Sababta VM-ka Azure ee qalabka VPN uu u lumiyo wadada soo noqodka
Qalabka VPN ee ku jira VM Azure wuxuu u baahan yahay in UDR, calaamadda gudbinta kaadhka shabakadda iyo siyaasadda martida ay isku raacaan. Raac hal codsi oo laan ah saddexda oo dhan.
VM Azure oo shaqeeya qalab VPN wuxuu ku dhex jiraa laba nidaam oo go'aan gaar ah oo madax banaan. Azure ayaa go'aamiya halka baakaddu ka baxdo shabakad-hoosaad, isagoo isticmaalaya shaxda waddooyinka iyo dejinta gudbinta kaadhka shabakadda. Nidaamka hawlgalka ee qalabka laftiisu wuxuu go'aamiyaa inuu sii gudbiyo baakadda la furfurey. Tunnel si fiican u soo baxa weli wuu ku guuldareysan karaa nidaamka labaad, oo halkaasay ku joogaan inta badan hirgelinta noocan ah.
Saddex milkiile oo hal waddo ah
Qaado shabakad laan 192.168.50.0/24 iyo shabakad-hoosaad culeys shaqo 10.0.10.0/24, qalabkuna wuxuu ku yaal 10.0.0.4 shabakad-hoosaadkiisa. Hal codsi wuxuu taabtaa saddex habayn oo kala duwan.
| Decision | Configured in | How it fails |
|---|---|---|
| Where the workload subnet sends branch traffic | Azure route table entry | Traffic leaves the subnet and never reaches the appliance |
| Whether a NIC may accept traffic not addressed to it | Azure NIC IP forwarding | Packets arrive and disappear at the interface |
| Whether the guest forwards decrypted traffic | Guest OS or vendor appliance policy | Tunnel is up, workload is unreachable |
| Whether the workload accepts the source | NSG and service policy | Requests delivered, replies refused |
Safka kasta waxaa leh koox kale inta badan hay'adaha, taasina waa sababta cilladdan inta badan u timaaddo saddex tikit halkii mid.
Waddada tilmaamaysa qalabka
Ku xir shax waddooyin shabakad-hoosaadka culeyska shaqada oo sii horgalaha laanta tallaabada xigta ee nooca Virtual appliance oo leh 10.0.0.4 sida cinwaan. Isticmaal cinwaanka gaarka ah ee la gaari karo ee qalabka, waligaa ha isticmaalin barta laga galo VPN ee dadweynaha. Tallaabada xigta waa inay tahay cinwaan uu shabakad-hoosaadka culeyska shaqadu horey u gaari karo. Ka tag qaybta kale ee waddada culeyska shaqada sidii ay tahay, haddii aanad si ula kac ah u go'aansan inaad beddesho waddada caadiga ah.
Ku hay qalabka shabakad-hoosaadkiisa, oo hubi in waddada u dirta taraafikada laanta qalabka aysan sidoo kale qaban waddada bixitaanka qalabka laftiisa. Wareeg sidan oo kale ah wuxuu u eg yahay tunnel caafimaad qaba oo aan jawaab lahayn, taasna waa wax aad u xun in la saxaro gelinka dambe ee 2 duhur oo habeen ah.
Calaamadda kaadhka shabakadda ee qof walba illoobo
Azure wuxuu leeyahay dejin gudbin IP ah kaad kasta oo shabakad ah, oo caadi ahaan waa damisan tahay. Waxay jirtaa sababtoo ah kaadhka gudbiya wuxuu helaa baakado loo diray wax kale, oo in si aamusan loo tuuro waa caadiga ammaan u ah dadka kale oo dhan.
az network nic update --resource-group rg-net --name appliance-nic --ip-forwarding true wuxuu u shidaa hal is-dhexgal. Hanuuninta Microsoft ee ku saabsan gudbinta kaadhka shabakadda waxay u baahan tahay dejintaas kaad kasta oo xiran oo gudbiya taraafik, sidaas darteed qalab hal kaad leh weli wuxuu uga baahan yahay kaadkaas.
Calaamaddu ma aha waddo mana aha qaanuun dab-damis. In la shido waxay siinaysaa fasax iyo wax kale maahee.
Maxay martidu ku sameysaa baakadda la furfurey
Marka tunnelku dhammaado, isku-duubka qalabka laftiisu wuxuu qaataa go'aanka xiga. Marti Linux ah, gudbinta IPv4 waa dejin waqtiga socodka, oo sysctl -w net.ipv4.ip_forward=1 waxay socotaa ilaa soo-baxa xiga. Kaydi fayl ku yaal /etc/sysctl.d/ halkii. Qalabka iibiyuhu wuxuu leeyahay isku-midkiisa, oo tilmaamaha Linux ee lagu dhejiyo madal iibiya caadi ahaan waxba ma qabtaan.
Siyaasadda dab-damiska martidu mar kale waa gooni, sidoo kale kooxda ammaanka shabakadda ee culeyska shaqada. Fasaxa UDP 500 iyo 4500 ee cinwaanka dadweynaha ee VM wuxuu ilaaliyaa tunnelka; waxna kama sheegto in codsiga laanta la furfurey uu gaari karo deked culeys shaqo.
Raac hal codsi iyo jawaabtiisa
Dooro hal qulqul oo la fasaxay oo raac bilow ilaa dhammaad. Laanta waxay u baahan tahay waddo 10.0.10.0/24 marta xiriirka goobta, qalabku wuxuu u baahan yahay waddo keenis ah oo u socota shabakad-hoosaadka culeyska shaqada, shabakad-hoosaadka culeyska shaqaduna wuxuu u baahan yahay waddo soo noqod oo u socota laanta.
Go'aami goor hore in naqshaddu ay hayso cinwaanka isha laanta ama ay tarjunto. NAT waxay beddeshaa waxa culeyska shaqadu arko, sidaas darteed qawaaniinteeda gelitaanku waa inay qeexaan qaabka aad runtii dooratay, ma aha cinwaan irrid la qiyaasay.
Gacan-qabsiga guuleysta wuxuu caddeeyaa hal xiriir oo silsiladdaas ah. Waddadu waa dhammaatay marka jawaabtu ku soo noqoto isla qalabkaas oo siyaasadda culeyska shaqada laftiisu u ogolaato.