Cinwaannada BGP ee Cloud VPN waxay ku dhex jiraan tunnelka, ma aha kaadhka shabakada

Fur bogga Cloud Router ee VPN oo kulan BGP oo cinwaan ku leh 169.254.0.0/16 ayaa ku eegaya. Falcelinta caadiga ah waa in cinwaankaas meel VM ah la dhigo oo la sugo kulanku inuu soo baxo. Falcelintaas waa khalad si gaar ah: lammaanuhu waxa uu ka tirsan yahay xidhiidhka macquulka ah ee tunnelka IPsec abuuro, ma aha interface-ka shabakada caadiga ah ee mishiinka. Wax kasta oo aad ku darto NIC ma keento in tunnelku qaado BGP.

Ku raac lammaanaha hoos xagga isku-dhafka halkii aad ku dareemin host-ka.

Ka bilow halka console-ku lammaanaha ku muujiyo

Bogga kulanku wuxuu taxaa cinwaan BGP ee Cloud Router iyo cinwaan peer, labaduba link-local waa HA VPN IPv4. Agtooda waxaa ku yaal cinwaannada gateway-ga dibadda ee tunnels-ka dhammeeya. Kuwani waa walxo kala duwan: lammaanaha link-local wuxuu ku nool yahay gudaha, cinwaannada gateway-kuna waxay ku nool yihiin dibadda oo waa in ay noqdaan kuwo la marin karo ka hor inta wax kale shaqeeyo.

Qor saddexda oo dhan ka hor inta aadan furin faylka habaynta, maxaa yeelay isku-dhafka iyaga ayaa ah qaabka guuldarada oo dhan.

U soo deg tunnelka qaada

Lammaanaha link-local macne macne ma leh ilaa ay jirto isku-xidhka amniga IPsec oo u dhexeeya labada gateway. Dhinaca Google tunnels-ka HA VPN waxay ku abuuraan labada interface; dhinacaaga waa wixii peer-ku wada hadlay. Marka hore hubi isku-xidhka xogta swanctl --list-sas oo qor tunnelkee ayaa kor u saaran interfacekee, maxaa yeelay kulan BGP caafimaad qaba oo tunnel dhintay korkiisa waa suurtagal ma aha, tunnel dhintay oo habayn rajo lehna waa wax caadi ah.

Baakadda BGP waa taraafikada IP ee gudaha. Shabakadda dibadda waligeed ma aragto, sidaas darteed switch kasta uma baahna labada cinwaan hal VLAN.

Hadda u habee peer-ka Linux si uu u dhigmaan

Dooro naqshadda tunnelka la taageeray oo u daa in ay go'aansato cinwaannada gudaha. Interface ku dhisan dariiq, gelinta dariiqada iyo doorashooyinka taraafikada ee la wada hadlay waa in ay is waafaqaan, maxaa yeelay magaca interface oo keliya waxba ma oggola. U jeedi BIRD cinwaanka maxalliga gudaha iyo cinwaanka gudaha ee Cloud Router, dhig lambarrada AS bogga kulanka, oo u oggolow TCP 179 gudaha dariiqa la ilaaliyay. Ku hay dariiqada cinwaanka dibadda fog uplink-ga jirka ah si tunnelku uusan u qaadan gaadiidkiisa.

Tunnel iskiisa maamula waa wareeg leh gacan-qabasho, oo hal saac wuxuu u ekaan doonaa dhibaato darbi-dab ah.

Hubi marxalad kasta si nidaamsan, ma aha dhammaan hal mar

Socod marxaladaha: isku-xidhka amniga kor, peer-ka gudaha laga gaari karo cinwaanka tunnelka, kulan BGP la aasaasay, prefix-yo la aqbalay, ka dib prefix culeyska shaqada si dhab ah loo isticmaalay. birdc show protocols waxay ka jawaabtaa su'aasha saddexaad oo wax kale ma aha, taasna waa sababta dadku goor hore ugu dhawaaqaan guul.

Deris la aasaasay ma dammaanad qaado in labada dhinac ay ku dhawaaqeen prefix-yada aad u baahan tahay, ama in dariiqyadaas loo rakibay sida la doorbiday.

Haddii kulanku aasaasan yahay oo taraafikadu weli qaadanayso dariiq qaldan, isbarbardhig prefix-yada la dhawaaqay iyo waxa shaxda dariiqadu ku sameyso. Dariiq gaar ah oo meel kale ah, ama doorbidid dariiq kale, waxay ku siinaysaa kulan BGP shaqeeya oo aan lahayn gudbin faa'iido leh.

Iso jooji ka hor inta aadan tan ku dabaqin Router Appliance

Network Connectivity Center Router Appliance waa qaab isku-xidh ka duwan. Peer-yadeeda Cloud Router waxay isticmaalaan cinwaanno gudaha oo ka yimaadda habaynta VPC iyo subnet halkii ay isticmaali lahaayeen lammaanaha link-local ee HA VPN. Haddii hadafka dhabta ahi yahay BGP oo leh VM dariiqayn, raac shuruudaha interface-ka alaabtaas halkii aad koobi lahayd kulan link-local.

Baaxadda link-local weli macneheedu waa waxa ay tidhaahdo. Tunnelka macquulka ah wuxuu bixiyaa derisnimadan, oo ma bixiso laysanka marin u ah yoolalka link-local ee aan loo baahnayn ee VPC-da.