IPsec oo ku dul socda WAN gaar ah: xadka siyaasadda SRX ee la hubinayo

WAN gaar ah wuxuu qaadi karaa baakadaha dibadda ee tunnel IPsec, sidaas darteed cinwaannada faca maaha inay noqdaan cinwaanno internet oo dadweyne. Waxa is beddela waa waddada ay baakadahaan dibadda maraan iyo oggolaanshaha interface-ka qaata. SRX, waddada kontoroolka dibadda, isku-xirka interface-ka tunnel iyo siyaasadda taraafikada la gudbiyo waa saddex shay oo kala duwan. In mid la hagaajiyo iyada oo labada kale khalad yihiin waa sababta caadiga ah ee tunnel-ku hoos ugu sii jiro.

Marka hore qor waddada IKE ee dibadda

Qor afar qiime ka hor intaadan taaban siyaasadda: cinwaanka faca, interface-ka maxalliga ah ee qaata IKE, macnaha waddada ee gaadha faca iyo waddada doorata interface-kaas. Baakadaha IKE waxaa loo jeediyaa SRX laftiisa, sidaas darteed waxay u baahan yihiin oggolaansho host-inbound aagga qaata, ma aha siyaasad taraafikada la gudbiyo. Cinwaanka WAN gaar ah ma tirtiro shardigaas, sababtoo ah baakadku wali wuxuu ku dhammaadaa qalabka.

Hubi xaaladda la rakibay iyada oo la isticmaalayo show security ike sa iyo habaynta iyada oo la isticmaalayo show configuration security ike. Tan kowaad waxay sheegtaa haddii wejiga 1 jiro; tan labaad waxay sheegtaa waxa qalabku u maleynayo inuu sameeyo.

Ku xir interface-ka tunnel siyaasadda saxda ah

VPN ku salaysan waddada wuxuu interface tunnel ku xiraa shay VPN, hunaanka la ilaaliyo waxaa loo waddaa interface-kaas. Qor interface-ka, waddada iyo siyaasadda ogolaata codsiyada u dhexeeya aagagga la xiriira. Aagga lagu magacaabo trust waa weel siyaasad, magacuna ma caddeeyo in baakadaha kontoroolka ama xogta loo baahan yahay la ogolaaday.

Akhri isku-xirka dhabta ah halkii sawir qadiim ah: show configuration security ipsec vpn dejinta ku-xirka interface-ka iyo show configuration security policies xeerarka tixraacaya aagga tunnel.

Haddii waddada la ilaaliyo ay tilmaanto meel kale, tunnel-ku wuu sarreeyi karaa iyada oo taraafikadu waligiis gelin. Tani waa dhibaato waddo oo qaba dhar IPsec.

Ku hay waddada faca underlay

Waddada faca dibadda waa in lagu xalliyaa underlay, ma aha si isdaba-joog ah tunnel-ka uu abuurayo. Haddii waddada faca ay tilmaanto interface-ka tunnel, baakadaha IKE waxay daba galaan tunnel-kooda oo wejiga 1 waligiis ma dhammaado. Waddada jawaabta taraafikada la ilaaliyo waxay u baahan tahay waddo iyo siyaasad sax ah oo u gaar ah, oo badanaa waa qaybta maqan marka hal jihada shaqeyso. Akhri gelitaanka shaxda waddooyinka ee cinwaanka faca oo xaqiiji in interface-ka baxa uu yahay interface-ka WAN.

Ku hubi iyada oo la isticmaalayo show route 198.51.100.10, adigoo beddelaya cinwaanka faca dhabta ah, oo xaqiiji in boodhka xiga uusan ahayn interface tunnel.

Xaqiiji kontoroolka iyo adeegga si kala horreysa

Ka shaqee kor: xaaladda wejiga 1, xaaladda wejiga 2, ka dib qulqulka codsi dhab ah. show security ipsec sa waxay taxdaa isku-xirka ammaanka, iyo show security flow session destination-prefix 10.60.0.0/16 waxay muujinaysaa haddii fadhiyada la gudbiyo loo abuurayo shabakadda la ilaaliyo.

Xiriirka kontoroolka caafimaadka qaba iyo waddada xogta shaqeysa waa laba natiijo oo kala duwan, iyo gudbinta wejiga 2 waxba kama sheegto haddii siyaasaddu ogolaato codsiga. Tijaabi hal qulqul oo la ogolaaday iyo mid ay tahay in siyaasaddu diiddo, si farqiga u muuqdo.

Qor wadajir waddada faca, oggolaanshaha host-inbound, isku-xirka tunnel, waddada gudaha iyo siyaasadda codsiga. Diiwaannadaan shan waxay muujinayaan lakabka masuulka ka ah guuldarrada mustaqbalka iyada oo aan lagu tiirsanayn calaamadda dekedda.