Beddelka IP-ga dadweynaha ee gateway VPN Azure iyo guurka rukhsadda

Hagaha beddelka IP-ga dadweynaha ee gateway VPN iyo guurkiisa rukhsadaha dhexdooda, iyadoo la socoto liiska, dib u celinta iyo hubinta macnaha ee tunnellada shaqeeya.

Azure saddex shay oo kala duwan ayaa loo yaqaan cinwaanka gateway-ga. Cinwaanka gaarka ah waxaa laga qoondeeyaa GatewaySubnet. Cinwaanka dadweynaha waa kheyraad IP dadweyne oo gaar ah oo ay tilmaamayso qaabeynta IP ee gateway-ga. Rukhsadda iyo deegaanka daruuraha waa macnaha ay qolofkaagu ku helo midkood. Beddel mid, labada kalena meeshooda ayay ku sii jiraan, taasina waa sababta shaqada cinwaannada badanaa badhka uga joogsato.

Waxaan sameeyaa isbeddelladan afar marxaladood: liiska shayada, go'aanka in IP-ga dadweynaha uu ku socdo gateway-ga jira ama gateway-ga dib loo dhiso, fulinta isbeddelka inta cinwaanka hore gacanta ku jiro, ka dibna hubinta tunnellada kasta labada dhinac ka hor inta aan wax la tirtirin. Marxaladda dadku boodaan waa liiska.

Midkee saddexda shay ayaa dhab ahaan beddelaysaa

U magacow shayga ka hor inta aanad furin bogga. Gateway VPN wuxuu cinwaankiisa gaarka ah ka qaataa shabakad hoose oo ay tahay in si sax ah loogu yeedho GatewaySubnet, Azure-na wuxuu ka qoondeeyaa horgalahaas; ma jiro goob guud oo lagu dhejiyo. Cinwaanku wuxuu u muuqdaa mid xasilloon oo kaliya sababtoo ah shabakadda hoose waa xasilloon. Dib u cinwaan shabakadda ama dib u dhis gateway-ga oo wuu la socdaa.

Cinwaanka dadweynaha waa la beddeli karaa, laakiin qawaaniinta SKU ayaa go'aamiya in beddelka uu sharci yahay. Gateway Basic wuxuu la lammaan yahay IP dadweyne dhaqdhaqaaq Basic, SKU-yada VpnGw waxay u baahan yihiin Standard taagan, gateway-na leh badhitaan aag wuxuu u baahan yahay IP dadweyne Standard oo isla aagaggaas leh. SKU qaldan waa la diidaa ka hor inta tunnel uusan dhicin.

ObjectWhere it livesWhat a change forces
Private addressGatewaySubnet prefix, assigned at deploymentSubnet resize or rebuild, then routes, NSGs and peer review
Public addressPublic IP resource referenced by the IP configurationGateway reprovision, peer and allowlist edits, new client profiles
Subscription contextYour PowerShell or CLI sessionNothing in Azure, and it clears most not-found errors

Liis ka hor inta wax dhaqaaqin

Marka hore caddee rukhsadda, waayo la'aanteed liiska intiisa kale waa wax-ku-ool. Diiwaangeli gateway-ga, qaabeyntiisa IP iyo xiriir kasta oo ku dhamaada, natiijadana ku hay meel u dhow diiwaanka isbeddelka.

Get-AzContext | Select-Object Subscription, Tenant, Environment
Get-AzVirtualNetworkGateway -ResourceGroupName rg-hub -Name gw-hub |
  Select-Object Name, Sku, EnableActiveActive, IpConfigurations
Get-AzVirtualNetworkGatewayConnection -ResourceGroupName rg-hub |
  Select-Object Name, ConnectionStatus, ConnectionType

Aqoonsiga kheyraadka ayaa ka muhiimsan magacyada. Xiriirku wuxuu hayaa tixraacyo gateway-ga iyo gateway shabakad maxalli ah, aqoonsigaasna wuxuu ka muuqdaa script-yada, digniinaha iyo qoondaynta siyaasadda oo aan cidna xusuusan. Liiso sidoo kale waxa Azure ka baxsan: magaca DNS ee cinwaanka u horseedaya, liiska ogolaanshaha lammaanaha, iyo dab-damiska laanta ee dhejiya IP-ga hore.

Beddelka IP-ga dadweynaha ee gateway-ga shaqeeya

Marka hore samee cinwaanka beddelka, isla gobolka iyo isku-darka aagagga u dhigma gateway-ga, kheyraadka horena meeshiisii ku daa. Kadib dib u dhis qaabeynta IP oo dir cusboonaysiinta hal wicid. Wiciddaas waxay beddeshaa dhammaan ururinta qaabeynta, sidaas darteed gateway firfircoon-firfircoon wuxuu u baahan yahay labadaba, haddii kale tunnel keliya ayaa kuu hadha oo kan kalena lumaa.

$gw = Get-AzVirtualNetworkGateway -ResourceGroupName rg-hub -Name gw-hub
$pip = New-AzPublicIpAddress -Name pip-gw-hub-2 -ResourceGroupName rg-hub `
  -Location westeurope -AllocationMethod Static -Sku Standard
$conf = New-AzVirtualNetworkGatewayIpConfig -Name gwipconfig1 `
  -SubnetId $gw.IpConfigurations[0].Subnet.Id -PublicIpAddressId $pip.Id
Set-AzVirtualNetworkGateway -VirtualNetworkGateway $gw -IpConfigurations $conf

Tunnelladu way dhacaan inta gateway-ga dib loo diyaarinayo. Dhinaca fog wuxuu u baahan yahay jadwal: dab-damiska lammaanaha wuxuu sii bixinayaa cinwaanka hore ilaa qof ka beddelo, xiriirka dhinaca foggiisu filayo IP-gii horena wuu sii hoos jiifaa si kasta oo Azure caafimaad u eg yahay. Hoos u dhig TTL-ka DNS ka hor daaqadda.

