I-Anypoint VPN noma i-NAT ku-Transit Gateway: ukuhunyushwa kwenzeka kuphi
I-Anypoint VPN ayizihumushi ngokwayo izinto zekheli. Khetha phakathi komklamo we-PAT ku-firewall, imephu ye-prefix ye-AWS noma okunye ukuxhumana ngaphambi kokuthembisa nge-NAT.
Isidingo se-NAT asiso isidingo kuze kube yilapho sisho amakheli ashintshayo kanye nengxenye evunyelwe ukuwashintsha. Ekuxhumaneni kwe-MuleSoft leso sinqumo sinokufakwa okuthathu: ukuthi i-backend idinga ukuhunyushwa kwamachweba amaningi-kuya-kwelilodwa noma igama le-prefix elilodwa-kuya-kwelilodwa, ukuthi ukuxhumana kwe-AWS okwami ngempela kungakwenza yini lokho kuhlela, nokuthi ingabe wonke umzila uhlala ngaphakathi kwengxube evunywa umthengisi. Uma lokhu kungalungile, uzokwakha ilabhu esebenzayo kodwa ehlulekayo ekubuyekezweni.
Iphuzu elilodwa elingashintshi ukuthi i-Anypoint VPN uqobo ayiyona into yokuhumusha. Imibhalo ye-CloudHub 2.0 ibala i-NAT njengengasekelwa lapho, ngakho noma yimuphi umklamo ocabanga ukuthi umhubhe uzofihla amakheli abasebenzi bakho usuvele uphukile.
Nquma ukuthi ukuhunyushwa kufanele kwenzeni
Uma abasebenzi abaningi bezinhlelo zokusebenza kufanele babonakale ku-backend njengekheli elilodwa, isidingo ukuhunyushwa komthombo okwabiwe, ngokuvamile i-SNAT noma i-PAT egcina isimo ku-firewall oyilawulayo. Leyo ngxenye kufanele ihlale emzileni ogunyaziwe, igcine isimo sayo kukho konke ukuphila kokugeleza, futhi ibone ukugcwala okubuyayo kwayo yonke into exhumene eyayibhale kabusha. Ukulahlekelwa yisimo phakathi nesikhathi akukwephuli ukuxhumana; kukuphelisa. Ipheya le-firewall elenqabayo ukwabelana ngesimo sokuhumusha lizolahla yonke into eya eweni lesipele ngemva kokushintshwa. Linganisa leyo ngxenye ngokugeleza kwesikhathi esisodwa, hhayi ngokudluliswa.
Uma kungenjalo amanethiwekhi amabili eyahlukene ehlangana futhi inombolo ngayinye idinga igama elihlukile, isidingo uhlelo lwamakheli olulodwa-kuya-kwelilodwa olunezinto eziqondile ezihleliwe, imizila ehambisanayo nokuxazululwa kwamagama okuhambisana nokuhlela. Ukufihla wonke umsebenzi ngemuva kwekheli elilodwa akulona uhlobo olushibhile kwalokho, futhi ukushintsha elilodwa ngomunye ekubuyekezweni komklamo yiyo indlela amaphrojekthi alahlekelwa ngayo ikota.
Bhala isinqumo ngamazwi aqondile ngaphambi kokukhetha umkhiqizo: umthombo wangempela, indawo yokugcina yangempela, inani elihunyushiwe, isiqondiso sokuqala, umnikazi womhumushi nomzila wempendulo olindelekile. Engeza ukuthi yikuphi ukuzazi okuzogcinwa imibhalo ye-backend, ngoba umklamo ofihla yonke imithombo ucekela phansi nokuhlolwa kwamaklayenti ngamanye.
Hlola ukuthi i-AWS ingakuhlela yini kuwe
I-AWS manje isibhala phansi i-NAT elawulwayo yolulodwa-kuya-kwelilodwa kuzixhumano ze-Transit Gateway ne-Cloud WAN, eyamenyezelwa ngasekupheleni kuka-Okthoba 2026, ngakho isimangalo esidala sokuthi isango lokudlula alikwazi neze ukuhumusha sesiphelelwe yisikhathi. Imibhalo ye-Transit Gateway NAT ichaza ukuhlelwa kwe-prefix ye-IPv4 okungenasimo: izinto zangempela nezihunyushiwe zigcina ubude obufanayo, futhi amabhithi womsingathi namachweba okuthutha ayasinda ekuhunyushweni. Funda iziqondiso zokungena nokuphuma njengezinqumo ezimbili ezihlukile zomklamo, ngoba zihlelwa ngokwehlukana futhi okukodwa kungase kube kulungile kanti okunye akukho. Akukho kulokho kuchaza okubonisa isimo sokugeleza ngakunye, ngakho ungakhohlwa ukuthi ukuhlelwa kuzolandela ukuxhumana esikhundleni sakho.
