Hagidda taraafikada u dhexeeya laba laan iyada oo loo marayo gateway VPN Azure
Laba xiriir Site-to-Site oo ku yaal hal gateway VPN Azure ayaa mari kara taraafikada laamaha, laakiin kaliya marka labada daraf ay bartaan prefix-ka uuna jiro waddada soo noqoshada LAN.
Laba laan ayaa isweydaarsan kara taraafikada iyada oo loo marayo gateway VPN Azure iyada oo aan jirin tunnel toos ah oo dhexdooda ah. Laan kastaa waxay furtaa xiriir Site-to-Site oo u socda isla gateway-ka, gateway-na wuxuu u gudbiyaa prefix-yada la bartay labada xiriir. Waxa taas ka shaqeeya maaha tunnel-ka labaad, balse waa isweydaarsiga waddooyinka: laanta A waa inay bartaa prefix-ka laanta B, B-na midka A. Raac baaritaannada hoose si taxane ah oo joogso marka ugu horreysa ee guuldareysta, sababtoo ah tallaabo kasta oo xigta waxay ku xiran tahay taas.
Shuruudaha horudhaca ah, ka hor inta aadan wax dhigin
Afar shuruudood ayaa go'aamiya haddii nashqaddan ay haba noqon karto. Gateway-ku waa inuu ku saleysnaadaa waddooyinka oo uu ku jiro SKU taageera BGP, labada xiriir waa inay leeyihiin BGP shaqeynaya, meelaha cinwaannada laamaha waa inaanay is-dul-saarnaan, oo dhinacna kama tiirsanaan karo NAT si uu u qariyo prefix-kiisa dhabta ah.
Qorshee ASN-yada si ula kac ah. Qiimaha caadiga ah ee Azure ee la diiwaangeliyay waa 65515, laan kasta oo router-keeda waxay u baahan tahay ASN gaar ah oo aan ku dhacayn gateway-ka ama laanta kale. Isticmaalka qiime caadi ah iyada oo aan la hubin qaabeynta gateway jira waa habka waddada AS loo diido mar dambe.
Sidoo kale hubi inaadan filaneynin dabeecadda peering VNet. Gateway-ku wuxuu isweydaarsadaa waddooyinka labada xiriir ee aad qaabaysay; ma ka dhigto peering-yada aan loo baahnayn kuwo gudba. Haddii shabakad saddexaad ay tahay inay gaarto labada laan, waxay u baahan tahay xiriirkeeda ama waddadeeda, ma aha qiyaasta ah in gateway-ku taraafikada qaybin doono. Qor xadkaas ka hor daaqadda isbeddelka ugu horreysa, sababtoo ah waa go'aanka nashqadeed ee dadku ku noqdaan marka goob dambe lagu daro.
Ku qaabee sidan
Tallaabo kastaa waxay leedahay natiijo la arki karo, markaa ha dhaqaaqin ilaa ay muuqato.
- Ku shid BGP gateway-ka shabakada fikradda ah oo qor ASN-kiisa iyo cinwaanka peer-ka.
- Samee gateway shabakad maxalli ah laan kasta oo leh meesha cinwaanka dhabta ah ee laantaas, ASN-keeda iyo cinwaanka BGP peer-keeda.
- Samee xiriir kasta oo Site-to-Site oo ku shid BGP xiriirka laftiisa.
- U qaabee router-ka laanta inuu la peer sameeyo cinwaanka gateway-ka uu Azure qoondeeyay, ee ma aha barta IKE ee dadweynaha ee gateway-ka iyada oo la qiyaasayo.
Tallaabada afraad waa meesha inta badan isku dayga ay ku hakadaan. Cinwaanka BGP peer-ka ee Azure soo sheegayo waa kan router-ka laanta ay tahay inuu u isticmaalo deris, oo had iyo jeer ma aha cinwaanka dadku ka filayaan jaantuska tunnel-ka.
