Ukufanisa amaqembu e-LDAP ku-ASA uma kuqhathaniswa ne-DAP yomgomo weqembu le-VPN

Amarekhodi amabili ahlukene anquma ukuthi yimuphi umgomo weqembu owamukelwa yiseshini ye-AnyConnect, futhi ahlala ezingxenyeni ezihlukene zokucushwa anezindlela ezihlukene zokwehluleka. Imephu yezici ze-LDAP ihumusha inani elivela kuhlu lwemibhalo libe isici sogunyazo lwe-ASA ngesikhathi sokuqinisekisa; irekhodi le-DAP lihlola imibandela ngemuva kwalokho futhi lingengeza noma lisho phambili izici. Kokubili kungaphela ngegama elifanayo lomgomo, ngakho ukungena okusebenzayo akukutsheli lutho mayelana nokuthi yiluphi ucwaningo olukukhiqizile. Inhloso yokuqhathanisa ukukhetha ngamabomu eyodwa esikhundleni sokuvumela eyesibili ukuthi yeqe eyokuqala ngokuthula.

Izindlela ezimbili, izindawo ezimbili zokunquma

Ukukhetha kufika emibuzweni emithathu. Ngabe isinqumo sincike enanini elilodwa lesici elivela kuhlu, ingabe idinga okungaphezu kwalelo nani, futhi yiluphi ucwaningo oluvunyelwe ukunqoba lapho kokubili kufana?

Uma okokufaka okuwukuphela kungubulungu beqembu, imephu yezici iyithuluzi elincane futhi elilula ukulihlola: imephu eyodwa, exhunywe kuseva eyodwa ye-AAA, ngomugqa owodwa ngeqembu ngalinye. Uma ukukhetha kufanele kubhekele isimo sedivayisi, ubunikazi bendawo yokugcina, isici sesibili noma iwindi lesikhathi, okokufaka kwemephu kuyaphela futhi i-DAP iyona ndlela ekwazi ukuveza umthetho. Uma kokubili kusetshenziswa, funda ukubaluleka kuqala kunguqulo yakho ngaphambi kokubhala noma yikuphi, ngoba iseshini ehambisana nerekhodi le-DAP ingase ingawugcini umgomo owabuyiswa yimephu. Konke okunye ukubalwa kwezimali.

Indlela yemephu yezici, ngokulandelana kokucushwa

Indlela yemephu iqala encazelweni yeseva ye-AAA. Imephu yezici kufanele ixhunywe kunqubo yeseva ye-LDAP ebesetshenziswa ngempela iphrofayili yokuxhumana; imephu ekhona ekucushweni okusebenzayo kodwa ingabhekiselwa kuyo yileyo seva ayishintshi lutho. Lolo mugqa wokuxhuma yiwo owenza okunye ukucushwa kuphile. Umhlahlandlela wemephu ye-LDAP ye-ASA uyisithenjwa sohlelo lwemephu ezinguqulweni ze-9.x.

Ngaphakathi kwemephu, isitatimende esisodwa sisho isici sohlu kanye nesici se-ASA esikusondelayo, kanti ezinye izitatimende zihumusha amanani athile. map-name memberOf Group-Policy elandelwa map-value memberOf CN=VPN-Support,OU=Groups,DC=corp,DC=example Support-ReadOnly iyisimo: uhlangothi lwesobunxele yilokho okubuyiswe yihlu, uhlangothi lwesokudla igama lomgomo weqembu okufanele ube ukhona kakade. Igama elihlukile negama lokubonisa lomgomo akushintshisani, futhi ukucishe kuhambisane kunoma iyiphi yezintambo ezimbili akukhiqizi iphutha lapho ungena.

Imininingwane emibili iyaluma lapha: memberOf kubuyisela iqembu ngalinye i-akhawunti ekuqembu, ngakho umsebenzisi emaqenjini amabili anamamephu unikeza imephu amanani amabili angaba khona, futhi umthetho wezinhlamvu ezenziwe ngokulandelana encwadini uyiyona ndlela yokuxazulula ukulingana ongayethemba esikhundleni sokulandelana kwakho kokubaluleka. Inani elingenamephu alinikezi lutho, futhi lokho kubuyela ngokuthula kumgomo ozenzakalelayo wephrofayili.

