I-DHCP relay ye-ASA phezu kwe-VPN yesayithi-kuya-sayithi: umhlahlandlela wesinyathelo ngesinyathelo

I-relay isebenza ngezigaba ezintathu, futhi isigaba esiphakathi ukuphela kwesiwela i-VPN. Iklayenti lisakaza kusegimenti yegatsha, i-ASA iguqula lokho kusakaza kube yisicelo se-unicast esiya kuseva ye-DHCP, futhi iseva iphendula ikheli le-relay hhayi ileklayenti. Landela izigaba ngalolo hlelo, futhi iningi lezigameko zokuthi «i-relay yephukile» liphelela kunqubomgomo engekho noma emugqeni we-setroute ofundwe kabi.

Isigaba sokuqala: nika amandla i-relay ku-interface ebheke iklayenti

Ku-ASA yegatsha, i-relay iyisici se-interface ebheke kumaklayenti. Iseva ingamenyezwa ngokwendawo yonke nge-interface yayo efinyeleleka, noma ngaphansi kwale-interface ebheke iklayenti ukuze ithebula lokuhambisa likhethe indlela yokuphuma. Lezi zinhlobo ezimbili azishintshisani, futhi ukukopisha okungalungile yindawo yokuqala lapho umhlahlandlela uphambuka khona.

Hlola ukulungiswa okusebenzayo ngaphambi kokushintsha noma yini: iyiphi i-interface enamandla e-relay, iluphi uhlobo lweseva olukhona, nokuthi i-setroute ixhunywe ku-interface yeklayenti yini. Uma i-ASA iphinde isebenzise iseva ye-DHCP yesinye isigaba, misa futhi ufunde uhlu lwemikhawulo; iseva ne-relay azikwazi ukunikwa amandla ngasikhathi sinye kudivayisi eyodwa.

I-relay ifaka ikheli layo elibheke iklayenti emkhakheni wekheli lesango. Yilelo kheli iseva ezophendula kulo, ngakho kufanele lifinyeleleke lisuka endaweni ekude ngokusebenzisa itunnel, hhayi endaweni kuphela.

Isigaba sesibili: dluisa ithrafikhi edalwa yi-ASA ngetunnel

Lesi yisinyathelo abantu abasidlulayo. I-VPN yesayithi-kuya-sayithi esekelwe kunqubomgomo ivamise ukwakhelwa ithrafikhi phakathi kwama-subnet, futhi isicelo se-relay sidalwa yi-ASA ngokwayo. Uma uhlu lokufinyelela lwetunnel nemephu ye-crypto kuhambisana kuphela nokugeleza okusuka kuhost yegatsha kuye ku-subnet yeseva, iphakethe le-relay lingase lingene neze etunnelini. Hlola uhlu lokufinyelela kuzo zombili izinhlangothi, hhayi umugqa wegatsha-kuya-kuseva kuphela.

Qinisekisa ukuthi ithrafikhi ethakazelayo ihlanganisa umthombo we-relay we-ASA nekheli leseva, nokuthi nendlela yokubuya ivunyelwe. Kumklamo osekelwe ku-VTI isinqumo sokuhambisa silula, kodwa ukusekelwa kwe-relay phezu kwe-VTI kwafika kunguqulo ethile; umhlahlandlela we-DHCP we-ASA ubalula u-9.14(1), ngakho hlola isithombe ngaphambi kokukopisha isibonelo se-VTI kudivayisi endala.

I-ping esuka ku-ASA iya kuseva ayifakazeli okuningi ngokwayo. Ingaphumelela ngomunye umzila, ngekheli lomthombo elihlukile, noma ngaphansi konqubomgomo amaphakethe e-relay angahambisani nayo.

Isigaba sesithathu: funda impendulo nenketho ye-setroute

I-RFC 2131 ithi uma leyo nkambu ingeyona uziro, iseva ithumela impendulo yayo ekhelini eliku-giaddr. Ngakho-ke indlela yokubuya kufanele ihambise ekhelini le-relay, futhi inqubomgomo yetunnel kufanele ivumele indlela esuka kuseva iya ku-relay. Uma isicelo sadlula kodwa isiphakamiso singakafiki neze, yilapha okufanele kubhekwe khona.

Bese uhlukanisa izinto ezimbili ezizwakala zifana. Igama elingukhiye i-setroute lishintsha noma lengeza inketho yesihambisi esizenzakalelayo esinikezwa yi-ASA kuklayenti. Alifaki umzila ku-ASA futhi alidali inqubomgomo ye-VPN. Iklayenti elithola ikheli kodwa lingafinyeleli lutho livamise ukuba nenkinga ye-setroute noma yobubanzi, hhayi inkinga yetunnel. Kuyehlola ngeklayenti elingenaso isango elimile bese ubheka ukuthi isiphi isihambisi esizenzakalelayo esivela kusiphakamiso.

Funda isiphakamiso kusukela ekuqaleni kuze kube sekupheleni: ikheli elinikeziwe, imaki, isihambisi esizenzakalelayo, i-DNS nesikhathi sokuqashisa. Bese uvumela ukuqashisa ukuba kuvuselelwe. I-relay esebenza kanye bese yehluleka ekuvuseleleni ivamise ukuba nenkinga yobubanzi, yokuqashisa noma yendlela yokubuya eyafihlwa ukushintshana kokuqala.

Engikuhlolayo ngaphambi kokuthi ngithi kulungisiwe

Qala ngeklayenti futhi ubambe ukusakaza, bese uqinisekisa ukuthi i-ASA ikudlulisile ngekheli layo njenge-giaddr. Ohlangothini olukude qinisekisa ukuthi iseva yasibona leso sicelo futhi yakhetha ububanzi obuhambisana negatsha. Emuva egatsheni qinisekisa ukuthi iklayenti lamukele isiphakamiso futhi liyafinyelela esangweni laso.

Uma noma yisiphi isigaba sithule, hlola inqubomgomo noma umzila ohambisanayo esikhundleni sokwengeza esinye isitatimende se-relay. Ukulungiswa kwe-relay kuvamise ukuba sekulungile ngesikhathi othile ekhuphula udaba; okushintshile inqubomgomo yetunnel noma umzila wokubuya.

Bhala izigaba ezintathu kurekhodi yezinguquko: i-interface ebheke iklayenti, inqubomgomo ye-VPN ehlanganisa ithrafikhi ye-relay, nomzila wokubuya weseva oya ku-giaddr. Yilo rekhodi elenza ukwakhiwa kwegatsha elilandelayo kube umsebenzi ophindwayo esikhundleni sesikhathi sokulungisa amaphutha. Likhomba futhi unjiniyela olandelayo ukuthi yikuphi okuphumayo komyalo okufanele kuqoqwe kuqala.