Ku dhawaaq prefix-ka laanta lafteeda, tusaale ahaan 10.10.0.0/16 oo ka yimid A iyo 10.20.0.0/16 oo ka yimid B. Ha ku dhawaaqin waddo caadi ah ama isku-geyn ballaadhan si aad u daboosho shabakad gaar ah oo maqan; farqiga ayaa mar dambe ku soo noqda god madow oo aamusan.
Xaqiiji isweydaarsiga waddooyinka labada daraf
Xaaladda xiriirka maaha baaritaanka. IPsec wuu shaqeyn karaa labada xiriir iyada oo aan prefixna ka gudbin dhexdooda. Akhri BGP peer-yada gateway-ka iyo waddooyinka la bartay, ka dibna xaqiiji in waddada u socota laanta kale ay u muuqato sidii waddo la isticmaali karo.
| Check | Where | Stop if |
|---|---|---|
| BGP session established | Gateway BGP peers, branch router neighbour state | Session is Idle or Active on either side |
| Prefix learned | Gateway learned routes, branch BGP table | The other branch's prefix is absent |
| Prefix selected | Branch routing table, effective routes on the VNet | Prefix is known but a more specific route wins |
Prefix ku jira shaxda BGP weli wuu lumin karaa go'aanka gudbinta waddo joogto ah ama prefix gaar ah. Hubi waddada la doortay, ee ma aha kaliya tan la helay.
Raac waddada soo noqoshada dhinaca LAN
Tani waa qaybta Azure uga muuqata sax oo goobta ku guuldareysata. Marti ku sugan laanta A waxay u dirtaa baakaddeeda router-ka VPN ee A kaliya haddii router-kaasi yahay gateway-deeda caadiga ah, ama haddii martida ama gateway-deeda uu leeyahay waddo loogu talagalay prefix-ka B. Isla sidaas waa inay run tahay jihada kale.
Haddii switch xudunta u ah oo gooni ah uu yahay gateway-ka caadiga ah ee LAN, wuxuu u baahan yahay waddada u socota laanta kale oo tilmaamaysa router-ka VPN. La'aanteed codsigu wuu yimaadaa jawaabtuna waxay ka baxdaa waddada internet-ka, isticmaaluhuna wuxuu arkaa xiriir furmaya oo haddana hangada.
Ha u gurman koox ammaan shabakadeed ku taal subnet-ka gateway-ka si tan loo hagaajiyo. Subnet-kaas wuxuu leeyahay shuruudiisa, NSG-na halkaas kuma habboona beddelka siyaasadda dhinaca laanta. Shaandhayntu waxay ku habboon tahay dab-damiska laamaha iyo culaysyada shaqada laftooda, halkaas oo xeerarka ay dib u eegi karaan milkiilayaashooda. U raridda xeerarkaas NSG subnet-ka waxay sidoo kale ka qarinaysaa kooxda soo saari doonta cilladda xigta.
Oggolow hawlgalka, ka dibna ku caddee imtixaan la diiday
Waddo la bartay maaha fasax. Oggolow isha, meesha loo socdo iyo adeegga aad run ahaantii u baahan tahay iyada oo loo marayo dab-damiska laamaha iyo siyaasadda barta ugu dambeysa, inta kalena ha ahaato mid la diiday.
Ka tijaabi culays shaqo caadi ah oo ku yaal laanta A ilaa adeeg dhab ah oo ku yaal laanta B, xaqiiji jawaabta, ka dibna isku day hawlgalka ay tahay inuu sii ahaado mid mamnuuc. Taraafikada ay soo saarto qalabka VPN laftiisu wuxuu isticmaali karaa cinwaan isha kale oo ka boodi kara marxaladda hagidda LAN, markaa ping guuleysta oo ka yimid router-ka waxay caddeynaysaa wax ka yar inta la arko.
Ku dhammee qorista afar xaqiiqo: prefix-yada la isweydaarsaday, ASN-yada la isticmaalay, waddada soo noqoshada LAN ee dhinac kasta, iyo siyaasadda oggolaanaysa adeegga. Haddii mid ka mid ah uu maqan yahay, habayntu waxay shaqeysaa ilaa isbeddelka ugu horreeya, ka dibna qofna ma sharixi karo sababta.