Azure IP VPN gaar ah oo ku socda ExpressRoute oo aan NVA lahayn

Halyeysta ayaa ah in sir-gelinta taraafikada ee peering-ga gaarka ah ee ExpressRoute ay u baahan tahay qalab shabakadeed macmal ah. Ma u baahna. Azure waxa ay taageertaa Site-to-Site VPN Gateway oo barteeda dambe ee tunnel-ku tahay ciwaan gaar ah oo RFC1918 ah oo lagu qaado wareegga, qalabkuna waa ikhtiyaari, ma aha qaab-dhismeed. Waxa halyeysta qalabku qarinayso waa qaybta dhab ahaan waxyeellaysa: in barteeda gaarka ah lagu daaro hal shay halkii laba, iyo in waddada peering tooska ah si aamusan uga guulaysato waddada sir-gelan.

Halyeysta meesha ay ka timid

Sheegashadu waxa ay leedahay asal la ixtiraamo. Sannado badan cuntada waxqabadka IPsec ee peering-ga gaarka ah waxa ay ahayd NVA, sababtoo ah albaabka la maareeyo waxa uu soo bandhigi jiray kaliya dhamaadka dadweynaha. Taasi way is beddeshay, jawaabihii la qoray ka hor isbeddelka ayaa wali lagu soo xigtay dunno aan cidina taariikhda hubin. Sixitaanku waa cidhiidhi: albaab VPN oo ciwaan gaar ah leh ayaa jira, waxana uu beddelaa barta dhamaadka, ma beddelo caqliga waddada ee ku wareegsan.

Midna kama fariisiso NVA. Waxa ay fariisiso mala-awaalka ah in qalabku yahay waddada kaliya ee loo maro shuruudda.

Daar barta gaarka ah labada heer

Ka bilow xiriirka peering-ga gaarka ah ee ExpressRoute oo shaqeeya oo ku xidhan VNet-ka uu ku jiro albaabka VPN. Dhinaca gudaha waa in uu horey u gaadhay ciwaannada gaarka ah ee ku habboon wareeggaas, sababtoo ah tunnel-ku waxa uu isticmaali doonaa ciwaannadaas gaadiid ahaan. Kadib shuruudda albaabka: nidaamka Microsoft ee VPN-ka IP gaar ah waxa uu u baahan yahay albaab lagu dhisay kheyraad IP dadweyne oo Standard ah. Cinwaanka tunnel-ka gaarka ah ma tirito shuruuddaas, taas oo la yaab ku tahay dadka u malaynaya in «gaar» macneheedu yahay «meelna IP dadweyne ma jirto».

Hadda daar calanka labada goobood. Qaabeynta albaabka waxa ay leedahay beddelkeeda u gaar ah IP-yada gaarka ah, xiriirka Site-to-Site ee gaarka ahna waxa uu leeyahay mid labaad oo ku qasba xiriirkaas inuu isticmaalo ciwaanka gaarka ah. Mid dhigid oo mid kale aan dhigid waa qaabeynta aan dhamaystirnayn ee ugu caansan; tunnel-ku ama ma dhismayo ama waxa uu ku dhismaa barta dhamaadka khaldan.

az network vnet-gateway update -g rg-net -n vpngw-prod --set enablePrivateIpAddress=true
az network vpn-connection update -g rg-net -n conn-onprem --set enablePrivateIpAddress=true
az network vnet-gateway show -g rg-net -n vpngw-prod \
  --query '{sku:sku,priv:enablePrivateIpAddress,active:activeActive}'

Xaqiiji magacyada sifooyinka ee la jaanqaadaya nooca CLI ee aad rakibtay, sababtoo ah calaamadaha albaabka iyo sifooyinka CLI mar walba isku erey ma laha. Albaab firfircoon-firfircoon waxa uu soo bandhigaa laba ciwaan tunnel oo gaar ah, qalabka gudahana waa in uu haystaa labada lammaane oo la qaabeeyay haddii aad rabto in dulqaadkaasi wax macne ah yeesho. BGP looma baahna kaliya in tunnel-kan ciwaanka gaarka ah la qaado, inkastoo ay caadi ahaan qayb ka tahay sida aad u qaybiso prefix-yada.

Halyeysta labaad: tunnel la aasaasay waxa uu sir-gelinayaa taraafikadaada

Hadda laba waddo ayaa gaadha shabakadda codsiga: waddada tooska ah ee peering-ga gaarka ah iyo waddada VPN-ka. Labaduba way shaqeeyaan. Kaliya mid ayaa isticmaala lakabkan IPsec. Microsoft waxa uu diiwaangeliyay in marka prefix-yo isku mid ah lagu dhawaaqo ExpressRoute iyo VPN labadaba, Azure uu doorbido waddada tooska ah ee ExpressRoute, sidaas darteed tunnel caafimaad qaba iyo tiriyeyaal caafimaad qaba waxba ma caddaynayaan meesha baakadaha codsigu tageen.

Hababka hagidda ee la diiwaangeliyay waa xadka daboolaya ExpressRoute iyo xad ka gaar ah oo la ilaaliyo VPN-ka, ama prefix-yo kala duwan labada waddo. Tusaale ahaan, peering-ga gaarku waxa uu qaadi karaa 10.40.0.0/16 halka VPN-ku ku dhawaaqayo 10.40.12.0/24. Prefix-ka gaarka ah ayaa guuleysta xadka intiisa kalena toos ayuu ahaanayaa.

az network vnet-gateway list-advertised-routes -g rg-net -n vpngw-prod
az network vnet-gateway list-learned-routes -g rg-net -n vpngw-prod
az network vpn-connection show -g rg-net -n conn-onprem --query connectionStatus

Isku samee isla hubintaas dhanka gudaha, sababtoo ah doorbidka router-kaaga ayaa go'aamiya dhinaca taraafikada baxa uu ka baxo. Oo hayso gaadiidka tunnel-ka laftiisa waddada ExpressRoute; waddo soo jiidata barta gaarka ah ee albaabka tunnel-ka gudihiisa waxa ay tunnel-ka ka dhigtaa mid isku hallaynaya.

Go'aami waxa dhaca marka tunnel-ku dhaco

Waddada VPN ee ka gaar ah ayaa luntay marka tunnel-ku dhaco, halka waddada tooska ah ee ballaaran ay sii jirto. Markaas taraafikadu waxa uu qulqulayaa isagoo aan sir-gelayn oo wax walba caafimaad bay u muuqdaan, taas oo ah qaabka guuldarrada ugu xun ee shuruudda u jirta si loo dammaanad qaado sir-gelinta. Haddii shuruuddu ka mamnuucdo dib-u-noqoshadaas, waddada iyo siyaasadda gelitaanku waa in ay si cad u sheegaan halkii ay ku tiirsanaan lahaayeen helitaanka tunnel-ka.

Qor prefix-yada laga yaabo in ay si toos ah u gaadhi karaan iyo kuwa ay tahay in ay joogsadaan marka waddada sir-gelan maqan tahay. Kadib tijaabi kiiska la ogol yahay taraafiko dhab ah oo isbarbardhig tiriyeyaasha xidhiidhka, sababtoo ah shaxda waddada oo keliya ma kuu sheegi doonto haddii shuruudda sir-gelintu weli shaqaynayso.

Qaab-dhismeedkaas waxa uu sidoo kale kuu ogolaanayaa in aad NVA ku qiimeyso sifooyinkiisa dhabta ah, sida tunnels badan, wax-soo-saarka ama baaritaanka iibiyaha, halkii aad iibsan lahayd mid sababtoo ah barta dhamaadka waa gaar.