Kungani izicelo ze-TACACS+ ze-ASA zedlula umhubhe we-VPN wegcini lakho

Umhubhe wegcini uyasebenza, abasebenzisi baqinisekisa ku-seva ye-TACACS+ ekude, kodwa ukungena kwe-firewall ngokwayo kusaphela isikhathi. Isizathu akusilo iphutha kumhubhe: umhubhe we-LAN-to-LAN uthwala ithrafikhi ehambisana nabakhethi bawo, futhi ithrafikhi yokuphatha eyakhiwa yi-ASA mayelana nayo iwukugeleza okuhlukile okunekheli lomthombo layo. Amaqembu amaningi akuthola lokhu ngesikhathi sefasitela loshintsho, lapho i-akhawunti yomqondisi eyodwa iyona ehlulekayo. Thatha isikhathi se-AAA esiqalwa yi-ASA njengokugeleza okufanele ukuklame, hhayi njengomphumela oseceleni wokuxhumana osekuvele kusebenza.

I-ASA iyiklayenti ngokwayo, futhi ithrafikhi yayo idinga indlela yayo

Lapho i-firewall ixhumana ne-seva ye-TACACS+, i-firewall iyiklayenti njenganoma yimuphi omunye, ngaphandle kokuthi akekho owayemisa umzila wayo ngamabomu. Amaphakethe ayo avela ekhelini le-interface kudivayisi, ayakhiwa endaweni kunokuba adluliselwe, futhi kufanele ahanjiswe, ahunyushwe futhi avikelwe ngomgomo njengethrafikhi yabasebenzisi. Umhubhe wendawo-kuya-endaweni ovikela i-subnet yabasebenzisi awuvikeli lowo mthombo wokuphatha ngokuzenzakalela, ngoba ukukhethwa kwethrafikhi kusekelwe kumakheli hhayi enjongweni.

Bhala ikheli ohlose ukuthi iseva izolibona. Uma ungakwazi ukulisho ngochungechunge olulodwa, awunayo indlela yokuklama.

I-interface emgqeni we-aaa-server akuwona umhlobiso

Ku-ASA, umbhali womsingathi aaa-server uthatha ukuxhumana kwe-interface kubakaki, futhi incwadi yemiyalo yomsingathi we-AAA ye-Cisco iyichaza njenge-interface lapho iseva yokuqinisekisa ikhona. Yikho ukuxhumana okubopha isicelo ku-interface nakuwo umgomo osetjenziswa yileyo interface. Ukukhetha ngayo noma iyiphi i-interface ebheke ku-inthanethi, noma ukushiya okwasala kusukela ekufudukeni kokugcina, kukhiqiza ikheli lomthombo i-seva ekude nomhubhe okungakaze kwakhiwe kulo.

inside iyimpendulo efanele kuphela lapho i-interface eshiwo iphethe ikheli ohlose ukulisebenzisa njengomthombo. Kudivayisi yegcini lokhu kuvame ukuba njalo; kudivayisi enezigaba eziningi zangasese kungenzeka kungenjalo.

Ukushintsha ukuxhumana kusho ukwakha kabusha umbhali

Le ncwadi yemiyalo efanayo ibhala umkhawulo wokuhlela obamba abantu ngesikhathi sokushintsha: ukushintsha i-interface kumsingathi okhona kudinga ukususa nokwakha kabusha umbhali womsingathi. Ukulungiselelwa okubonakala kuhleliwe kungenzeka kungazange kusebenze, futhi umzamo wokungena olandelayo usazophuma ekhelini elidala. Hlela lokho njengokususa-nokwengeza unekhophi yombhali wokuqala phambi kwakho, hhayi njengokulungisa endaweni.

Uma kuneziseva eziningi ezichaziwe, shintsha eyodwa futhi uyihlole ngaphambi kokuthinta ezinye, ukuze iphutha lingavali yonke imigwaqo yokuphatha ngesikhathi esisodwa.

Hlola abakhethi, ukuhunyushwa nendlela yokubuyela ndawonye

Izinto ezintathu kufanele zivumelane ukuze isicelo sifike. Abakhethi bethrafikhi bomhubhe, noma ukuvikelwa kwe-interface yomhubhe uma uyisebenzisa, kufanele bahlanganise umthombo we-ASA ngokwayo nekheli leseva; uhlu lwabakhethi olwakhelwe ama-subnet abasebenzisi ngokuvamile ngeke lukwenze lokho. Noma yimuphi umthetho we-NAT osendleleni kufanele uhunyushe lowo mthombo ngokungaguquki, ngoba iseva igunyaza ubunikazi bedivayisi yenethiwekhi obandakanya ikheli elilutholayo. Futhi indlela yokubuyela kufanele ibekhona, okusho ukuthi kumhubhe osekelwe kumgomo ukuthi uhlangothi olukude lunomkhethi ohambisanayo ohlangothini oluphambene.

Ngakwesokudla kweseva, qinisekisa ngokwehlukana ubunikazi bedivayisi, imfihlo eyabiwe kanye nomgomo wokuphatha. I-TACACS+ igcina ukuqinisekisa, ukugunyaza nokubalwa njengemisebenzi eyehlukene, ngakho ukwenqaba okufika ngemva kokushintshana okuqediwe kuyimpendulo yomgomo, hhayi ukwehluleka kokuthutha. Ukukufunda njengenkinga yenethiwekhi kukuthumela ukufuna endaweni engafanele.

Gcina imfihlo ngaphandle kokubanjwa kwamaphakethe, amathikithi nemibhalo ngesikhathi uxazulula iphutha, futhi khumbula ukuthi ikheli lomthombo elibhalwa yiseva yilona okufanele ukuklama kwakho kukuchaze.

Yenza ushintsho ngaphandle kokuzivalela ngaphandle

Sebenzisa ikhonsoli noma indledlana yokuphatha ezimele ngesikhathi ushintsha ukuqinisekisa kokuphatha okukude, futhi gcina indlela yokubuyela yasekhaya egunyaziwe kuze kube yilapho indlela entsha isithwele ukungena kwangempela. Bese uqinisekisa ngobubanzi obuncane: iseva eyodwa, idivayisi eyodwa, ukuqinisekisa okukodwa okuphumelelayo nekheli lomthombo elibonwe kuzo zombili izinhlangothi.

Bhala ukugeleza ekhasini lako: i-interface nekheli lokuqala, iseva ekude, indlela evikelwe kanye nomuntu ongumnikazi womgomo wokugunyaza. Khona-ke ushintsho lwe-interface noma lomhubhe olulandelayo lungahlolwa ngaphandle kokucabanga ukuthi yikuphi kokugeleza okubili okuthintekayo.