaydi waqti aad maamusho.
- Xaqiiji in tunnel-ka la beddelay uu dhismayo, oo hubi tunnel-ka kale iyo dariiqa kahor isbeddelka xiga.
Hal dabeecad ayaa mudan feejignaan kahor dayactirka. Marka bilowga AWS shaqeynayo ma jiro waqti: AWS way sii dayaacdaa ilaa tunnel-ku kaco, waxayna dib u bilaabataa marka customer gateway soo diro fariinta delete-SA. Haddii aad si ula kac ah u damiso lamaanaha, AWS way sii garaacaysaa, diiwaannada lamaanahana way muujin doonaan.
Xaqiiji wadada abka, ma aha oo kaliya xaaladda tunnel-ka
Tunnel soo sheegaya up ma aha mid la mid ah codsi shaqeeya. Shaqada Lambda oo ku xiran VPC waxay wali u baahan tahay waddo subnet oo u socota horudhaca macmiilka, sharciyada security group iyo network ACL oo oggolaada socodka, xallinta magacyada oo soo celisa cinwaanka saxda ah, iyo waddo soo-noqod oo dhinaca macmiilka ah.
Hal mar ku tijaabi codsi dhab ah oo ka yimid macnaha abka, haddii uu guuldareysto akhri flow logs. Socodka keepalive waa xulasho sharci ah marka bilowga AWS daman yahay oo tunnel fadhiid ah uu u baahan yahay baakado si uu kor ugu sii jiro, laakiin waa inay noqotaa go'aan la-socod-sheeg ah oo aad magac u bixin karto, ma aha wareeg ping aan la sharraxin oo shaqada lagu dhejiyey.
Marka hore dooro yaa dhisaya tunnel-ka, ka dibna cilladda hadhay ku baadh heerkeeda. Dukumeentiga AWS ee ku saabsan bilowga wuxuu si faahfaahsan uga hadlayaa shuruudaha cinwaanka, aqoonsiga iyo isku-dayga marka la barbar dhigo tilmaamaha console-ka.