Lapho kufanele kusetshenziswe khona ama-NSG kuthrafikhi ye-VPN ye-Azure esuka endaweni kuya endaweni

Ithuneli elisuka endaweni liya endaweni liyasebenza, iklayenti lendawo lifinyelela amanye amahost e-Azure kodwa amanye aliwafinyeleli, futhi othile uxhume iqembu lokuphepha kwamanethiwekhi ku-GatewaySubnet ukuze alungise lokho. Ma kube lapho. I-Azure ayiwusekeli i-NSG ku-GatewaySubnet, futhi iqembu alikwazi ukubona iphakethe langaphakathi njengoba umthetho womsebenzi wenza. Beka inqubomgomo kusubnet noma ku-NIC okuyiwa kuyo, fanisa ikheli lomthombo elikhona ngemva kokususwa kwemfihlo, bese uqinisekisa ngoxhumano olusha hhayi oludala.

Beka i-NSG lapho i-Azure ihlola khona

Umngcele osekelwayo wokuhlunga umsebenzi isubnet noma isixhumi sethiwekhi okuyiwa kuso. Isubnet yesango iyingqalasizinda, futhi i-Azure ibhala ukuthi ama-NSG awasekelwe lapho futhi angaphazamisa ukusebenza kwesango.

Kukhona nenkinga yokucabanga ngendawo yokubeka. I-NSG ku-GatewaySubnet izohlola ukushintshana kwe-IPsec kwangaphandle, okukheli zayo zingezesango ezimbili. Umthetho wakho wohlelo udinga umthombo oyimfihlo ngaphakathi kwethuneli, futhi leyo phakethe ikhona kuphela ngemva kokuba isango liyisusile imfihlo. Xhuma iqembu kusubnet yomsebenzi futhi umthetho uzobona ikheli owubekelwe lona.

Hlola izixhumanisi zamanje ngaphambi kokushintsha noma yini, ukuze wazi ukuthi udluliselani:

az network vnet subnet show -g rg-net -n snet-app --vnet-name vnet-prod --query networkSecurityGroup.id
az network vnet subnet show -g rg-net -n GatewaySubnet --vnet-name vnet-prod --query networkSecurityGroup.id

Thola ikheli lomthombo ngemva kokususwa kwemfihlo

Umthombo wangaphakathi ikheli langasese leklayenti lendawo, noma ikheli elivezwa idivayisi noma i-NAT ye-VPN ngemva kokuhumusha. Akulona ikheli lomphakathi lesango le-VPN lendawo, elingelokushintshana kwangaphandle.

Uma i-NAT iyingxenye yomklamo, qinisekisa umthombo ovezwayo esikhundleni sokucabanga. Ukubamba amaphakethe ku-VM ye-Azure, noma inkambu yomthombo kurekhodi lokuxhumana kwesevisi, ixazulula umbuzo ngokushesha kunokufunda ukuhlelwa kwendawo. Bese ubhala umthetho ngokumelene nalelo kheli nembobo okuyiwa kuyo yangempela.

az network nsg rule create -g rg-net --nsg-name nsg-app -n allow-onprem-https --priority 200 --direction Inbound --access Allow --protocol Tcp --source-address-prefixes 192.168.10.0/24 --destination-address-prefixes 10.1.2.0/24 --destination-port-ranges 443

Sebenzisa umthetho owodwa kusevisi ngayinye ofuna ukuyiveza, futhi gcina uhlu lwamachweba lufushane. Umthetho ovumela wonke amachweba asuka ebangeni lendawo wenza i-NSG ibe yinto yokwenziwa.

Hlola ububanzi obuzenzakalelayo be-VirtualNetwork

Ithegi yesevisi ye-VirtualNetwork ibanzi kunenethiwekhi ebonakalayo yendawo. Incazelo yayo ihlanganisa izikhala zamakheli zendawo ezixhunyiwe, amanethiwekhi ahlangene kanye nezinye iziqalo ezixhunywe ngesango. Ngakho-ke umthetho wokuvumela ozenzakalelayo obekelwe i-VirtualNetwork kungenzeka ukuthi usuvumela ukuthrafikhi kwethuneli okwakucatshangwa ukuthi kungaphandle.

Funda imithetho ezenzakalelayo ngaphambi kokwengeza emincane, futhi funda wonke umthetho wezinga eliphezulu ongase ufane kuqala. Ukwengeza imvume ecacile akususi umthetho obanzi osuvumela ukugeleza. Lapho inqubomgomo idinga ukwenqaba, kubeka ezingeni elihlolwa ngempela ngaphambi kwemvume.

Imibhalo yamathegi esevisi ye-Microsoft ibala ukuthi ithegi ye-VirtualNetwork ihlanganisa ini, futhi yiyo inkomba okufanele icashunwe lapho othile ethi ithegi isho kuphela ububanzi be-VNet.

Funda imithetho esebenzayo emingceleni yomibili

Uma zombili i-NSG yesubnet ne-NSG ye-NIC zisebenzayo, ukugeleza kufanele kwenelise zombili. Imvume kwelinye ayichithi ukwenqaba kwelinye, futhi iphakethe lihlangabezana nombono ohlanganisiwe.

az network nic show-effective-nsg -g rg-net -n vm-app-nic -o table

Uma imithetho yomlawuli wokuphepha ye-Azure Virtual Network Manager isebenza, hlola nalolo ungqimba. Umthetho womlawuli othi Always allow ungahambisa ithrafikhi ngaphandle kokuhlolwa kwe-NSG, kuyilapho i-Deny yomlawuli iyimisa ngaphambi kokuba ama-NSG ayibone. Ukuhlola ama-NSG kuphela akuphelele kulolo hlelo.

Khumbula ukuthi ama-NSG agcina isimo. Ukuhlela umthetho akusho ukuthi kuqeda uxhumano oluvunyelwe olukhona, ngakho ukuhlolwa kokwamukela kudinga ukugeleza okusha. Lesi simo siwusizo ekukhiqizeni futhi siyadukisa esikhathini sokushintsha.

Qinisekisa ngoxhumano olusha

Vula isikhathi esisha kusukela eklayentini lendawo kuya embotsheni yesevisi, bese uphinda kusukela kumhost okufanele wenqatshwe. Gijimisa ukuhlolwa kokugeleza ohlangothini lwe-VM futhi, ukuze wazi ukuthi indlela yokubuya iphelele.

az network watcher test-ip-flow -g rg-net --vm vm-app --direction Inbound --protocol Tcp --local 10.1.2.4:443 --remote 192.168.10.50:51515

Imvume ye-NSG iyisinqumo esisodwa sokufinyelela, hhayi indlela futhi hhayi umlaleli. Uma umthetho uvumela ukugeleza kodwa uxhumano luhluleka, hlola indlela yeklayenti lokungena ku-VPN, indlela yokubuya ye-Azure kanye nodonga lomlilo lomhost ngaphambi kokuhlela iqembu futhi. Rekhoda ikheli lomthombo langempela, izixhumanisi ze-NSG kanye nomthetho ofanayo nesevisi evunyelwe, ngoba ushintsho olulandelayo lokuhlangana noma lwendlela lungashintsha lokho ithegi ye-VirtualNetwork ekuhlanganisayo.