DNS-ka Azure P2S wuu guuldarraystaa marka resolver-ku ku jiro VNet la isku xidhay

Macaamiil wuu gaari karaa shabakaddiisa fadhiga ah waxaana weli ku guuldarraystaa xallinta magacyada shabakad la isku xidhay. Peering ma aha transit-ka gateway ilaa labada dhinacba ay yidhaahdaan.

Ping VM-ka oo wuu jawaabaa; weydii magaciisa oo macaamiilku wuxuu yidhaahdaa martigeliyaha waa la garanayn. Marka resolver-ku ku jiro shabakad fadhi ah oo la isku xidhay halkii uu ku jiri lahaa tan gateway-ga VPN ku jiro, labadaas natiijadood waa la filayay, oo wax ka qabad resolver ah ma beddelo. Waxa maqan waa heshiis marshooyin ah oo peering-ku si caadi ah u hayo. Laba topology ayaa warqad ku eg yihiin isku mid, farqiga u dhexeeya mid shaqeeya iyo mid jaban waa laba switch oo peering ah oo jihada saxda ah loo dhigay.

Malee laptop ku tunnelaynaya gateway ku yaal VNet2, halka domain controller-ka DNS-ka bixiya uu fadhiyo VNet1.

Laba topology, hal farqi

Dhig resolver-ka gudaha shabakadda fadhiga ee gateway-ga oo magacu wuu xallimayaa isla marka tunnel-ku soo baxo. Ma jiro habayn peering ah oo ka qaybqaata baaritaankaas.

U rar resolver-kaas dhinaca kale ee peering-ka oo macaamiilku weli jawaab ayuu ka helaa VM-ka halka magacu aan la garanayn. Shahaadada, tunnel-ka iyo macaamiilku isma beddelin. Waxa kaliya ee dhaqaaqay waa halka resolver-ku ku nool yahay. Peering-ku wuxuu siiyay waddo loo maro cinwaankaas, ma aha awood gateway-ku u leeyahay inuu halkaas taraafik ku qaado.

Dhinaca A: u oggolow transit-ka gateway milkiilaha gateway-ga

Peering-ku wuxuu isku xidhaa laba shabakadood oo fadhi ah, laakiin isku xidhkaas ma aha mid gudbin ah taraafikada ka soo galaya gateway, codsiga point-to-site-na sidaasuu u yimaadaa. Sidaas darteed gateway-ka VNet2 ma laha awood uu ku wareejiyo baaritaanka VNet1 ilaa nashqaddu fasax siiso. Fasaxu waa switch ku yaal peering-ka oo ay leedahay shabakadda gateway-ga haysata.

Deji Allow gateway transit peering-ka VNet2 ee u jeedda VNet1. Hantidan waxaa leh shayga peering-ka, ma aha kheyraadka gateway, sidaas darteed waxaad ku akhridaa oo ku beddeshaa blade-ka peering-ka. Taasi waa dhammaan dhinaca A.

Dhinaca B: isticmaal gateway fog oo ku yaal lammaanaha

Qaybta kale waa sawirka muraayadda: peering-ka VNet1 ee ku noqonaya VNet2 fur Use remote gateways. Daarista isla calanka labada daraf, ama mid kaliya, waxay ka tagtaa waddo badh dhisan iyo calaamadii asalka ahayd oo aan la taaban. Kaliya shabakadda leh gateway-ga VPN ayaa fasaxa transit, lammaanahana waa dhinaca isticmaala.

Akhri labada sifo ee labada shabakadood halkii aad ka aamini lahayd blade-ka portal-ka ee aad ugu dambeysay furatay.

Get-AzVirtualNetworkPeering -ResourceGroupName rg-core -VirtualNetworkName vnet2 `
  | Format-List Name,AllowGatewayTransit,UseRemoteGateways
Get-AzVirtualNetworkPeering -ResourceGroupName rg-core -VirtualNetworkName vnet1 `
  | Format-List Name,AllowGatewayTransit,UseRemoteGateways

Aragtida lammaanaha oo wada jira waa habka ugu dhaqsiyaha badan ee lagu qabto habayn rogan. Peering soo sheegaya AllowGatewayTransit false dhinaca gateway-ga ayaa sharraxa guuldarrada oo dhan iyada oo aan la qabsan baakad.

Waxa macaamiilku weli qaadanayo

Marshada ayaa lagama maarmaan ah lamana filna, maxaa yeelay profile-ka point-to-site waa inuu macaamiilka siiyo cinwaan DNS oo jawaaba marka transit-ku shaqeeyo. Resolver-ka platform-ku ma aha cinwaankaas: wuxuu ka jawaabaa aagagga Azure Private DNS ee ku xiran shabakadda fadhiga, laakiin waxba kama sheego aag ku martigeliyay serveradaada hagidda, taasna waa waxa deployment-kani isticmaalo. U jeedi macaamiil xaggaas oo magacyada dadweynuhu si farxad leh ayay u xallimayaan halka martigeliyaha gudaha uu weli la garanayn.

Weydii resolver-ka laptop-ka xiran ka hor inta aanad wax kale beddelin.

nslookup dc01.corp.example 10.1.0.4

Waqti dhammaadku wuxuu sheegayaa in waddadu weli maqan tahay. Jawaab awood leh ayaa dib ugu riixda dhibaatada macaamiilka, inta badan dhejis aan waligiis lagu darin, sidaas darteed magacyo gaagaaban waxay u safraan resolver dadweyne oo si farxad leh u guuldarraysta.

Isbarbardhig isla heshiiska dhinaca site-to-site

Wax ka mid ah tan kuma xirna laptops gaar ahaan. Beddel macaamiilka laan site-to-site ah oo shuruudda labada dhinac ayay soo noqotaa: laanta si toos ah ayay u timaaddaa shabakadda gateway-ga, adeeg laba shabakad u jira ayaa weli ka dambeeya peering-ka.

Transit-ka waa in lagu bixiyaa labada peering, switch-ka bixiyana wuxuu ku nool yahay peering-ka ee ma aha nooca macaamiilka.

Ka hor inta aanad gateway-ga eedeyn

Windows wuxuu haysataa liis resolver ah adapter kasta, sidaas darteed xaqiiji waxa interface-ka tunnel-ku dhab ahaan helay ka hor inta aanad gateway-ga eedeyn.

ipconfig /all
Get-DnsClientServerAddress -AddressFamily IPv4
ipconfig /flushdns

Jawaab diidmo ah ayaa ka badbaadda cache-ka hagaajinta marshada, liis dhejis duugoobayna wuxuu sii wadaa dirista weydiimaha meel aan aaggu waligiis martigelin. Nadiifi, mar kale weydii, oo qor server kee jawaabaya.

Laba shuruudood oo yar ayaa go'aamiya in waddadu sii jirto: boosaska cinwaanku waa in aanay is dulsaarnaan, iyo kooxda amniga shabakadda ee subnet-ka resolver-ka waa in ay ogolaato barkada macaamiisha, taas oo ah uun xaddi kale oo isha. Ku caddee baaritaan waddooyin wax ku ool ah oo ka yimaada dhinaca VM iyo hal weydiin toos ah oo macaamiilka, si dhibaatada aag, dhibaatada dhejis ama shaandhayn aan waligood loo khaldin transit maqan.

Maqaallo la xiriira