Amaklayenti e-VPN ku-ASA athola amakheli kusuka echibini le-DHCP elingalungile

Funda i-dhcp-server ne-dhcp-network-scope ku-ASA njengezinkambu ezimbili ezihlukene, setha i-scope ekhelini elingahanjiswa ngaphandle kwechibi, bese uqinisekisa umzila.

Amaklayenti e-AnyConnect avela kunethiwekhi engaphansi engalungile, noma isiphakeli se-DHCP senqaba ukunikeza noma yini, kuyilapho inqubomgomo yeqembu ibonakala ilungile ekuqaleni. Ku-ASA kunezinkambu ezimbili ezindaweni ezimbili ezizwakala zombili njenge «amakheli avelaphi», futhi ukusetha okungalungile kuveza lokhu ngqo. Iphrofayela yokuxhumana isho isiphakeli se-DHCP; inqubomgomo yeqembu isho inethiwekhi engaphansi okufanele isiphakeli siyikhethe. Azikho kuzo zombili ezakha ichibi.

Izinto ezintathu, imibuzo emithathu

Qala ngokuhlukanisa imodeli yokwaba kusuka echibini, ngoba izimodeli ezimbili azabelani ngokucushwa. Uma i-ASA isabalalisa amakheli ngokwayo, uchaza ichibi lendawo futhi uqondise inqubomgomo yeqembu kulo. Uma isiphakeli se-DHCP sangaphandle sibasabalalisa, iphrofayela yokuxhumana isho leso siphakeli futhi inqubomgomo yeqembu inikeza inkomba ye-scope. Ukuhlanganisa kokubili yisizathu esivamile sokuthi ikheli lingaveli neze.

IntentObjects involved
ASA allocates from its own poolip local pool plus the group policy's address-pool
External DHCP allocatesdhcp-server on the tunnel group, dhcp-network-scope on the group policy

Funda amanani asebenzayo ngaphambi kokushintsha elilodwa

Umugqa oshiyiwe awufani ne-none ecacile. Ukucushwa okusebenzayo kubonisa lokho okukubhalile; show run all group-policy kubonisa ukuthi inqubomgomo iphelela kukho ngempela, kuhlanganise namanani okuzenzakalelayo atholakale njengefa. Hlola kokubili ngaphambi kokunquma ukuthi i-scope ayilungile, ngoba inqubomgomo yeqembu edla ifa kunqubomgomo yokuzenzakalela inganikeza inani elingaveli neze ohlwini olufushane.

show running-config group-policy RemoteStaff
show run all group-policy RemoteStaff
show running-config tunnel-group RemoteStaff
group-policy RemoteStaff attributes
 dhcp-network-scope ?

? umphumela kufanele ufundwe kusurungo lakho elifakiwe, ngoba amanani amukelwayo nombhalo wawo wosizo kuyahluka phakathi kwezinguqulo. Ireferensi ye-Cisco ASA 9.24 ye-nqubomgomo yeqembu ichaza isibaluli njengekheli elingahanjiswa kunethiwekhi engaphansi efiswayo, ngaphandle kwechibi lokwaba, kukhethwa ikheli lesixhumi. Akusilo ibanga lechibi futhi akusilo inombolo yenethiwekhi.

Setha i-scope ekhelini, hhayi ebangeni

Ake sithi ichibi ofuna isiphakeli sisisebenzise ukusuka ku-10.50.30.50 kuya ku-10.50.30.200 ku-/24, futhi isixhumi se-ASA kuleyo ngxenye siyi-10.50.30.1. Inani le-scope liyi-10.50.30.1. Ukubhala i-10.50.30.0 kuyahluleka ngoba iyinombolo yenethiwekhi, futhi ukubhala ibanga nakho kuyahluleka ngoba isibaluli sithatha ikheli elilodwa. Uma ikheli olikhethile kuyikheli lesixhumi, lidinga umzila oqinile ukuze impendulo yesiphakeli se-DHCP ifinyelele kulo.

group-policy RemoteStaff attributes
 dhcp-network-scope 10.50.30.1

Lesi siqephu senza into eyodwa kuphela. Asilungiseleli isiphakeli se-DHCP, asakhi chibi lapho, futhi asenzi iphrofayela yokufinyelela kude engaphelele ibe esebenzayo. Ukuziphatha okubhalwe lapha yi-IPv4 kuphela; ungakholwa ukuthi izolawula i-DHCPv6 noma ukwabiwa kwesandulela.

Shintsha ngophuzu lokubuyisela

Thatha i-snapshot kuqala, ukuze ukubuyisela kube umyalo hhayi ukwakhiwa kabusha. Gcina ukucushwa okuhlobene efayeleni ngaphambi kokuhlela, futhi wazi ukuthi no kubuyisela ini kusurungo lakho: kubuyisela isibaluli enanini lokuzenzakalela noma elatholakale njengefa, okungase kube none esikhundleni senqubomgomo engaphezulu kwayo.

copy running-config flash:pre-dhcp-scope.cfg
conf t
 group-policy RemoteStaff attributes
  no dhcp-network-scope
  dhcp-network-scope 10.50.30.1
 end
write memory

Ukususa isibaluli nakho kuyisinyathelo sokuxilonga. Uma i-scope ingachaziwe, isiphakeli se-DHCP sifuna emachibini aso ikheli elingakabiwe, ngakho iklayenti lingase liwele endaweni engalindelekile kodwa okungenani liyaxhuma. Lowo mphumela utshela ukuthi indlela yesicelo iyasebenza nokuthi okwehlulayo ukukhethwa kwechibi.

Qinisekisa ikheli, umzila nezimvume

Funda ukwabiwa kuthebula lezikhathi hhayi kwingxoxo yeklayenti, bese uqinisekisa ukuthi ikheli lingahanjiswa libuyela emhubheni nokuthi izihlungi zenqubomgomo yeqembu zivumela ithrafikhi oyilindele. Isinqumo sokwaba akusona isinqumo sokuhambisa, futhi iklayenti elithola ikheli echibini elifanele lingase lihluleke kuso sonke isicelo.

show vpn-sessiondb detail anyconnect filter name testuser
show ip local pool
show route | include 10.50.30
ping 10.50.30.61 source inside

Uma isikhathi sibonisa ikheli obukade ulifuna kodwa ithrafikhi iyafa, i-scope isiphelile njengomsolwa. Bheka umzila wokubuyela emuva, izilungiselelo ze-split-tunnel noma izihlungi kunqubomgomo yeqembu, nokuthi i-scope ye-DHCP isengxenyeni i-ASA eyihambisa ngempela.

Izihloko ezihlobene