ASA VPN hairpin: ukuhambisa imigudu emibili ngesixhumanisi esisodwa

Ithrafikhi yomsebenzisi okude ingaphuma ngesixhumanisi esifanayo se-ASA eyangena ngaso, kodwa imvume ye-hairpin, ububanzi bomgudu, i-NAT nama-ACL ziyizinqumo ezine ezihlukene.

Umsebenzisi okude uxhuma ku-ASA, ucela i-host engemuva kwegatsha, futhi i-ASA ithumela leso sicelo ngaphandle ngesixhumanisi esisodwa esangena ngaso umsebenzisi. Akukho kulokho okudinga imbobo yesibili yomzimba. Okudingayo yizinqumo ezine ezizimele abantu abajwayele ukuzihlanganisa zibe kunye: imvume yokwenza i-hairpin, umgudu ovikela amakheli afanele, inqubomgomo ye-NAT egcina umthombo okuwuthembisile, kanye nenqubomgomo yokufinyelela egunyaza insizakalo.

Iphakethe elilodwa, imigudu emibili

Landela ukugeleza futhi ukulandelana kwemisebenzi kuyeke ukuba yimfihlakalo. Iphakethe lifika ngaphakathi komgudu wokufinyelela okude, lihunyushwa futhi libe iphakethe le-IP elivamile elinomthombo ovela eqenjini lamaklayenti. I-ASA bese iyihambisa, iyiqhathanisa ne-crypto ACL yendawo-kuya-endaweni, iphinde iyibethe ngomshoshaphansi futhi iyithumele ngaphandle ngesixhumanisi sangaphandle ibheke egatsheni.

Amakheli angezansi ayizibonelo, kodwa ukuma kubalulekile: umthombo iqembu, hhayi i-LAN yangaphakathi ye-ASA.

remote client 10.77.0.20
  -> remote-access tunnel, terminated on ASA outside
  -> decrypted, routed, matched against site-to-site policy
  -> site-to-site tunnel, sent from ASA outside
  -> branch host 10.60.20.10

Kulandela izinto ezimbili. Iklayenti lidinga umzila wokuthi isiqalo segatsha sidlule kuxhumano lwayo lokufinyelela okude, okusho ukuthi i-split-tunnel noma uhlu lwemizila oluthunyelwe kufanele ilufake. Futhi igatsha kufanele lazi ukuthi libuyisela kanjani ithrafikhi ku-10.77.0.20 noma ekhelini elishintshwe wumklamo wakho we-NAT.

Imvume ye-hairpin iwusemhlabeni wonke

Umyalo abantu abawufinyelelayo ngu-same-security-traffic permit intra-interface. Ivumela ithrafikhi ukuthi ingene futhi iphume ngesixhumanisi esifanayo, okuyikho kanye okudingwa yilo mzila. Futhi iyisilungiselelo somhlaba wonke: ukuyivula kushintsha ukuziphatha kweminye imifudlana edlula kabili kwisixhumanisi esifanayo.

Yingakho ifanele ukuba kurekhodi loshintsho hhayi kuseshini yokulungisa amaphutha. Buza ukuthi yini enye kudivayisi manje engathatha umzila wesixhumanisi esifanayo, nokuthi ngabe kukhona yini okufanele kukwenze lokho. Emkhawulweni omatasa onamanethiwekhi ezivakashi noma imigudu yozakwethu egqagqene, impendulo ayiyona ngokuzenzakalela. Bhala isizathu eceleni kwesilungiselelo, ngoba unjiniyela olandelayo uzothola umyalo hhayi ingxoxo.

Ububanzi bokuvikela ne-NAT kwehlukene

Umgudu wendawo-kuya-endaweni uvika noma yini ekhethwa yi-crypto ACL yawo. Uma leyo ACL isho i-subnet yangaphakathi ye-ASA njengomthombo, iqembu lokufinyelela okude alivikelwe futhi iphakethe lizolahlwa noma lithunyelwe ngokukhululekile, kuye ngokuziphatha kwepulatifomu kuthrafikhi engahambisani. Engeza iqembu kumfudlana ovikelwe uma umklamo ugcina amakheli eqembu.

