VPN IPsec laba WAN ee Junos: isku-dubbaridka dariiqa isha iyo albaabka saxda ah

Laba xiriir WAN oo goob kasta waxay u eg yihiin badhitaan ilaa aad isku daydo inaad caddeyso lammaanaha cinwaan ee ay dhab ahaan isticmaashay socod gaar ah. SRX, albaab IKE ah wuxuu qaadayaa hal interface dibadeed iyo hal cinwaan maxalli ah; liiska musharraxiinta fog ma abuurto isha labaad ee maxalliga ah. Taasi waa sababta hagahan uu ku bilaabmayo matrixka lammaanaha halkii uu ka bilaaban lahaa habaynta, sababtoo ah Junos si fudud ayuu u commit-gareeyaa naqshad daboolaysa kala bar isku-darka aad u jeedday. Tan waxaan kala kulmay laba SRX345s: tunnelka kaydka ayaa si nadiif ah kor u kacay haddana hoos u dhigay fadhiga markii dib loo noqday.

Raac tallaabooyinka si isku xigta: liiso lammaanaha ay tahay in la taageero, dhis hal albaab isha kasta oo maxalli ah, xaqiiji isku-xirnaanta qaaday gaadiidka, kadibna go'aanso waxa nooc kasta oo guuldarro ah uu beddeli karo.

Khariidad lammaanaha ka hor inta aadan taaban CLI

Haddii goobta A ay ka soo bixi karto A1 ama A2 oo goobta B ay ku qaadan karto B1 ama B2, waxaad haysataa afar lammaane cinwaan dibadeed. Naqshadaha badankood waxay u baahan yihiin laba si joogto ah waxayna ula dhaqmaan labada kale sida ikhtiyaari. Qor matrixka oo calaamadee saf kasta, sababtoo ah saf kasta oo aad ballanqaaddo wuxuu kuu kacayaa albaab, interface tunnel iyo go'aan dariiq gudaha mustaqbalka.

Lammaane kasta oo loo baahan yahay waxay u baahan tahay saddex shay isku mar: underlay la gaari karo inta u dhexeysa cinwaannadaas, aqbalid labada dhinac ah ee aqoonsiga lammaanaha iyo cinwaanka isha labada gees, iyo dariiq soo-noqod la ilaaliyay. Lammaanaha kaliya hal jiho ka shaqeeya wuxuu weli muujinayaa tunnel, guuldarrada waxay soo baxaysaa gadaal sida gaadiid hal-jiho ah oo codsiga.

Hal albaab isha kasta oo maxalli ah, ee ma aha goob kasta oo fog

Liiska cinwaannada fog waxaa iska leh albaab, ishana maxalliga ah sidoo kale. tixraaca albaabbada IKE wuxuu hayaa cinwaannada fog, interface dibadeed, cinwaanka maxalliga ah iyo ogaanshaha lammaanaha dhintay sida dejinta gooni ah, waana taas qodobka: laba isha maxalli ah macneheedu waa laba albaab oo ku yaal laba unug st0. Wadaagga siyaasadda IKE dhexdooda waa caadi; in hal albaab la hayo oo la rajo inuu isagu doorto ish kale ma aha.

set security ike policy IKE-P1 mode main
set security ike gateway GW-A1 ike-policy IKE-P1
set security ike gateway GW-A1 address 198.51.100.20
set security ike gateway GW-A1 address 198.51.100.21
set security ike gateway GW-A1 external-interface ge-0/0/0
set security ike gateway GW-A1 local-address 203.0.113.10
set security ike gateway GW-A1 version v2-only
set security ike gateway GW-A2 ike-policy IKE-P1
set security ike gateway GW-A2 address 198.51.100.20
set security ike gateway GW-A2 external-interface ge-0/0/3
set security ike gateway GW-A2 local-address 192.0.2.10
set security ike gateway GW-A2 version v2-only

Kadib ku xir tunnels-ka oo sii prefixka fog laba next hop, mid tunnel kasta:

set interfaces st0 unit 1 family inet
set interfaces st0 unit 2 family inet
set security ipsec policy IPSEC-P1 perfect-forward-secrecy keys group14
set security ipsec vpn VPN-A1 bind-interface st0.1
set security ipsec vpn VPN-A1 ike gateway GW-A1 ipsec-policy IPSEC-P1
set security ipsec vpn VPN-A2 bind-interface st0.2
set security ipsec vpn VPN-A2 ike gateway GW-A2 ipsec-policy IPSEC-P1
set routing-options static route 10.20.0.0/16 qualified-next-hop st0.1 preference 10
set routing-options static route 10.20.0.0/16 qualified-next-hop st0.2 preference 20

In hal albaab uu hayn karo laba odhaah oo nooca address waxay ku xiran tahay sii-deynta iyo in qalabku socodsiiyo habka IKE. Junos hore oo ku salaysan kmd wuxuu qaataa hal cinwaan fog albaab kasta; build-yada cusub waxay maareeyaan musharraxiin badan laakiin waxay ku daraan xaddidaadyo u gaar ah, culaysyada helitaanka sare waa meel caadi ah oo taageeradaas ku cidhiidhi noqoto. Eeg qoraallada sii-deynta build-kaaga saxda ah ka hor inta aadan tan ka koobi-gelin chassis hore.

