ASA hairpin: ukuphuma ku-inthanethi noma umlenze we-VPN phakathi kwezindawo?

Iqembu lamaklayenti lingaphuma liye ku-inthanethi noma lingene ku-VPN yendawo. Nquma ukuthi yimuphi umlenze owudingayo ngaphambi kokubhala i-NAT, bese uhlola umzila, isikhethi nomzila wempendulo.

Abasebenzisi ababili bokufinyelela kude ngemuva kwe-ASA eyodwa bangathumela ithrafikhi ngaphandle kwesixhumi sangaphandle esisodwa futhi bathole ukuphathwa okuhluke ngokuphelele. Omunye uya kuwebhusayithi yomphakathi, ngakho iphakethe lidinga ukuhunyushwa komthombo nomzila we-inthanethi. Omunye uya kuseva engemuva komhubhe waphakathi kwezindawo ogcina ngokufanayo kuleso sixhumi, ngakho iphakethe lidinga ubunikazi, isikhethi somhubhe esifanayo nomzila wokubuya oya eqenjini lamaklayenti. Imvume yesixhumi esifanayo iyisimo esidingekayo kukho kokubili futhi ayisona isixazululo kunoma yikuphi.

Imilenze emibili, isixhumi esisodwa

Nquma ukuthi yimuphi umlenze owakhayo ngaphambi kokuthayipha umthetho we-NAT, ngoba imithetho ayishintshani. Umlenze A usuka kuklayenti uya ku-inthanethi: ikheli leqembu liyangena, ikheli lomphakathi elihunyushiwe liyaphuma, libuya ngesixhumi esifanayo. Umlenze B usuka kuklayenti uya kwisimaphambili esiyimfihlo ngaphesheya komunye umlingani we-IPsec: ikheli leqembu liyagcinwa, libhalwa kabusha ngokufihla futhi lilethwa kumlingani okufanele azi ukuthi uphendula kanjani iqembu.

Okudingwa yikho kokubili kuqala imvume yesixhumi esifanayo. Ngaphandle kwayo i-ASA iyala ukudlulisa iphakethe ngaphandle kwesixhumi eza ngaso, futhi ukwehluleka kubonakala njengenkinga yomzila hhayi yenqubomgomo:

same-security-traffic permit intra-interface

Lowo mugqa owodwa uvumela ukuhlelwa kokudlulisa, njengoba isithenjwa se-NAT se-ASA sichaza emizileni yesixhumi esifanayo. Awunezi umzila weklayenti, awugunyazi isisetshenziswa, awuhumushi ikheli futhi awuxoxisani ngesikhethi se-IPsec, ngakho lindela ukwengeza ezinye izinto ezintathu noma ezine ngemuva kwayo futhi ungafundi ukwamukelwa kwayo njengenqubekela phambili.

Umlenze A: iklayenti lifuna i-inthanethi

Ukuze kuphume ku-inthanethi ikheli leqembu kufanele liyeke ukuba yimfihlo ngaphambi kokuba iphakethe lishiye idivayisi. Ekwakhiweni kwe-PAT okuvamile umthetho uhumusha iqembu libe yikheli lesixhumi sangaphandle, futhi isimo sokubuya sibuyisela ukugeleza okuya kuklayenti:

object network VPN_POOL
 subnet 10.80.0.0 255.255.255.0
nat (outside,outside) after-auto source dynamic VPN_POOL interface route-lookup

Bese uqinisekisa ukuthi iklayenti licelile ngempela ku-ASA ukuthi ithwale leyo thrafikhi. Ukukhishwa komhubhe ohlukanisiwe kuthumela indawo yomphakathi ngoxhumano lwefoni ngokwalo, olungafinyeleli ku-ASA nhlobo, futhi awukho umthetho we-NAT olungisa iphakethe elingakaze lithunyelwe. Qhathanisa uhlu lomhubhe ohlukanisiwe lwenqubomgomo yeqembu nendawo oyihlolayo.

Ingxenye esele yomlenze ijwayelekile: umzila ozenzakalelayo noma othile osebenzisekayo ophuma kwisixhumi sangaphandle, inqubomgomo yokufinyelela evumela ukugeleza, ne-DNS ephathwa ngokwenqubomgomo yesixazululi oyikhethile. Engeza route-lookup lapha ngesizathu esifanayo ngezansi, ngoba isixhumi sokungena nesokuphuma siyafana.

