I-failback ku-ASA: yini ehlile iyahamba lapho umzila ubuya
Ukubuya komzila endleleni eyinhloko akusho ukuthi imifudlana endala isihambile. Bheka kanyekanye i-uplink, ithuneli, ithebula lokuxhumana nomphumela wohlelo.
Ku-ASA enama-uplink amabili, i-failback ayilona ukuphambana kwe-failover. Umzila oya ku-peer uyashintsha, bese kuba khona ukuthi ipulatifomu ixhumanise imishini emithathu ehlukene yesimo: ithebula lemizila, izinhlangano zokuphepha ze-IKE ne-IPsec, nethebula lokuxhumana. Ngayinye ingasala ngemuva kwezinye, futhi ukubambezeleka lokho yikho abantu abaningi abakubiza ngokuthi ithuneli elingabuyi.
Ukuthi i-failback ishintsha ini ngempela
Ukusesha umzila ingxenye ebonakalayo. Lapho into egadiwe isilulama, umzila ogadiwe oya ekhelini langaphandle le-peer uyabuya, futhi iphakethe elilandelayo elithunyelwa i-ASA lilandela futhi isixhumanisi esiyinhloko. Konke okulandela lokho kuncike ekutheni isimo esikhona siyavumelana nomzila omusha.
I-ARP ne-NAT yizinto ezithembekile ezithule. I-next hop entsha idinga isango elingaxazululeka nokuhumusha okusavumelana nomkhawulo okude, ngaphandle kwalokho amaphakethe okuqala ngemuva kwe-failback awiyo ndawo futhi umzila ubonakala ulungile kuyilapho kungasebenzi lutho.
Imibono emine emgqeni owodwa wesikhathi
Rekhoda lezo zinto zine ngaphambi, phakathi nangemuva koshintsho, ngoba isithombe esisodwa asikwazi ukukutshela ukuthi yikuphi ungqimba oluhambile.
| View | What to record |
|---|---|
| Uplink and route | Interface state, the tracked object result, the route selected for the outer peer address |
| IKE and IPsec | The live peer, IKE version, security associations, protected-traffic counters |
| Connection table | Interface and endpoint pair for old flows and for flows created after the change |
| Application | One pre-existing operation and one fresh request, each marked success, reset, stall or recovered |
Umzila ongakaze ushintshe nomzila oshintshe ngesikhathi ukuxhumana okudala kugcina isimo sako sokudlulisa kuletha isikhalo esifanayo nobufakazi obuhluke ngokuphelele.
Kungani ukuxhumana okudala kuhlala emzileni wokulondoloza
I-ASA ayiwuqedi umfudlana ngoba umzila ushintshile. Ukuxhumana osekuqediwe kugcina isinqumo sokudlulisa eyakhiwe naso, futhi ipulatifomu inikeza izilawuli ezihlukene zokuthi lokho kuvunyelwe isikhathi esingakanani: i-floating-connection timeout ne-connection holddown. I-umhlahlandlela wezilungiselelo zokuxhumana we-ASA 9.24 ye-Cisco izithatha njengemibuzo ehlukene, futhi yileyo ndlela eziziphatha ngayo. Enye ilawula ukusinda komfudlana okhona; enye ilawula ukuthi imifudlana emisha ingawusebenzisa nini umzila okhethiwe.
Ngaphambi kokushintsha noma yikuphi kwalokhu, funda amanani asebenzayo enguqulo yakho. Ukuwanciphisa kuvala izikhathi abantu abasazisebenzisayo. Ukuwenyusa kwenza i-failback ibonakale sengathi ayenzekanga neze, ngoba ukuxhumana okusha kuqhubeka kuthatha umzila omdala isikhathi sonke.
Ithuneli alivumelani kabusha ngokhiye ngoba umzila ubuyile
Izinhlangano zokuphepha ze-IPsec zithwala impilo yazo evunyelwene futhi zisinda ekushintsheni komzila okuzithwalile. Ngakho ithuneli lingahlala likhona phakathi ne-failback kuyilapho ikheli lalo langaphandle lingasavumelani nomzila osetshenziswayo, futhi lesi yisizathu se-DPD namadizayini abopha ikheli le-peer esikhundleni sokuliyeka lintanta.
Amadizayini e-crypto-map ne-VTI aziphatha ngendlela ehlukile lapha, futhi imibhalo ye-Cisco ye-9.24 VTI ichaza inketho esekelwe emizileni. Isitatimende esidala esijwayelekile sokuthi i-ASA ayikwazi ukugcina ama-VPN asekelwe emizileni asisebenzi ezinguqulweni ezisekelwayo.
Funda ubufakazi ngalolu hlelo
Qala endaweni yokulawula: i-show route yomzila okhethiwe, i-show interface yesimo sesixhumanisi, nezibali ze-SLA monitor zento egadiwe. Bese ufunda i-show crypto ikev2 sa, noma okulingana ne-IKEv1, ukubona ukuthi iyiphi i-peer ephilayo, kulandele i-show crypto ipsec sa yemifudlana evikelwe. Bese unciphisa ithebula lokuxhumana nge-show conn address <host> futhi uqhathanise ikholomu ye-interface kokufakiwe okudala nokusha. Bhala imiphumela namasiginesha esikhathi, ngoba ukulandelana kwayo wukuxilongwa ngokwakho.
Qeda ngokuhlola uhlelo: umfudlana owawukhona kakade nomunye owakhiwa ngemuva kokubuya komzila. Uma umfudlana omdala wehluleka futhi omusha usebenza, unendaba yesimo sokuxhumana. Uma womabili ehluleka, ithuneli noma inqubomgomo ayilungile futhi ithebula lokuxhumana liyiphazamiso.
Gcina lowo mbhalo usesimweni esifanayo kuzo zontathu izigaba futhi ubhale inguqulo eqondile. Uma umgqa wesikhathi uqhubeka ukhomba ekushintsheni okukodwa, thumela umbhalo kosizo esikhundleni sokuqagela i-ID yephutha.