ASA: iphothi le-VPN ne-PAT eqinile ye-DMZ ku-IP eyodwa yomphakathi
Ikheli elilodwa lomphakathi, izinsizakalo ezimbili. Bhala uhlu lwekheli, ukuthutha kanye nephothi lomsizakalo we-VPN ne-PAT ye-DMZ ngaphambi kokuba elinye lithathe ingeno yelinye.
Izinsizakalo ezimbili, ikheli elilodwa lomphakathi, negama le-DNS elibonakala sengathi ligcina iphothi. Alikwenzi lokho. Ngaphambi kokushicilela iseva ye-DMZ eceleni kwengeno ye-VPN ku-ASA, bhala ama-tuple engeno bese uwahlola ngokulandelana; inkambu yokuqala ehambisana nensizakalo ekhona yindawo lapho uhlelo luma khona. Konke okungezansi kucabanga ukuthi i-VPN iphelela kudivayisi ngokwayo, hhayi kuseva yangaphakathi.
Bhala izinkambu ezinhlanu ngaphambi kokubhala umyalo
Kuyo yonke ingeno yomphakathi, rekhoda umndeni wekheli, ikheli lomphakathi, ukuthutha, iphothi lomphakathi kanye nomnikazi. Umnikazi kungaba insizakalo yasendaweni ye-ASA noma iseva yangaphakathi ehumushiwe. Izingeno ezimbili zingabelana ngekheli futhi zibe ama-tuple ahlukene, futhi izingeno ezimbili zingabonakala zihlukile kumdwebo kuyilapho zishayisana kudivayisi.
Gcina ikholomu yesibili yephothi langempela, lelo iseva yangaphakathi elilalela kulo ngempela. Iphothi lomphakathi nephothi langempela yizinqumo ezizimele, futhi ngesikhathi uwahlanganisa kukholomu eyodwa ulahlekelwa amandla okufunda ukuhumusha kwakho kamuva.
| Public entry | Owner | Real side |
|---|---|---|
| TCP 443 on the outside address | ASA VPN listener | Appliance-local, no translation |
| TCP 8443 on the outside address | Static PAT | DMZ server TCP 443 |
| UDP 443 on the outside address | Check the effective listeners | Possibly the VPN data path |
Funda izimo zangempela nezibonisiwe ngendlela efanele
Qala ku-tuple onawo kakade, hhayi kuseva ofuna ukuyengeza. Ukwehlukaniswa okuyisibonelo kugcina ingeno ye-VPN egunyaziwe ku-TCP 443 yomphakathi futhi kushicilele iseva ye-DMZ HTTPS ku-TCP 8443 yomphakathi ngenkathi leyo seva iqhubeka ilalela ku-443:
Public TCP 443 -> ASA VPN listener
Public TCP 8443 -> DMZ server TCP 443Kumyalo osetwe, insizakalo yangempela nensizakalo ebonisiwe zimi ezindaweni eziqinile, futhi ukuziphendukela kuchaza okunye ukubonisa, hhayi okuphukile. Le yindlela evame kakhulu yokuthi ukuhumusha okusebenzayo kuphenduke indida: ukulungiselelwa kuvumelekile, kukhomba nje kwenye indawo.
Umhlahlandlela we-NAT ye-ASA 9.16 wakwa-Cisco ubhala i-PAT eqinile, ukusetshenziswa kwekheli lesikhombisi kanye nezincazelo zephothi langempela uma liqhathaniswa nelibonisiwe. Funda isigaba sohlelo olusebenzayo ngempela; umyalo okhunjulwa epulatifomu endala awukona ukulungiselelwa kwamanje okuphelele.
Bala ukuthutha njengengxenye yokubhuka
I-TCP 443 ne-UDP 443 ama-tuple ahlukene, futhi lowo mehluko awukuniki i-UDP mahhala. I-VPN ingaba nezilaleli ezihlukene ze-TLS ne-DTLS, futhi ezinye izinsizakalo ezilungiselelwe zingase zivele ziphethe ukuthutha okufunayo. Bhala uhlu lwezilaleli ezisebenzayo nenqubomgomo yokufinyelela esikhundleni sokucabanga ukuthi ikhasi lewebhu liyona yonke ingeno ye-VPN.
Igama lesibili lomsingathi elixazulula kukheli elifanayo nalo alixazululi ukungqubuzana kwezinga lokuthutha. I-DNS ukubonisa igama ekhelini, hhayi umxhumanisi wamaphothi, futhi ukushicilela iseva nge-PAT akusona isenzo esifanayo nokuhambisa isilaleli se-VPN kwelinye iphothi.
Uma ingeno ye-VPN kufanele ngempela ihambile, izinto ezine zishintsha ndawonye: iphrofayili yeklayenti, i-URL yomphakathi, ukuhlunga kwaphezulu kanye nakho konke ukuthutha okusetshenziswa ukusetshenziswa. Kuzenze kuwindi elilodwa hhayi ngakunye. Gcina indlela ehlukile yokuphatha eya kudivayisi ivulekile ngaphambi kokuthinta insizakalo oyisebenzisayo ukuyifinyelela. Ngaphandle kwendlela yesibili, ukuhambisa ukushintsha ongakwazi ukukuhoxisa ngaphandle.
Qinisekisa ngaphandle ngezixhumanisi ezintsha
Vumela kuphela uhlelo lwe-DMZ oluhlosiwe ngaphansi kwenqubomgomo yokufinyelela esebenzayo, bese uhlola ukulandelana kokuhumusha okuhambisanayo, indlela yokubuyela yeserva kanye negama lomsingathi kusitifiketi. I-PAT ishintsha indawo yenyambithi yenethiwekhi; ayiniki ukufinyelela kuhlelo futhi ayilungisi isitifiketi esiveza omunye umsingathi.
Hlola zombili izinsizakalo ngezixhumanisi ezintsha ezivela kumsingathi wangaphandle ogunyaziwe: i-VPN kufanele isakheke, futhi isicelo se-DMZ kufanele sifinyelele isilaleli esihloselwe sona. Isikhathi esikhona sesivele sisekile singagcina isimo sangaphambilini, ngakho asifakazi lutho mayelana nokubonisa okushintshile ngomzuzu odlule.
Vala umjikelezo ngokubuyekeza uhlu lwengeno ngalokho okusethile, kuhlanganise nanoma yisiphi isilaleli ositholile hhayi osidalile. Umuntu olandelayo ozoshitshila insizakalo kulelo kheli uzoqala kuthebula lakho, futhi umugqa ongafanele lapho ubiza kakhulu kunomyalo ongafanele lapha.