Google HA VPN ilaa kipanga njia Cisco: marka hore qorshee kheyraadka lammaanaha
Magaca labada is-dhexgal ee Google, kheyraadka lammaanaha, heshiiska IKEv2 iyo fadhi kasta oo BGP ka hor inta aanad habaynin kipanga njia Cisco, ka dibna dooro hal lammaane ama laba.
Go'aanka ugu horreeya ee HA VPN-ka Cisco iyo Google ma aha nooca profile-ka sirta ah ee la isticmaalayo, ee waa in hal qalab maxalli ah ama laba ay joojiyaan tunnellada. Albaabka HA VPN ee Google wuxuu leeyahay laba is-dhexgal, mid kastaana wuxuu filayaa tunnel lammaane oo u dhigma. Taas waxay ku siinaysaa laba tunnel ha lahaato laba kipanga njia ama aan la lahayn, farqiguna waa haddii hal koronto-bixiye ama casriyeyn software ah uu hoos u ridi karo naqshadda oo dhan.
Go'aanku waa hal qalab lammaane ama laba
Dooro qaabka saddex shuruudood: haddii aad aqbali karto barta guuldarada maxalliga ah, haddii labada is-dhexgal ee daruuraha ay tahay in la isticmaalo, iyo inta dib-u-kulmi ah ee culayska shaqadaadu u adkaysanayso. Haddii mid ka mid ah saddexda uu yahay shuruud adag, laba qalab lammaane ayaa ah jawaabta daacadda ah.
Go'aanso taas ka hor inta aanad furin console, sababtoo ah jawaabtu waxay beddeshaa inta tunnel iyo fadhi BGP ah ee xaashida shaqadu tahay inay qeexdo.
Qor xaashida shaqada ka hor amar kasta
Xaashida shaqadu waxay leedahay shan saf, mid kastaana wuxuu u baahan yahay milkiile:
| Row | What it records |
|---|---|
| Google side | Project, VPC, region, HA VPN gateway, and the external address of each interface |
| Peer side | The Cisco external addresses, plus the external peer VPN gateway resource that represents them |
| Tunnel pairs | Which peer interface maps to each Google interface, with IKE version, secret and crypto parameters |
| Routing | Cloud Router, local and remote AS numbers, and one inside BGP pair per tunnel |
| Workloads | Approved on-premises and VPC prefixes, and what firewall policy should permit between them |
Kheyraadka lammaanaha dibadda wuxuu qeexaa is-dhexgalladaada gudaha Google Cloud, abuuristiisuna ma habayso kipanga njia Cisco. Isku-dheellitirnaantaas waxay layaabtaa dadka filaya in console-ka daruuraha uu noqdo isha runta labada dhinac. Waa caddayn ku saabsan waxa Google ay tahay inuu filo, kipanga njia na weli waa inuu la jaanqaado. Hagaha albaabka lammaanaha ee Google wuxuu caddayntaas ku xiraa shaqada tunnel-ka, BGP, firewall-ka iyo IKE ee weli lagaa rabo.
Haddii saf aan milkiile lahayn, waxaa buuxin doona qofka shaqada ku jira inta lagu guda jiro beddelka.
Kala hay saddexda door ee cinwaanka
Cinwaannada lammaanaha ee dadweynaha ayaa qaada is-weydaarsiga IPsec ee dibadda. Lammaanaha BGP ee gudaha wuxuu ka tirsan yahay isku-xirka macquulka ah ee la ilaaliyo ee korkiisa socda. Prefixyada LAN iyo VPC ee lagu dhawaaqay waxay qeexaan culayska shaqada ee ka dambeeya isku-xirkaas. Koobiga cinwaanka gudaha ee VM ee goobta lammaanaha dibadda wuxuu isku daraa labada door ee hore, guuldaraduna waxay u muuqataa dhibaato gorgortan ah halkii ay ahaan lahayd khalad gelin xog ah.
Qorshee laba tunnel lammaane oo u dhigma, mid kasta oo is-dhexgal HA VPN ah. Isticmaalka labada is-dhexgal ee daruuraha laftiisu ma tirtiro barta guuldarada maxalliga ah, sababtoo ah labada tunnel weli waxay ku dhici karaan isla chassis.
Qor doorka cinwaanka agta qiime kasta oo xaashida shaqada ah. Caadadaas keliya waxay ka hortagtaa inta badan isku-darka.
U beddel xaashida shaqada nuqulka Cisco
Ka bilow dukumeentiga lammaanaha ee la taageero ama template-ka habaynta Google ee u dhigma platform-kaaga, ka dibna isku waafaji placeholder kasta xaashida shaqada. Isku mar baadh xaqiijinta IKEv2, soo-jeedinta ESP, PFS iyo qaabka tunnel-ka iyo jiidista marinnada, sababtoo ah isku-dheellitirnaan la'aan mid ka mid ah waxay badanaa u muuqataa isku-dheellitirnaan la'aan mid kale. Isticmaal platform-ka dhabta ah iyo nuqulka software-ka si aad u dooratid waxa la taageero, maadaama habka Classic VPN uu yahay barta bilowga ee ka duwan.
Ka fogee sirta la wadaago sawirrada shaashadda, lifaaqyada tikitada iyo qoraallada taageerada. Fure horay loo wadaagay oo lagu dhejiyay faallo kiis waa daahfurka aqoonsiga, ma aha qalab xallinta dhibaatooyinka.
Haddii template-ka iyo xaashida shaqadu is khilaafaan, joogso oo ku xalli warqad. Qalabku kuma garab qaadan doono.
Aqbal tunnel kasta caddayntiisa u gaar ah
HA VPN waxay u baahan tahay fadhiyo BGP, iyo guul gorgortanka IKE wuxuu dejiyaa oo kaliya heerka koowaad. Fadhiga gudaha waa inuu soo baxaa, prefixyada loogu talagalay waa in la dhawaaqo oo la aqbalo, iyo waddooyin faa'iido leh iyo oggolaanshaha firewall waa inay jiraan ka hor inta aanay socon taraafikada culayska shaqada. Ku qorista taas oo dhan sida hal iftiin cagaar ah waxay qarinaysaa heerka dhab ahaan guuldarraystay.
Diiwaangeli caddaynta aqbalaadda tunnel kasta: isku-xirka ammaanka ee la gorgortamay, xaaladda deriska BGP, prefixyada la bartay ee la filayay iyo wadada culayska shaqada ee loogu talagalay. Kadib samee baaritaan guuldarro iyo soo-kabasho oo la kontoroolo, sababtoo ah tunnel aan waligiis guuldarrayn waa tunnel aan la tijaabin wadadiisa soo-kabashada.
Diiwaankaas waa dib loo isticmaali karaa marka xigta ee naqshaddu is beddesho, waana farqiga u dhexeeya is-dhexgal iyo qayb amarro ah oo male-awaalkiisu lumay.