I-ASA identity NAT ngokumelene nokukhishwa kwe-IOS NAT kuthrafikhi ye-VPN

Igatsha lisebenzisa i-PAT ye-inthanethi kanye ne-VPN yesayithi-kuya-sayithi kusango elilodwa le-Cisco, futhi i-VPN iyeka ukusebenza ngaso leso sikhathi lapho i-NAT ingezwa. Amakheli angaphakathi kwethuneli awasahambisani nalokho okugadwa yi-crypto ACL, noma uhlangothi lwangakwesokunye lubona amakheli ahunyushiwe angenayo indlela. I-Cisco ixazulula lokhu ezindaweni ezimbili: i-ASA ikhetha umthetho we-NAT obonisa ikheli kulo ngokwalo, kuyilapho i-IOS igcina ukugeleza ngaphandle komthetho wokuhumusha nge-deny ku-ACL. Zombili zigcina amakheli okuqala, futhi akukho okweqa ukucubungula kwe-NAT.

Bhala phansi ukugeleza ngaphambi kokukhetha umthetho

Qala ngokubhala ukugeleza okulindele ukukuvikela: umthombo we-LAN, indawo ekude kanye nokubhangqa kwamakheli okuqondile okugadwa yinqubomgomo ye-IPsec. Yenza lokhu ngaphambi kokuhlela umthetho, ngoba leli qoqo likhombisa ukuthi yisiphi isihlukanisi noma umthetho we-NAT obekufanele uhambisane.

Bese uthola umthetho ohlangene ngempela, hhayi lowo obuwuhlosile. Kuzo zombili izinkundla i-NAT ihlolwa ngokulandelana, futhi umthetho wangaphambili ungawina ngaphambi kokuthi ukukhishwa kwakho kucatshangelwe. Ukukhishwa okubonakala kulungile kodwa okuhlulwa yomunye umthetho akukaze kunikeze iphakethe elilindelekile kunqubomgomo yokuvikela. Uphawu lufana nokungabikho kokukhishwa, ngakho ukulandelana kwemithetho kufanele kufundwe ngaphambi kokushintsha ukucushwa.

I-ASA identity NAT iwumthetho, hhayi ukuveqa

Ku-ASA, i-identity NAT iwumthetho we-NAT okukheli okuhunyushiwe kwawo kulingana nelokuqala. Ikhethwa njenganoma yimuphi omunye umthetho futhi isafaka ingeno yokuhumusha, ngakho iphakethe alikweqi ukucubungula kwe-NAT. Okushintshayo ukuthi amakheli kunethiwekhi ahlala efanayo, futhi yilokho okudingwa yinqubomgomo ye-IPsec.

nat (inside,outside) source static LAN-NET LAN-NET destination static REMOTE-NET REMOTE-NET

Izixhumanisi zomthetho kanye nesilungiselelo salo se-route-lookup kufanele kuhambisane nomklamo wokudlulisa. Umthetho obonisa ikheli ngendlela efanele kodwa osetshenziswa kubhangqa lezixhumanisi elingalungile awuzukukhethwa ukugeleza kwakho. I-route-lookup inquma ukuthi iphakethe elihunyushiwe lizohanjiswa ngomzila noma kusetshenziswe indawo yokuqala, futhi lokho kunquma ukuthi ithrafikhi ebuyayo izobuya ngethuneli.

Ukufinyelela kokuphatha ku-ASA ngokwayo kuyicala elihlukile. Uma usebenzisa i-identity NAT kuthrafikhi yokuphatha, imfuneko ye-route-lookup encike kunguqulo iyasebenza, futhi ukukhishwa okubanzi okukotshiwe kusibonelo se-VPN ngeke kulungise i-SSH.

I-deny ku-IOS NAT ACL isho ukuthi akukhethiwe lapha

Ku-IOS, i-NAT ye-inthanethi iqhutshwa uhlu lwemithombo, futhi ley ACL iyisihlukanisi, hhayi isihlungi. Umugqa we-permit ukhetha ithrafikhi yokuhumusha; umugqa we-deny usho ukuthi iphakethe alikhethiwe lapha. Leyo deny akuwona umyalo wokulahla iphakethe njengoba kunjalo nge-deny ku-ACL yesixhumanisi.

Ukungakhethwa lapha futhi kuncane kunokungahunyushwa ndawo yonke. Omunye umthetho we-NAT, esinye isixhumanisi noma i-route-map kusengahumusha ukugeleza, ngakho ithebula le-NAT lonke kufanele lifundwe. Iphakethe lisadinga umzila, i-crypto ACL ehambisanayo kanye nemvume emingceleni yangempela yokulawula ukufinyelela.

Ukuhlelwa okuncane kwe-IOS kubeka i-deny phezu kwe-permit ohlwini olufanayo futhi kukhomba umthetho we-overload kulolo hlu. Khona-ke i-crypto ACL ivikela okubhangqa okufanayo nokukhishwa yi-deny ekuhumusheni.

ip access-list extended NAT-ACL
 deny ip 10.10.0.0 0.0.0.255 192.0.2.0 0.0.0.255
 permit ip 10.10.0.0 0.0.0.255 any
ip nat inside source list NAT-ACL interface GigabitEthernet0/1 overload

Umbuzo owodwa olingekayo kuzo zombili izinhlobo

Zombili izinhlobo ziphendula umbuzo ofanayo: imuphi umthetho ohlangene nalokhu kugeleza, futhi yimaphi amakheli aphumile esixhumanisini? Bhala esixhumanisini esingaphandle bese uqhathanisa ikheli lomthombo ngaphambi nangemva kwesango. Bese uhlola umbono wohlangothi lwangakwesokunye ngethuneli, ngoba i-SA ingase imile kuyilapho ukugeleza okuvikelwe kuhunyushwa kwenye indawo.

Ku-ASA khombisa i-nat detail kanye nethebula lokuhumusha; ku-IOS khombisa i-ip nat translations kanye nezibali ze-ACL ezihambisanayo. Umthetho ongakaze ukhule awukaze ukhethwe, futhi lokho kukhomba ukulandelana, isixhumanisi noma isiqondiso hhayi ukucushwa kwe-crypto.

Lapho ukucushwa kuvame ukungahambi kahle

Ukwehluleka okuvamile kungokwemishini. I-deny ingaphansi kwe-permit futhi ayihlangani nakanye. Isihlukanisi sisetshenziswa endaweni engalungile, ngakho ukugeleza okubuyayo kuyahunyushwa. Umthetho we-identity uhlanganisa amakheli alungile kodwa ukubhangqa kwezixhumanisi okungalungile. I-crypto ACL ivikela inethiwekhi encane engasahambisani nalokho okwethulwa umthetho we-NAT.

Bhala phansi ukubhangqa kwamakheli okuqala nokwethuliwe eduze komnikazi womthetho, ukuze unjiniyela olandelayo abone ukuthi kungani isihlukanisi senqaba ukuhumusha kuyilapho umlilo uvumela uhlelo. Gcina lokho kuthikithi yoshintsho, hhayi encwadini yomuntu siqu. Bese ugijima futhi ukugeleza ngemva kwanoma yimuphi ushintsho lwe-NAT, ngoba ukulandelana kwemithetho kuyingxenye yokucushwa ngisho lapho umbhalo womthetho ungashintshile. Ithuneli eliphumayo akubona ubufakazi bokuthi amakheli asindile; iphakethe elibanjwe kanye nombono wohlangothi lwangakwesokunye ngemva kokuvula isembozo kuphela.