I-NAT bese inquma ukuthi ikheli leqembu liyasinda yini. I-Identity NAT iyaligcina, futhi igatsha libona u-10.77.0.20 njengomthombo. Ukuhumusha kushintsha isivumelwano: igatsha manje libuyisela ithrafikhi ekhelini elihunyushiwe, futhi inqubomgomo yalo uqobo kufanele ikwamukele. Ukulandelana kwemithetho kunquma ukuthi i-crypto ACL ihambisana ngaphambi noma ngemuva kokuhumusha, ngakho funda umfudlana osebenzayo esikhundleni sokucabanga ukuthi yimuphi onqobayo.

Ungasusi imithetho ejwayelekile ye-PAT ye-inthanethi ukuze kusebenze icala elilodwa lokudlula. Ukukhululwa okuqondiwe noma umthetho we-identity wamabomu kulula ukuwuchaza nokuwuhlehlisa kunembobo enqubomgopweni yokuphuma.

Ukubethela akusona isigunyazo

Umgudu osebenzayo ufakaza kuphela ukuthi izinhlangothi ezimbili ziyavumelana ngokhiye nangabakhethi. Awusho lutho mayelana nokuthi lo msebenzisi angafinyelela yini kuleyo nsizakalo. Isihlungi se-VPN noma inqubomgomo yeqembu exhunywe kuxhumano lokufinyelela okude kusamele ivume indawo nomgudu wegatsha, futhi i-ACL yesixhumanisi emzileni wangaphandle isasebenza.

Hlola impendulo kuzo zombili izinhlangothi. Uxhumano oluphumelelayo ngesikhathi insizakalo engumakhelwane kufanele yehluleka lunikeza ulwazi oluningi kune-ping eyodwa ephumelelayo, ngoba lukhombisa ukuthi inqubomgomo ikhetha hhayi ukuvuleka kabanzi. Uma ukuhlolwa okufanele kunqatshwe kuphumelela, akusona umgudu oyisici; inqubomgomo yiyo. Gcina imiphumela yomibili kurekhodi loshintsho ukuze umuntu olandelayo azi ukuthi yikuphi ukuziphatha okwakuhlosiwe.

I-hairpin noma isixhumanisi sesibili

Ukudlula kwe-hairpin kugcina umklamo umncane futhi kubiza isilungiselelo esisodwa somhlaba wonke. Isixhumanisi esihlukile, noma umgudu osuselwe emizileni onesixhumanisi saso sobuzengqondo, sihlukanisa umzila wokudlula futhi sikunikeza inqubomgomo yesisxhumanisi ngasinye, ngenani lokukhetha amakheli nomunye i-crypto map noma iphrofayela. Akukho okulungile ngokwengeziwe; zehluleka ngendlela ehlukile.

Imiklamo esuselwe emizileni iwukuhlelwa okuhlukile, hhayi ibhokisi lokumaka kusilungiselelo esifanayo. Uma ufudukela kwenye, ingxoxo engenhla nge-crypto ACL esuselwe kunqubomgomo iyeka ukusebenza futhi ithebula lemizila liqala ukwenza umsebenzi wokukhetha.

Qinisekisa kusukela kuklayenti langempela

Ukuhlolwa okuqalwa kusukela ku-ASA kunekheli lomthombo elihlukile futhi ngeke ludlule umzila osuka eqenjini uya egatsheni. Sebenzisa packet-tracer ukuhlola isihlanu-somuntu, bese uvula uxhumano lwangempela kusukela kuklayenti langempela elikude, ngoba umlandeli wenza ukulingisa futhi akathathi indawo yokuhambisa umzila nenqubomgomo yeklayenti uqobo.

Ngemva koshintsho oluhleliwe, xhuma ensizakalweni okufanele isebenze, bese kuleyo okufanele inqatshwe, bese uqinisekisa umzila wokubuya wegatsha. izibonelo ze-Cisco ze-NAT hairpin ye-VPN zigcina imvume ye-intra-interface, i-NAT nama-ACL kuhlukene ngokubonakalayo, futhi lowo umfanekiso wengqondo ofanele ukopishwe.

Izihloko ezihlobene