Macaamiisha dhibic-ilaa-goob waxay u baahan yihiin borofayl cusub, waayo xirmada la soo dejistay waxay qaaddaa barta dhamaadka. Magac DNS gaar ah oo gateway-ga hortiisa ah waxay kaa badbaadinaysaa dib u qaybinta: hay magaca, beddel diiwaanka.

Guurka gateway-ga rukhsad kale

Guurka kheyraadka wuxuu guuriyaa ururin, gateway kelidiina waa xubinta ugu faa'iidada yar. Shabakadda dalwaddii, kheyraadka IP dadweynaha, gateway-yada shabakad maxalli ah iyo xiriirradu way wada safraan sababtoo ah mid kastaa wuxuu hayaa tixraac mid kale. Rukhsadda bartilmaameedka waa in ay ku taal isla kiraystaha, Microsoft.Network waa inuu halkaas ka diiwaangashan yahay, labada dhinacna waxaad u baahan tahay gelitaan qoraal.

Hubinta waxay socotaa ka hor wax kasta oo isbeddela, sidaas darteed guur la diiday wuxuu kheyraadka meeshooda ku reebaa. Taasina waa sababta guurku u qalmo isku-deyn ka hor dib u dhiska: guur guulaystay wuxuu la qaataa IP-ga dadweynaha, markaas lammaanayaasha iyo liisaska ogolaanshaha way sii shaqeeyaan, halka gateway dib loo dhisay uu si dhif ah u soo celiyo isla cinwaanka.

az resource move --destination-group rg-hub `
  --destination-subscription-id 00000000-0000-0000-0000-000000000000 `
  --ids /subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-hub/providers/Microsoft.Network/virtualNetworkGateways/gw-hub

Akhri guuldarada hubinta halkii aad ku celcelin lahayd. Sababaha caadiga ah waa ku-tiirsanaan laga tagay, nooc kheyraad aan la guurin karin, ama quful ku yaal mid ka mid ah kooxaha kheyraadka. Haddii guurku aanu macquul ahayn, dib u dhis bartilmaameedka oo u gudub: xaqiiji marin-u-jiidka iyo aqoonsiga shabakad tijaabo ah, jooji xiriirrada hore halkii aad tirtiri lahayd, kadib ka saar waddada hore daaqad dambe.

Marka gateway-ga uu u muuqdo mid maqan, hubi macnaha

Khaladka lama helin badanaa waa khalad baaxad. Koonto leh rukhsado dhowr ah ayaa cmdlet-ka u jeedisa mid qaldan, fariintuna waxay eedaysaa kheyraadka. Taa beddelkeeda raadi shayga aqoonsigiisa kheyraad buuxa: aqoonsigu wuxuu qaataa rukhsaddiisa, marka haddii uu xallimo waxba ma maqna, macnahaaga caadiga ahna waa qaldan yahay.

Laba is-waafaqi la'aan oo kale ayaa sidaas loo akhriyaa. Gateway daruur ganacsi ma jiro fadhi u jeedda deegaan dowladeed ama Shiine, noocyada moduulka horena waxay seegaan qaababka kheyraadka ee API-gu hore u soo celiyo. Dheji rukhsadda, waafaji deegaanka, kadib fur kiis.

Set-AzContext -SubscriptionId 11111111-1111-1111-1111-111111111111
Get-AzResource -ResourceId /subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-hub/providers/Microsoft.Network/virtualNetworkGateways/gw-hub

Hubi labada dhinac ka hor nadiifinta

Isku-xiran waa xaalad, ma aha caddayn. Hubi xaaladda tunnel-ka xiriir kasta, xaaladda BGP haddii aad isticmaasho marin-u-jiid dhaqdhaqaaq, iyo waddooyinka waxtarka leh ee shabakad hoose oo shaqo. Kadib mar hal codsi dhab ah oo ka socda barnaamij ku tiirsan tunnel-ka. Xiriirku wuxuu sheegan karaa inuu xiran yahay inta horgalaha aad u baahan tahay uu ka maqan yahay shaxda waddooyinka.

Get-AzVirtualNetworkGatewayBGPPeerStatus -VirtualNetworkGatewayName gw-hub -ResourceGroupName rg-hub
Get-AzEffectiveRouteTable -NetworkInterfaceName nic-app -ResourceGroupName rg-app

Ku hay IP-ga dadweynaha hore mid go'doonsan halkii la tirtiri lahaa ilaa daaqadda dib u noqoshada xiranto, oo qor beddellada lammaanaha iyo dab-damiska si loo horjeedsado si nidaamsan.

  • Macnaha waxaa lagu dhejiyay rukhsadda leh gateway-ga
  • IP-ga dadweynaha hore waa la keydiyay, ku-tiirsanaanta waa la qoray
  • Xiriir kastaa waa cagaar iyo hal codsi dhab ah oo dhex mara
  • Isticmaalayaasha dhibic-ilaa-goob waxaa loo raray borofaylka cusboonaysiinta
  • Diiwaanka DNS waa la beddelay qiimihiisii horena waa la qoray

Maqaallo la xiriira