Interface-kaas helaa doorka NAT gudaha iyo dibadda ee bixista IOS VPN
Raac baakadda macmiilka ee la sirtey laga bilaabo interface-ka farsamaysan ilaa isku xirka sare. Turjumaaddu waxay ku taal socodka gudaha, ma aha gaadiidka dibadda ee tunnel-ka.
Router-yada bixiya bixinta internetka tunnel buuxa waxay qabtaan laba shaqo oo u eg mid. Waxay dhammeeyaa tunnel-ka, waxayna baakadda macmiilka ee la sirtey u gudbisaa internetka. Kaliya shaqada labaad ayaa u baahan turjumaad, turjumaadduna waa inay la socotaa socodka gudaha. Farqigaas ayaa go'aamiya interface-yada qaata doorka NAT iyo inta aadress ee muuqata qaanuunka.
Raac hal baakad oo mara router-ka
Qaado macmiil ku yaal 10.90.0.25 oo fura adeeg HTTPS dadweyne. In goobtaas ay gasho tunnel-ka waa go'aan siyaasadda macmiilka laftiisa. Marka ay gasho, router-ku wuu siraa baakadda oo u gudbiyaa interface farsamaysan, halkaas oo loo maro isku xirka sare ee dadweynaha.
Interface-kaas farsamaysan waa dhinaca gudaha ee turjumaadda. Isku xirka sare ee dadweynaha waa dhinaca dibadda. Haddii doorka ay rogan yihiin ama maqan yihiin, baakaddu waxay ku baxdaa isha gaar ah, ama waa la tuuraa ka hor inta aan la turjun.
| Stage | Question to answer |
|---|---|
| VPN client | Does the client's policy put this destination inside the tunnel? |
| Decrypted ingress | Which virtual interface receives the inner packet? |
| Internet egress | Which route, access policy and source translation apply? |
| Reply | Is the client's flow translated back before it is delivered over the tunnel? |
La jaanqaad siyaasadda turjumaadda iyo kooxda macmiilka
Qaanuunka NAT waa inuu sheegaa baaxadda macmiilku dhab ahaan helo, ma aha LAN-ka xafiiska ee si kadis ah ula wadaaga isku xirka sare. Qaanuunka daboolaya kaliya subnet-ka maxalliga ah wuxuu seegaa macmiilka fog xitaa marka labaduba ka baxaan isla interface-ka.
ip access-list extended NAT-TUNNEL
permit ip 10.90.0.0 0.0.0.255 any
ip nat inside source list NAT-TUNNEL interface GigabitEthernet0/0/0 overloadKa reebista goobaha gaarka ah si gooni ah u hay. Taraafikada u socota goobaha gudaha waa inay hayaan isha asalka ah, haddii kale goobtu waxay ka jawaabtaa ciwaan aanay gaari karin oo lugta soo noqodka waxay ku guuldareysataa si u eg wareegga marinka.
Ku dhaqan geli doorka interface-yada dhabta ah ee naqshadda la dhigay. Qayb Virtual-Template laga nuqulay jawaab Easy VPN duug ah ma aha konfigurashan buuxa oo hadda jirta, nooca tunnel-ka la isticmaalayna wuxuu go'aamiyaa interface-ka hela baakadda la sirtey.
Kala sooc gaadiidka dibadda iyo turjumaadda gudaha
Turjumaadda isha barnaamijka la sirtey ma aha isla hawsha riixidda IKE ama baakadaha la ilaaliyay ee mara qalabka NAT ee sare. Tan hore waxay beddeshaa waxa internetku u arko isha codsiga macmiilka; tan dambe waxay tunnel-ka ku hayaan nool qalab dhexe.
Isku qaldantoodu waxay keentaa laba guuldarro caadi ah. Router turjuma gaadiidka tunnel-kiisa u gaar ah wuxuu jebiyaa xiriirka saaxiibka, halka router aan waligiis turjumin socodka gudaha uu ciwaannada gaarka ah u diro internetka. Akhri socodka aad eegayso ka hor inta aadan wax ka beddelin qaanuun, oo hubi in tunnel-ku taagnaa ka dib isbeddelka. Qaanuunka hagaajiya baarista internetka laakiin tuura tunnel-ka wuxuu dhaqaajiyay dhibaatada halkii uu xallin lahaa.
Mid ka mid ah guuldarrooyinka lama hagaajinayo iyada oo kan kale la beddelo. Akhri socodka aad eegayso ka hor inta aadan wax ka beddelin qaanuun.
Xaqiiji labada xad
Akhri isha barnaamijka xadka internetka, iyo goobta la soo celiyay ee lugta soo noqodka. Tan hore waxay sheegtaa in turjumaaddu dhacday; tan dambe waxay sheegtaa in khariidadda rogan ay ku soo noqotay macmiilka saxda ah.
Kadib tijaabi macmiil isticmaala waddo tunnel kala qaybsan oo la ansixiyay. Macmiilkaas waligiis ma isticmaalo turjumaadda internetka ee router-kan, sidaas darteed waa inuu u dhaqmaa si ka duwan, farqiguna wuxuu xaqiijiyaa waddada taraafikadu qaaday.
Haddii labada macmiil ay u dhaqmaan si isku mid ah, siyaasadda tunnel kala qaybsan ma samaynayso waxa naqshaddu sheegto. Hagaaji taas ka hor inta aadan ku darin qaanuunno turjumaad oo dheeraad ah, sababtoo ah qaanuun loo qoray waddo aan la isticmaalin ayaa qariya dhibaatada dhabta ah.