Sababta isticmaalaha fog ee ASA uu gaadho subnet-ka laakiin aan u gaadhin app-ka
Wadooyinku waxay caddeeyaan in tunnel-ku shaqeeyo, ma aha in isticmaalaha uu furan karo app-ka. Akhri filter-ka uu session-ku helay, kadib tijaabi xiriir la oggolaaday iyo mid la diiday.
Isticmaalahaagu wuu isku xidhaa, cinwaan buu helaa, wuxuu ping gareeyaa server ku jira subnet-ka app-ka, welina ma furan karo adeegga saaran. Isku darkaas waa caadi ASA, sababtoo ah tunnel guulaystay iyo fasax la isticmaali karo waxaa go'aamiya dejinta kala duwan. Liiska tunnel-ka qaybsan wuxuu doortay meelaha ay tunnel-ka galaan; filter VPN iyo xeerarka gelitaanka ee goobta lafteeda ayaa go'aamiya waxa codsiga la furfurnaa gaari karo. Saddexda go'aan u dhex mar si taxane ah halkii aad ka ballaarin lahayd liiska waddooyinka ilaa wax isbeddelo.
Saddex go'aan oo fudud in la isku qaldo
Gelitaanku wuxuu ka jawaabaa haddii isticmaalaha uu tunnel-ka dhisi karo: aqoonsiga, shahaadada iyo qayb kasta oo labaad. Doorashada waddadu waxay ka jawaabtaa meelaha uu macmiilku u diraa tunnel-kaas. Oggolaanshuhu wuxuu ka jawaabaa haddii codsiga la furfurnaa uu gaari karo adeegga. Kaliya saddexaad ayaa soo saara khaladka isticmaalahu soo sheegayo.
Hab degdeg ah oo lagu kala saaro waa in la weydiiyo waxa isbeddel burburin doono. Waddada ka saarista liiska qaybsan waxay joojisaa taraafikada subnet-kaas laakiin wax ma siiso; ACE ku darista filter VPN waxay siisaa goob iyada oo aan beddelin waxa macmiilku tunnel-gareeyo.
| Setting | What it decides | Symptom when it is wrong |
|---|---|---|
| Connection profile and authentication | Whether the tunnel is built | Login fails, no address assigned |
| Split-tunnel network list | Which destinations the client routes into the tunnel | Subnet unreachable from the client, everything else fine |
| VPN filter (ACL) | Which decrypted flows are permitted | Tunnel up, ping may work, TCP service refused or dropped |
Akhri filter-ka uu session-ku dhab ahaan helay
Ka bilow session-ka nool halkii aad ka bilaabi lahayd dejinta aad u malaynayso inay khusayso. show vpn-sessiondb detail anyconnect wuxuu daabacaa siyaasadda kooxda la qoondeeyay iyo magaca filter-ka ku xiran session-kaas. Haddii goobta ay madhan tahay, ma jiro filter wax qasabaya oo xannibaaddu meel kale ayay ka timid.
Kadib akhri siyaasadda leh qiimaha, oo ay ku jiraan qiimaha caadiga ah, sababtoo ah filter-ku wuu dhaxli karaa halkii laga qori lahaa meesha aad eegayso:
show run all group-policy <policy-name>
show run access-list <acl-name>
show run webvpn
Isbarbar dhig magaca filter-ka session-ka iyo ACL-da aad hadda tafatirtay. ACL magac la mid ah oo isticmaalahu waligiis helin ma beddeli karo siyaasadda kheyraadka session-kaas, waana sababta ugu badan ee isbeddel sax u eg uusan saameyn lahayn.
Mudnaanta ayaa sharaxda inta kale. Dejinta filter-ka, diiwaanka DAP wuxuu ka sarreeyaa sifooyinka magaca isticmaalaha, sifooyinka magaca isticmaalahana waxay ka sarreeyaan siyaasadda kooxda. Marka session-ku muujiyo filter aadan filayn, raadi siyaasad DAP oo u dhigma isticmaalahaas ka hor inta aadan taaban kooxda.
Liiska qaybsan iyo filter-ku waa goobo kala duwan
ASA 9.x siyaasadda kooxdu waxay haysataa split-tunnel-network-list iyo vpn-filter sida dejinta kala duwan, hagaha siyaasadda kooxda 9.22-na wuxuu u diiwaangeliyaa si gooni ah sababtaas awgeed. Liiska shabakaddu waa tilmaan waddo oo macmiilka ah; filter-ku waa liis kontorool gelitaan oo lagu dabaqo taraafikada la furfurnaa.
Farqigaas waa muhiim marka isticmaalahu u baahan yahay hal adeeg HTTPS oo ku jira subnet. Ku rid subnet-ka liiska qaybsan si baakaduhu tunnel-ka u galaan, kadibna filter-ka ku oggolow kaliya adeeggaas. Ballaarinta liiska waddooyinku wax ma oggolaato, yarayntiisuna ma aha hab fulin.
Hubi haddii ACL interface-ku uu waddada ku jiro
Taraafikada gelitaanka fog ee la furfurnaa mar walba kama gudbo ACL interface-ka dibadda sida dadku u malaynayaan. Meesha sysopt connection permit-vpn uu shidan yahay, ASA waxay dabaqdaa dhaqaaqa VPN-keeda diiwaangashan taraafikadaas, halka filter-yada VPN khuseeya ay weli khusaynayaan kadib. Hubi dejinta show run all sysopt halkii aad ka fasiri lahayd jaantuska topology-ga.
Si kastaba ha ahaatee, firewall-ka host-ka goobta iyo oggolaanshaha app-ku waddada ayay ku sii jiraan. Xeerka ASA ee oggolaanaya TCP 443 kama dhigayo app-ka inuu aqbalo isticmaalaha.
Aqbal isbeddelka xiriir la diiday sidoo kale
Tijaabo la oggolaaday kaligeed wax yar bay caddeyneysaa, sababtoo ah tunnel shaqaynaya wuxuu soo saaraa isla baakadda koowaad haddii filter jiro iyo haddii uusan jirin. Ka fur adeegga loogu talagalay macmiilka, kadib tijaabi goob ay tahay inay xiran tahay oo xaqiiji inay u guuldareysato sababta saxda ah.
Diiwaangeli afar xaqiiqo marka aad xidho ticket-ka: aqoonsiga la aqbalay, siyaasadda iyo filter-ka uu session-ku dhab ahaan helay, goobaha liiska qaybsan, iyo kheyraadka isticmaalaha loo oggolaaday inuu gaaro. Afartaas waxay sharaxaan halka taraafikada lagu kontoroolo iyada oo aan liiska waddooyinka laga dhigin firewall.
Haddii adeeggu weli diido ka dib marka filter-ku oggolaado, u gudub host-ka: cinwaanka dhageysiga, firewall-ka host-ka iyo khariidadda isticmaaleyaasha app-ka laftiisa. Tunnel-ku waqtigaas wuxuu qabtay shaqadiisa, isbeddellada ASA ee dheeraadka ahna waxay kaliya ku kordhiyaan khatar.