ExpressRoute iyo VPN: goobo kuwaa guuldarrooyin ah ayaad daboolaa?
Tunnel-ka labaad ee IPsec wuxuu daboolaa hal dhibic, ma aha wareegga ka hooseeya. Khariidayso goob kasta oo guuldarro, ka dib go'aanso haddii dariiqa beddelka ah ee aan sireysan la ogolyahay.
Tunnel IPsec oo ka shaqeeya peering-ga gaarka ah ee ExpressRoute wuxuu ku darayaa sireyn gaadiid hore u jiray. Tunnel labaad wuxuu hagaajinayaa helista dhibicda, waxbana kama qabto dariiqa shirkadda ee ka hooseeya labadaba. Farqigaas waa sahlan tahay in la lumiyo marka dashboard-yadu muujiyaan laba tunnel oo cagaar ah oo dib-u-eegista naqshadeynta ay weydiiso su'aal kale: guuldarrooyin kee ayay tahay in xiriirkani ka gudbo? Marka hore ka jawaab taas, ka dib tiri tunnels-ka, sababtoo ah tirada calaamadaha cagaar waa sifo lakabka sireynta ah iyo tirada goobaha guuldarrada waa sifo dariiqa oo dhan.
Ka bilow guuldarrooyinka, ma aha tunnels-ka cagaar
Qor afar sadar ka hor intaadan wax sawirin: hal dhibic VPN ama hal tusaale peer oo guuldarraysta, hal router maxalli ah ama xiriirka millirka koowaad oo guuldarraysta, dariiqa ExpressRoute ee la wadaago oo guuldarraysta, iyo IPsec oo aan la heli karin iyadoo peering-ga gaarka ahi wali qaadayo taraafikada. Sadar kastaa waxay magacawdaa waxa naqshadeyntu tahay inay ilaaliso, mid kastaana waxaa ka jawaaba hab kale.
| Failure | What must survive | What does not cover it |
|---|---|---|
| One VPN endpoint or instance | An alternate encryption endpoint and a route to it | A second tunnel terminating on the same instance |
| One local router or first mile | Independent local equipment and transport reachability | Any number of logical tunnels |
| The ExpressRoute path | A separately designed surviving underlay | An IPsec tunnel layered on the same circuit |
| IPsec unavailable, peering up | The intended encrypted-only or approved fallback policy | Assuming the tunnel is the only route |
Microsoft waxay diiwaangelisay VPN goob-ilaa-goob oo leh IP gaar ah oo ka sarreeya peering-ga gaarka ah ee ExpressRoute, iyo wada-noolaanshaha la taageeray ee xiriirada goob-ilaa-goob ee internet-ku-saleysan. Wada-noolaanshahaas waa naqshad lakab hoose oo kale, mana soo baxdo kaliya sababtoo ah waxaad ku dartay dhibic tunnel gaar ah oo kale.
Goobta guuldarrada 1: dhibicda VPN
Laba tunnel oo hal albaab ku yaal badanaa waa lammaane active-active oo ku dhammaada isla kheyraadka dhinaca Azure. Waxay ka ilaaliyaan dhibaatada hal tunnel ama hal tusaale, mana ka ilaaliyaan in kheyraadkaasi noqdo mid aan la heli karin, dib loo habeeyo ama awooddiisu dhammaato. Dheeraadka dhibicda waxay ka dhigan tahay dhibic labaad oo la taageeray, oo leh dariiqeeda iyo habaynteeda, iyo sidoo kale waddo gaari karta.
Hubi waxa aad dhab ahaan geynay, ma aha waxa jaantusku sheegayo, sababtoo ah portal-ku waxay u kooxaynayaa kheyraadkan si qarinaysa xiriirkooda:
az network vpn-connection show -g rg-connectivity -n vpn-to-hub --query '{conn:connectionStatus,tunnels:tunnelConnectionStatus}'
az network vnet-gateway show -g rg-connectivity -n gw-hub --query '{sku:sku.name,activeActive:enableBgp,peers:bgpSettings.peers}'Haddii labada tunnelba ay tilmaamaan hal albaab oo leh hal IP dadweyne, waxaad haysataa dheeraad dhibic oo nooc gaar ah oo xaddidan. Taasi waxay noqon kartaa si sax ah waxa shuruuddu dalbanayso, waana in sidaas loo sheegaa halkii lagu tilmaami lahaa xiriir dheeraad ah.