Umlenze B: iklayenti lifuna indawo eyimfihlo

Lo mlenze wehluleka ezindaweni eziningi, ngakho wubhale ngokulandelana. Okokuqala umzila weklayenti: isimaphambili sendawo kufanele sibe kuhlu lomhubhe ohlukanisiwe, kungenjalo iklayenti ngeke likufake emhubheni. Okwesibili isikhethi somhubhe: i-ACL yokufihla phakathi kwezindawo kufanele ihlanganise ikheli leqembu kuya kwisimaphambili esikude, hhayi kuphela i-LAN yasendaweni kuya kwisimaphambili esikude. Okwesithathu ubunikazi, ukuze ikheli leqembu lingahunyushelwa ku-PAT ye-inthanethi endleleni.

nat (outside,outside) source static VPN_POOL VPN_POOL
    destination static SITE_PREFIX SITE_PREFIX route-lookup

Uhlangothi olukude yingxenye abantu abakhohlwa ukuyihlola. Umlingani udinga umzila wokubuya oya eqenjini nesikhethi esikufaka, futhi inqubomgomo yakhe kufanele ivumele amakheli omthombo ezowabona. Uma indawo isetshenziswa ngombono ohunyushiwe esikhundleni salokho, lokho kuwukwakheka okuvumelekile, kodwa lapho kufanele abalingani ababili, izikhethi ezimbili namathebula omzila amabili avumelane ngamakheli ahunyushiwe.

Hlola nokulandelana kwemithetho. Umthetho we-PAT obanzi ongaphezulu komthetho wobunikazi uzohumusha ukushintshana okuyimfihlo ngaphambi kokuba umthetho wobunikazi uhlolwe, futhi uphawu umhubhe wendawo ongenayo i-SA efanayo hhayi iphutha le-NAT.

Isivivinyo esikutshela ukuthi wakha wuphi umlenze

Sebenzisa ukuhlolwa komzila kwe-ASA ngokwayo esikhundleni sokufunda ukulungiselelwa nokwethemba. packet-tracer input outside tcp 10.80.0.25 40000 203.0.113.10 443 detailed kubonisa isinqumo se-NAT, umzila nomphumela we-ACL wokugeleza okukodwa; kuphinde ngendawo eyimfihlo. Uma isigaba se-NAT sibhala kabusha ukugeleza okusuka kwimfihlo kuya kwimfihlo, wakhe umlenze A wephakethe elalidinga umlenze B.

Eminye imiyalo emibili ivala igebe. show nat detail iphrinta ukulandelana kwemithetho okwalandelwa yi-packet-tracer, futhi show crypto ipsec sa kubonisa ukuthi isikhethi sikhona yini kubhangqa olilindele. I-SA engekho iyindaba yokulungiselelwa kwesikhethi noma yomlingani, hhayi into umthetho we-NAT ongayilungisa.

Qinisekisa umlenze ngamunye ngethrafikhi ewusebenzelayo

Yamukela umlenze A ngesicelo esijwayelekile somphakathi esivela kuklayenti, futhi wamukele umlenze B ngesicelo esiya kusisetshenziswa esiyimfihlo esikhona ngempela. Bese uphinda ngamunye ngesisetshenziswa esenqatshiwe, ngoba “kuvunyelwe” nokuthi “kuqinisekiswe inqubomgomo yokufinyelela” akubona ubufakazi obufanayo, futhi i-ping eqala enkabeni ayizivivinyi zombili izindlela zeklayenti.

Gcina amarekhodi amabili okuhlola ehlukene kuthikithi: ikheli lomthombo, indawo, umthetho we-NAT oqondile nomphumela. Uma umbiko olandelayo uthi “i-VPN iphukile”, labo bhangqa bazokutshela ngaphakathi komzuzu ukuthi wuphi umlenze ohlehlile, futhi impendulo ivamise ukuba umzila noma isikhethi, hhayi umugqa wesixhumi esifanayo wonke umuntu asola kuqala.

Izihloko ezihlobene