Indlela ye-DAP, nokuthi yini eyengezayo

I-DAP ihlola imibandela futhi isebenzisa izici phezu komphumela we-AAA. Irekhodi liphethe ukubaluleka, isenzo kanye neqoqo lemibandela; amarekhodi ahlolwa ngokulandelana kokubaluleka futhi isenzo sinquma ukuthi ukuhlola kuyaqhubeka noma kuyama. Leyo yimodeli yokwenza ehlukile ekusesheni inani, futhi yikho kanye okwenza ikwazi ukuveza imithetho imephu engakwazi ukuyiveza.

Lokho i-DAP eyengezayo okokufaka. Imibandela ingabhekisela ezicini zohlu, ezicini zendawo yokugcina kanye nesimo sedivayisi, futhi irekhodi elihambisanayo lingaphethe ama-ACL, uhlu lwama-URL noma izihlungi zaleso seshini. Ngakho umthetho ofana nokuthi abasebenzi bosekelo kukhompyutha ephathwayo bathola umgomo wokufunda kuphela kuyilapho labo basebenzi kudivayisi engaphathwanga bethola owomisiwe uyavezwa ku-DAP hhayi emephini yezici. Imephu inokokufaka okuyedwa ngqo: inani elabuyiswa yihlu lesici osishilo.

I-DAP futhi yengeza indawo yesibili yokubheka lapho iseshini iwela kumgomo ongafanele. Irekhodi elihambisana nesenzo sokuqhubeka aliqedi ukuhlola, futhi irekhodi elilandelayo lisengashintsha umphumela, ngakho lokho okukubonayo kuwumphumela wokulandelana hhayi wokusesha okukodwa. Funda izinombolo zokubaluleka ngokulandelana, futhi khumbula ukuthi kungase kube yirekhodi lesipele elenza umsebenzi. Imephu, ngakolunye uhlangothi, ayinakho ukulandelana: isici esisodwa, inani elilodwa, impendulo eyodwa.

Lapho kokubili kungavumelani khona

Ukubaluleka kuyona ingxenye ephula imiklamo. Lapho iseshini ihambisana nakunqubo yemephu nerekhodi le-DAP kokubili, umphumela uncike kunguqulo nakusenzo serekhodi, ngakho kuqinisekisa ku-ASA yakho uwedwa esikhundleni sokucabanga ukuthi enye yezindlela iphethe umphumela.

Izindlela ezintathu zokwehluleka zichaza ingxenye enkulu yokudideka. Imephu echaziwe kodwa engakaze ixhunywe kuthegi yeseva esetshenziswa yiphrofayili inikeza umgomo ozenzakalelayo ngaphandle kwanoma yiliphi iphutha ndawo yonke. Intambo yombandela we-DAP ehluke enanini lohlu ngezinhlamvu ezinkulu noma izikhala ayihambisani nakancane, futhi irekhodi lesipele lisebenza ngokuthula. Futhi umgomo weqembu ongakabi khona wamukelwa yimephu, ngoba imephu ibuyisela igama kuphela, ngakho iseshini ayitholi sikhathi esisodwa sezimvume ezihlosiwe futhi akukho lutho kusichasisekelo esikhomba entweni engekho. Hlola kokuthathu ngaphambi kokuthinta ubulungu beqembu.

Ukufunda ubufakazi kuseshini ephilayo

Funda impendulo kuseshini entsha hhayi ekucushweni. show vpn-sessiondb detail anyconnect filter name jdoe iphrinta umgomo weqembu iseshini eyithola ngempela, futhi show running-config ldap attribute-map iqinisekisa ukuthi yimaphi amanani imephu eyayingase iwabuyisele. Ohlangothini lohlu, test aaa-server authentication LDAP-AD username jdoe password <password> ibonisa izici i-ASA eyazithola zibuyile, futhi debug ldap 255 ibonisa ukushintshana lapho ukuhlolwa kungahambisani nalokho obukulindele.

Bese uhlanganisa amarekhodi amane ngokubhala: inani lohlu, imephu noma isimo se-DAP esicushiwe, umgomo weqembu wendawo kanye nensiza umsebenzisi akwazi ukuyifinyelela ngempela. Uma okuthathu kokuqala kuhambisana nesine singahambisani, inkinga isemzimbeni womgomo hhayi ekukhetheni. Uma iseshini ibonisa igama lomgomo elifanele kodwa i-ACL engafanele, yeka ngokuphelele ukubheka i-LDAP. Shintsha irekhodi elilodwa ngesikhathi futhi uhlole iseshini entsha, ngoba iseshini exhunywe kabusha iwubufakazi kuphela obubonisa ukucushwa osanda kukubhala.