Wadaagga SMB wuxuu ku guuldareystaa kaliya VPN: saxeex mise isku dhac subnet?
Wadaag ka shaqeeya LAN ayaa ku guuldareysan kara kaliya tunnellada. Kala sooc diidmada saxeexa, subnet is dulsaaran iyo fadhi SMB duugoobay.
Disk la sawiray oo xafiiska ka shaqeeya balse guriga waqtigu ka dhamaado keligiis wax faa'iido leh ma bixiyo. Tunnelku si cad ayuu u qaadayaa baakadaha, haddii kale waxba ma gaadhi lahaa serverka. Waxa guuldareystay waa mid ka mid ah saddexda lakab: magaca waxaa loo xalliyay cinwaan khaldan, macmiilku wuu diiday inuu saxeexo fadhiga, ama fadhi duug ah ayaa ka badbaaday xiriirka qaaday. Mid kastaa leh hagaajin ka duwan, laba ka mid ah saddexda waxay ku yaalliin dhinaca macmiilka.
Saddex guuldarrood waxay qaataan isla khalad
Xarafka diskku ma sheego lakabka jabay, qoraalka khaladkuna badanaa wuu guud yahay oo ku habboon saddexda. Kala sooc iyadoo laba su'aalood oo degdeg ah: serverku ma ka jawaabaa cinwaankiisa IP, iyo dekedda 445 ma aqbashaa xiriir?
Jawaabahaas waxay soo saaraan shax go'aan halkii mala-awaal. Haddii IP shaqeeyo magacuna shaqayn, taas waxay tilmaamaysaa xallinta magacyada. Haddii labaduba shaqeeyaan gelitaankana la diido, taas waxay tilmaamaysaa saxeexa. Haddii labaduba shaqeeyaan akhrinta faylku hakato ka dib jabka tunnelka, taas waxay tilmaamaysaa fadhi duug ah.
| Symptom | Layer to inspect |
|---|---|
| IP works, hostname times out | DNS or subnet overlap |
| TCP 445 opens, logon refused | SMB signing policy |
| Hangs after reconnect | Session state and timers |
Ku shaqee siday isugu xigaan, maxaa yeelay magac loo xalliyay martigeliyaha qaldan ayaa tijaabo kasta oo dambe macne darro ka dhigaya.
Xalli magaca ka hor intaadan taaban wadaagga
Haddii serverku ka jawaabo cinwaankiisa magaca wadaagguna waqti dhaafo, tunnelku shaqadiisa ayuu qabanayaa macmiilkuna meel khaldan ayuu eegayaa. Gelitaanka fog, laba sababood ayaa sharraxaya inta badan tan.
Tan ugu horreysa waa is dulsaarnaanta cinwaannada. Marka xafiisku isticmaalo 192.168.70.0/24 routerka guriguna bixiyo isla baaxo, magac martigeliye oo loo xalliyo 192.168.70.20 ayaa laga yaabaa inuu tilmaamo qalab maxalli ah halkii serverka ka dambeeya tunnelka. Markaas Windows waxay u diri kartaa codsiga gudaha, waxay diidi kartaa wadada, ama waxay u xalli kartaa daabacad leh cinwaankaas si kadis ah. Hagaajinta waa in labada dhinac midkood dib loo nambareeyo, ma aha in wado kale lagu daro.
Tan labaad waa baaxadda DNS. Adapter VPN oo aan lahayn server DNS gudaha, ama leh mid aan laga gaari karin tunnelka, wuxuu magacyada gaaban u daayaa xalliyaal dadweyne. Akhri gelitaannada DNS ee adapterka oo si toos ah u weydii magaca gudaha ka hor intaadan taaban wadaagga:
> ipconfig /all | findstr /i "DNS Servers"
> nslookup files.corp.internal
Server: 10.90.0.2
Address: 10.90.0.2
Name: files.corp.internal
Address: 10.90.0.15Haddii weydiintaas soo celiso cinwaanka la filayay, xallinta magacyada waa la caddeeyay dhibaataduna sarey ayay ku taal.
Akhri shuruudda saxeexa labada geesood
Server la gaari karo oo diida gelitaan kasta waa calaamad ah ismaandhaafka siyaasadda ma aha cilad shabakadeed. Windows waxay ku amri kartaa saxeexa SMB macmiilka, server ama NAS aan saxeexinna ma dhammaysan karo fadhiga, si kasta oo tunnelku caafimaad u leeyahay.
Waxaad akhriyi kartaa dejinta macmiilka adigoon ka baadhin tafatiraha siyaasadda:
> Get-SmbClientConfiguration | Select-Object RequireSecuritySignature
RequireSecuritySignature
-------------------------
True
> Get-SmbConnectionQiimaha u dhigma dhinaca serverka wuxuu ku jiraa qaabeynta SMB ee serverka, labaduna waa inay is waafaqaan. Kiis la soo sheegay, macmiilku wuxuu shuruudda ku shiday siyaasad maxalli ah halka serverku aanu saxeexin haba yaraatee; daminta iyo socodsiinta gpupdate /force waxay isla markiiba soo celisay wadaagga. Taasi waa tallaabo lagu xaqiijinayo sababta, ma aha hagaajin joogto ah.
Dooro inaad saxeexa ku shido labada geesood meesha serverku taageerayo. Beddelka dejinta amniga si wadaag u shaqeeyo waa in lagu diiwaangeliyaa qiimihii hore iyo sababta, si aan qofna ugu qasban inuu mar kale ogaado hubinta xigta.
Nadiifi fadhiga duugga ah ka hor intaadan habaynta timarrada
Wadaag hakada kaliya ka dib marka VPN dhaco oo dib u xirmo badanaa waxay hayaan fadhi serverku hore u tuuray. Serverku wuxuu xiraa fadhiyada SMB ee aan firfircoonayn marka loo eego timer-ka Autodisconnect ee hoos yimaada LanmanServer\Parameters, oo caadi ahaan 15 daqiiqo, halka macmiilku leeyahay SessTimeout u gaar ah oo hoos yimaada LanmanWorkstation\Parameters. Joojin ka dheer qiimayaashaas waxay labada geesood kaga tagtaa fikrad ka duwan fadhiga.
Ku soo celi siday isugu xigaan si natiijadu macne u yeelato: xir tunnelka, fur wadaagga, jebi tunnelka laba daqiiqo, soo celi, ka dibna isku day inaad akhrido fayl. Haddii mount-ku iskiis u soo kabsado, ka tag timarrada. Haddii uu hakado ilaa aad dib u mount gasho, dib u xir wadaagga ka dib marka tunnelku istaago halkii aad mount gelin lahayd ka hor inta uusan jirin, oo hubi in caawiyaha mount-ka uu dib u tijaabinayo.
Kor u qaadista waqtiyada ayaa tallaabo ugu dambeysa macquul ah xiriir aan degganayn, laakiin waxay daaweynaysaa calaamadda. Macmiil sugaya waqti dheer fadhi serverku hilmaamay weli wuu sugayaa.
Ku dhammee akhrinta hal fayl iyada oo loo marayo mount-ka, ka dibna jebi oo soo celi tunnelka mar kale. Tijaabada aqbaalkaas waxay daboolaysaa saddexda lakab isku mar, waana tijaabada kaliya ee u dhigma waxa isticmaaluhu dhab ahaan sameeyo.