Xaqiiji isku-xirnaanta qaaday baakadda

Laba SA iyo laba tunnel ma sheegaan kee ayaa fadhiyada gudbiyay. Weydii qalabka si toos ah oo isbarbardhig goobaha lammaanaha aad u jeedday:

show security ike sa detail
show security ipsec sa detail
show security flow session destination-prefix 10.20.1.0/24
show interfaces st0.1 | match packets

Soo-saarka faahfaahsan wuxuu sheegaa albaabka maxalliga ah iyo kan fog isku-xirnaan kasta, taas oo ah habka ugu dhaqsiyaha badan ee lagu ogaan karo tunnel laga wada xaajooday isha aanad filayn. Kadib fiiri tirsannada baakadaha unug kasta ee st0.1 iyo st0.2 inta aad gaadiidka marinayso; tunnel waxba qaadanaya wuxuu hayaa SA-giisa oo wuxuu u muuqdaa caafimaad qab soo-koobid.

Sii nooc kasta oo guuldarro ah ogaadeenkiisa

Nolosha lammaanaha, luminta xiriirka sare ee maxalliga ah, ka-la-noqoshada dariiqa la ilaaliyay iyo jajabka codsiga waa afar dhacdo oo kala duwan. DPD wuxuu ka jawaabaa kaliya tan koowaad, markaa u habee waqti iyo xad aad difaaci karto halkii aad ka tagi lahayd qiimaha caadiga ah oo aad u malayn lahayd inuu daboolayo inta kale:

set security ike gateway GW-A1 dead-peer-detection interval 10
set security ike gateway GW-A1 dead-peer-detection threshold 3
set security ipsec vpn VPN-A1 vpn-monitor source-interface st0.1
set security ipsec vpn VPN-A1 vpn-monitor destination-ip 10.20.0.1

La-socodka tunnel ee tijaabiya meel ku dhex taal subnet-ka fog wuxuu daboolayaa xaaladda DPD aanu arkin: IKE waa nool, albaabku wuu jawaabaa, prefixka la ilaaliyay haddana lama gaari karo. Dooro kee ka mid ah labada ayaa horumarka jiidi doona, sababtoo ah haddii labaduba isku mar shaqeeyaan waxaa yimaada duufaan is-beddel ah halkii ay noqon lahayd wareejin nadiif ah.

Ha illoobin geesta fog. Dariiqa la doorbiday ee ku sii yaal goobta fog wuxuu weli tilmaamayaa tunnel aad hore uga tagtay, mana jiro waqti-madhan maxalli ah oo taas hagaajiya. Daabac isla caqliga mudnaanta labada lammaane, oo qor haddii xiriirka soo-kabtay uu gaadiidka si otomaatig ah dib u qaadan karo ama gacan lagu beddelaa.

Cinwaan cusub sii hal xiriir adigoon taaban midka kale

Marka ISP uu ku siiyo block cusub, beddel hal xiriir markiiba. Cusboonaysii address ama local-address labada lammaane ee lammaanahaas, samee commit, oo tirtir kaliya isku-xirnaannada saameeyay iyadoo index la isticmaalayo halkii aad ka tirtiri lahayd dhammaan SA-yada qalabka. Tirtirka guud wuxuu qaataa tunnelka caafimaadka qaba wuxuuna daaqadda dayactirka u beddelaa hakad.

Kahor inta aadan wax nadiifin, kaydi hal socod guuldarraystay iyo faahfaahinta fadhiyadiisa sida caddayn, kadibna mar kale ku socodsii hubinta kore lammaanaha cinwaanka cusub. Soo-celinta xiriirku waa go'aan dariiq, markaa u qaado soo-noqoshada tallaabo gooni ah oo la tijaabiyay halkii aad u malayn lahayd in mudnaanta hore ay iyada ku soo noqoto.

Ku xir isbeddelka liis-hubin gaaban

Naqshadda tunnel laba WAN waxay dhammaataa markaad sheegi karto lammaanaha ka dambeeya fadhi kasta, ee ma aha marka labada SA ay kor yihiin. Dhamee liiska hoose qalabka aad runtii beddeshay:

• Lammaane kasta oo la ballanqaaday wuxuu leeyahay albaab, unug st0 iyo gelitaan dariiq.
• Tunnel kasta waxaa la arkay isagoo qaadanaya baakado, ee ma aha kaliya haynta SA.
• Labada gees waxay ku heshiiyaan ogaanshaha iyo goorta dhinac kee ayaa soo-celinaya mudnaanta.
• Dariiqa soo-noqod ee lammaane kasta waxaa lagu qoray dhinaca dariiqa socodkiisa.

Haddii saf uu guuldarraysto, hagaaji lammaanahaas ka hor inta aadan ku darin kan xiga; laba tunnel oo kala-bar shaqeeya oo la is dul saaro waxay tirsannada ka dhigaan macne-la'aan oo habdhaqanka failover ka dhigaan mid aan la saadaalin karin.