Lokho kusho ukuthi i-10.80.0.0/16 ehlanganiswe ne-172.28.0.0/16 yenza i-10.80.10.23 ibe yi-172.28.10.23. Ayinciphisi i-/16 ibe yikheli elilodwa, futhi ayithathi indawo yesidingo se-PAT. Ihlanganisa nezinhlobo ezithile zokuxhumana, phakathi kwazo i-VPC ne-Site-to-Site VPN, kodwa hhayi ukuxhumana kwe-Client VPN, futhi ukulungiselelwa kuhlala kumnikazi wesango lokudlula, hhayi ohlangothini lwe-Anypoint.
Thatha lesi sici njengenye indawo yokulawula engaba khona, hhayi njengobufakazi bokuthi ukusetshenziswa kwakho kungayisebenzisa. I-CloudHub 2.0 ibhala phansi ukuxhumana kwendawo yangasese esangweni lokudlula ku-akhawunti ye-AWS yeklayenti uqobo, nemibandela yesifunda nemibandela yelungelo, ngakho qinisekisa uhlobo lwangempela lokuxhumana, umnikazi wayo kanye nesimo sokusekelwa somthengisi ngaphambi kokuklama mayelana nokukhetha okusha.
Gcina umzila ngaphakathi komngcele osekelwe
Kumhumushi we-firewall, sebenzisa imodeli ye-VPN, ukuhumusha nokuhlela umzila esekelwe yalowo mkhiqizo esikhundleni sokunamathisela umthetho we-NAT ojwayelekile emhubheni osebenzayo. Impendulo ye-backend kufanele ibuya ngengxenye efanayo yokuhumusha, futhi umhubhe ophumayo onempilo awusho lutho ngalowo mzila wokubuya.
Kumzila wesango lokudlula, bhala uhlu lokuxhumana kwendawo yangasese, amathebula omzila afanele, ukuxhumana kwasendaweni kanye nezingxenye iklayenti elingakwazi ngempela ukuzilungiselela. Lokhu kuwukwakheka kokuxhumana okuhlukile, hhayi ibhokisi lokumaka le-NAT eliboshelwe ekuxhumaneni okukhona kwe-Anypoint VPN, futhi umngcele wokusekelwa uhamba kanye nakho.
Qhathanisa izinketho ezintathu kuthebula elilodwa
Amaqembu amaningi adinga ukuphendula imibuzo emibili kuphela: amaningi-kuya-kwelilodwa noma elilodwa-kuya-kwelilodwa, nokuthi ubani umnikazi wokuxhumana. Ithebula elingezansi liguqula lezo zimpendulo zibe yinketho yokuqala.
| Requirement | Starting option | What breaks it |
|---|---|---|
| Many workers, one backend address | Stateful PAT on your firewall | Asymmetric return path, expired state |
| Overlapping /16s, one-to-one | AWS prefix mapping on a supported attachment | Client VPN attachment, no explicit config |
| Per-client audit must survive | Keep original sources, translate downstream | Any many-to-one hiding of sources |
Funda ikholomu yesithathu njengombuzo wokubuyekeza, hhayi njengomcabango wamuva. Imephu ye-prefix evunyelwe ephepheni kodwa ehlelwe ekuxhumaneni ongengomnikazi walo iseyiphrojekthi evinjiwe, futhi umthetho we-PAT ovumela ukugcwala ukuba kudlule kodwa ophula ukubhalwa kwamaklayenti ngamanye uyahluleka ekuhlolweni okulandela.
Qinisekisa ukuhlelwa ngaphambi kokukuthembisa
Dlulisa umsebenzi omusha wohlelo lokusebenza emzileni bese uqinisekisa impendulo, hhayi isicelo kuphela. Buza umnikazi we-backend ukuthi yiliphi ikheli lomthombo elibhalwe imibhalo yabo, hlola ukuthi ukuphathwa komndeni wamakheli kuyahambisana nokuhlelelwe kuzo zombili iziqondiso, futhi qinisekisa ukuthi umzila okufanele wenqatshwe usenqatshwa. Ukuxhumana kwakudala akufakazeli lutho mayelana nokuhlelwa okusanda kushintshwa.
Gcina ukuqinisekiswa kwe-backend kungakhonzeleki ekutheni yiliphi ikheli elihunyushiwe elenelisa uhlu lwayo lokuvunyelwa, ngoba ukuhlelwa kungumsebenzi wamapayipi wenethiwekhi hhayi isinqumo sokulawula ukufinyelela. Ngesikhathi lapho ukusethwa kabusha kwephasiwedi kuncike ku-prefix ye-NAT, noma yiluphi ushintsho lwobubanzi lwesikhathi esizayo luba ukuphazamiseka.
Ngaphambi kokugunyazwa, bhala izimpendulo ezintathu: uhlobo lokuhumusha, umnikazi womhumushi, nokuxhumana noma umzila womkhiqizo osekelwe okuthwalayo. Uma okukodwa kwazo kuseyiqagela, umklamo awukakulungeli iwindi loshintsho.