Goobta guuldarrada 2: dariiqa maxalliga ah iyo shirkadda
Sireynta hoosteeda waxaa yaal xaqiiqo jireed iyo ganacsi: qalabka cidhifka macmiilka, isku-xirka, shabakadda bixiye iyo goobta peering. tilmaamaha helista ExpressRoute waxay si cad u sheegaan in dheeraadka min dhamaad ilaa dhamaad uu ku jiro qaybaha macmiilka iyo bixiyaha adeegga, ma aha oo kaliya dhinaca Microsoft. Laba waddo oo macquul ah oo wadaaga router, koronto ama xiriirka millirka koowaad wali waxay wadaagaan ku-tiirsanaantaas.
Halkan ayaa naqshad badanaa ku guuldarraysta dib-u-eegis daacad ah. Laba wareeg oo ka yimid isla bixiye, oo ku dhammaada isla dhismo, oo ku yaal qalab ka yimid isla dalabka iibka, ma aha laba goobood oo guuldarro. Waa hal goob guuldarro oo leh laba biilasha.
Weydii shirkadda su'aasha qoraal ahaan: kee ka mid ah waddooyinkan ayaa kala duwan, xaggee, oo waa maxay dhaqanka la diiwaangeliyay marka qaybta la wadaago ay guuldarraysto? Hubaal afka ah inta lagu jiro wicitaan naqshadeyn kama gudbo jabka aad u naqshadeyneysid.
Goobta guuldarrada 3: waddada ku hadha IPsec la'aan
Peering-ga gaarka ah iyo IPsec waxay bixin karaan waddooyin tartan ah oo isla prefix-ka codsiga ah. Haddii waddada la ilaaliyay ay lunto, waddada tooska ah ee ExpressRoute ee hadhay waxay wali noqon kartaa mid la isticmaali karo, iyada oo aan lahayn lakabka sireynta ee tunnel-ku bixinayay. Haddii taasi la aqbali karo waa go'aan siyaasadeed, waana go'aanka inta badan si maldahan loo daayo.
Shuruudaha sireynta iyo shuruudaha helista halkan si dhab ah ayay isku dhaceen karaan. «Waddo kasta oo hadhay waa guul» waa bayaan ku saabsan helista oo si aamusnaan ah uga jawaaba su'aasha sireynta «maya». Qor kee baa guuleysta, prefix-yadee, iyo cidda ansixisay.
az network vnet-gateway list-advertised-routes -g rg-connectivity -n gw-hub --peer 10.0.0.1
az network vnet-gateway list-learned-routes -g rg-connectivity -n gw-hub -o tableIsbarbardhig waddooyinka la bartay iyo prefix-yadii aad filaysay. Waddo beddel ah oo qaada culeys maamuleed yar waxay si buuxda ugu filnaan kartaa culeyskaas, waxayna aad uga fogaan kartaa awoodda dalabka wax-soo-saarku u baahan yahay, sidaas darteed qor malo-awaalka awoodda waddada agteeda.
Qor sadar saddex ah oo gooni ah, ma aha hal xukun
Ku hay dheeraadka dhibicda, dheeraadka gaadiidka iyo ka soo kabsashada musiibada sida gelitaanno gooni ah diiwaanka naqshadeynta, mid kastaa leh habkiisa, xaqiijintiisa iyo milkiilaha. Marka dib-u-eegis dhacdo ay weydiiso sababta xiriirku uga gudbay bilowga albaabka laakiin uusan ka gudbin goynta fiber-ka, sadar saddex ah ayaa ku jawaaba hal jumlad; hal sanduuq «dheeraad» ma karo.
Ka dib tijaabi sadarrada si jaban loo tijaabin karo. Guuldarree hal tunnel oo xaqiiji in taraafikadu dhaqaaqdo oo mar kale la sireeyo. Ka noqo hal waddo oo xaqiiji in waddada hadhay tahay tii aad ula jeeday, ka dib xaqiiji haddii wali la sireeyay. Diiwaangeli guuldarrooyinka aadan awoodin inaad ekaysiiso, sababtoo ah sadar aan la tijaabin waa malo-awaal waana in sidaas loo calaamadeeyaa.
Natiijada faa'iidada leh waa shax kooban iyo hal jumlad sadar kasta. Haddii sadar uusan lahayn hab, taasi waa natiijada, waana aad ka jaban tahay in dib-u-eegis naqshadeyn lagu ogaado marka loo eego inta lagu ogaanayo inta lagu jiro jabka shirkadda oo labada tunnel ay marnaba ka gudbi lahaayeen.