GCP HA VPN: fadhiga BGP waxay ku xayiran tahay Waiting for peer, is-weydaarsiga lammaanaha cinwaannada
Fadhi BGP oo Cloud VPN ku xayiran Waiting for peer badanaa waxa uu is-weydaarsaday cinwaannada tunnel-ka iyo lammaanaha. Hubi lammaanaha ka hor inta aadan wax dib u dhisin.
Fadhi BGP oo aan marnaba gaadhin Established tunnel Cloud VPN badanaa ma aha dhibaato hagidda. Waa dhibaato fiilooyinka: laba cinwaan oo ay tahay inay is-milicsadaan ayaa si khaldan loo geliyay, ama lammaanaha tunnel-kii hore ayaa dib loogu isticmaalay kii labaad. Tunnel-ka laftiisu wuu si buuxda u caafimaad qabi karaa inta fadhigu ku xayiran yahay Waiting for peer, sababtoo ah IPsec iyo BGP waa wada-hadal gaar ah oo u dhexeeya isla labada dhibicood ee dambe. Go'aanso midka labadaas ka mid ah oo jaban ka hor inta aadan wax dib u dhisin.
Hal su'aal ayaa xallisa inta badan kiisaska: ma arkaa qalabka lammaanaha cinwaanka Cloud Router haba yaraatee?
Xaaladda tunnel-ka iyo xaaladda fadhigu waa laba baaritaan oo kala duwan
Marka hore IKE iyo ESP ayaa yimaada. Haddii tunnel-ku aan la dhisin, wax gudihiisa ah ma khuseyso oo doodda cinwaanka BGP waa goor hore. Akhri xaaladda tunnel-ka iyo xaaladda faahfaahsan, ka dibna akhri xaaladda lammaanaha BGP ee hagaha isla tunnel-kaas.
Tunnel-ku wuu shaqeeyaa halka lammaanahiisa BGP uu joogsan yahay, taas oo cilladda ku xaddidaysa fadhiga: cinwaanka lammaanaha, ASN ama TCP 179 oo yimaada cinwaanka gudaha. Tunnel-ku wuu shaqeeyaa, fadhigu wuu shaqeeyaa iyo weliba ma jiraan waddooyin VPC gudaheeda tani waa kiiska saddexaad. Beddelka cinwaannada halkaas ma caawinayo, sababtoo ah fadhigu hore ayuu u shaqeeyaa oo horgalaha si fudud looma dhawaaqo ama lama doorbido. Kala soocidda saddexdaas kiis waa qaybta ugu weyn shaqada.
Tunnel kastaa wuxuu u baahan yahay /30 u gaar ah, labada daraf oo buuxa
Tunnel kasta oo HA VPN ah wuxuu ka helaa 169.254.0.0/16 link-local /30, hal cinwaan oo ku yaal interface-ka Cloud Router iyo kan kale lammaanahaaga. Goobta lammaanaha waa in ay magacawdo darafka fog, marnaba cinwaanka hagaha laftiisa.
Laba tunnel macneheedu waa laba interface oo Cloud Router ah, mid kastaa wuxuu leeyahay /30 kale. Dib u isticmaalka lammaanaha tunnel 0 ee tunnel 1 waa khaladka ku muuqda mid nadiif ah shaxda soo-koobka oo ku dhinta paketka OPEN.
| Tunnel | Router interface | Peer address | What a swap produces |
|---|---|---|---|
| tunnel 0 | 169.254.1.1/30 | 169.254.1.2 | OPEN sent to itself or to nothing; session waits |
| tunnel 1 | 169.254.1.5/30 | 169.254.1.6 | same failure on the second session |
| both | one pair reused | one address reused | one session up, the other never leaves waiting |
Lammaanaha ka akhri kheyraadka hagaha halkii aad ka akhrin lahayd soo-koobka console-ka. Soo-koobku wuxuu cinwaanka lammaanaha ku taxaa tiir ay fududahay in si khaldan loo akhriyo, ipRange-ka interface-ka iyo peerIpAddress-ka lammaanaha waa inay sharraxaan darafyada iska soo horjeeda ee hal /30.
Is-weydaarsigu badanaa wuxuu dhacaa inta lagu jiro dib u dhis
Waa marka tunnel la dib u dhisayo ay lammaanuhu isdhaafaan. Cinwaanka lammaanaha tunnel-kii hore waxa loo koobiyaa goobta interface-ka tunnel-ka cusub, ama fadhiga cusub waxa loo jeediyaa lammaanaha fadhigii hore. Si kasta oo ay tahay, Cloud Router wuxuu paketarka OPEN u diraa cinwaan hadda isaga laftiisu ah ama cinwaan aan tunnel ka dambeeyn.
Qor lammaanaha ka hor inta aadan furin console-ka: magaca tunnel-ka, interface-ka, cinwaanka hagaha, cinwaanka lammaanaha, ASN-ka lammaanaha. Ka dibna abuur labada tunnel hal mar, si kan labaad aan looga buuxin hadhaaga kii hore.
Saddex sababood oo kale oo fadhigu u sugayo
Tan koowaad waa ASN-ka lammaanaha: dhinac kastaa waa in lagu habeeyaa ASN-ka dhinaca kale, iyo is-waafaji la'aantu waxay gaadhaa lammaanaha laakiin marnaba ma dhismaan. Tan labaad waa firewall-ka lammaanaha laftiisa, kaas oo waa in uu u oggolaado TCP 179 interface-ka tunnel-ka; qaanuunka IKE ama ESP ma daboolo taas. Tan saddexaad waa lammaane ka jawaaba cinwaan isha ka duwan kii loo habeeyay deriskiisa.
Diiwaanka lammaanaha laftiisa ayaa ah kala-soocaha. Haddii soo-koobka BGP-giisu uusan ku taxin deris cinwaankaas, paketarku ma yimaadaan oo lammaanaha ama waddadu waa khalad. Haddii derisku ku jiro Active ama Connect, paketarku way yimaadaan oo halbeegyada fadhigu isku mid ma aha.
Hubi sida ay paketarku u socdaan
U shaqee xagga dibadda: xaaladda tunnel-ka, ka dibna xaaladda lammaanaha BGP ee hagaha, ka dibna soo-koobka BGP ee lammaanaha, ka dibna waddooyinka. Haddii labada hore caafimaad qabaan, jooji wax ka beddelka dhinaca Cloud VPN oo ka shaqee qalabka lammaanaha. Haddii hagahu soo sheego in lammaanuhu joogsan yahay oo qalabkaagu aanu lahayn deris, lammaanuhu waa khalad ama dekedda BGP waa la shaandheeyay. Qabashada paketarka interface-ka tunnel-ka lammaanaha ayaa hal aragti ku xallisa, sababtoo ah paketarka OPEN ama halkaas way yimaadaan ama marnaba ma yimaadaan.
gcloud compute routers get-status ROUTER --region=REGION wuxuu daabacaa xaaladda lammaanaha agteeda cinwaanka uu isticmaalayo, waana isla lammaanahaas aad u baahan tahay inaad isbarbardhigto.
Marka fadhigu dhismaan, xaqiiji in horgalaha la bartay uu ka muuqdo shaxda waddooyinka VPC iyo in hal martigeliyaha dhinac kastaa ka jawaabo. Ka dibna qor lammaanaha ugu dambeeya agteeda magacyada tunnel-ka, si dib u dhista xiga uu uga bilaabmo shax la hubiyay ee uusan ka bilaaban soo-koobka console-ka.