I-VPN yendawo-kuya-endawo isuka ku-AWS iya ku-Azure: bhala kuqala indlela yokubuya
Ithumbu elixhunyiwe phakathi kwamafu amabili alifakazi lutho kuze kube yilapho yonke i-subnet yomsebenzi iqondisa endaweni ekude yephrofikhi. Landela uhlelo ngokulandelana, bese uhlola insizakalo.
Ithumbu lizokhuphuka. Imvamisa kwenzeka kanjalo, ngoba i-IKE idinga kuphela iziphakamiso ezihambisanayo nekheli lontanga elifinyeleleka. Okwehlulayo ngemuva kwalokho yindlela yokubuya: umsebenzi we-AWS uthumela amaphakethe ethumbini, kodwa akukho lutho ohlangothini lwe-Azure olwazi ukuthi liphendula kanjani ku-10.10.0.0/16, noma indlela ye-Azure isetafuleni i-subnet yomsebenzi engayisebenzisi. Bhala uhlelo lwemizila ngaphambi kokuthinta noma iyiphi ikhonsoli, futhi ithumbu lizoba ingxenye engathandeki kakhulu yomsebenzi.
Isinyathelo 1: qandisa uhlelo lwamakheli
Sebenza ngamanani aqondile. Umsebenzi we-AWS ukwi-10.10.1.20 ngaphakathi kwe-10.10.0.0/16 futhi udinga i-TCP 443 eya ensizakalweni ye-Azure eku-10.20.1.30 ngaphakathi kwe-10.20.0.0/16. Izikhala ezimbili akumele zidlulane, futhi ukuhlolwa kokwamukela yipheya lensizakalo, hhayi ithumbu.
Bhala lawo maqiniso amane ngaphambi kwanoma yini enye, ngoba isinyathelo ngasinye esilandelayo sihlolwa ngawo.
Isinyathelo 2: shono isango eliphethe umkhawulo ngamunye
I-AWS Site-to-Site VPN ingaphela esangweni langasese elibonakalayo noma esangweni lokudluliswa, futhi labo bangabanikazi bemizila abehlukene. I-Azure inikeza i-VPN Gateway yayo ephethwe kanye, ngokwehlukana, amadivayisi asekelwe ku-VM amakhasimende awaqhubayo ngokwawo. Qopha ukuthi iyiphi ipheya onawe, ngoba ukugxuma okulandelayo kuyahluka kuyo yonke inhlanganisela.
Esangweni eliphethwe, ungakopishi umzila okhomba ekhelini ledivayisi langasese eliqanjiwe. Ngedivayisi, ungacabangi ukuthi ukusabalala kwemizila efwini kulungisa uhlelo lokusebenza lwesivakashi, ngoba akwenzi lokho.
Ukungalungi lapha kukhiqiza uhlelo olubonakala luphelele futhi luthumela amaphakethe ekhelini elingaphenduli neze.
Isinyathelo 3: bhala umzila umsebenzi ngamunye awusebenzisa ngempela
Umgogodla ngamunye ngezansi ukucinga okwihlukile, futhi umzila komunye wabo awuwona umzila wephakethe. Gcwalisa ithebula ngamanani akho ngaphambi kokuba ithumbu liqale ukusebenza.
| Boundary | Must reach | Owner to inspect |
|---|---|---|
| AWS workload subnet | 10.20.0.0/16 | the subnet's VPC route table |
| AWS transit gateway, if used | 10.20.0.0/16 via the VPN attachment | the table associated with that attachment |
| Azure workload subnet | 10.10.0.0/16 | effective routes on the NIC, whatever their source |
| VPN scope | both prefixes, agreed | static connection ranges or BGP advertisements |
Ku-AWS, ithebula lemizila le-subnet yomsebenzi ngeyakho ukuyibuyekeza ngisho nangemva kokuba i-BGP noma ithumbu linempilo; umbono jikelele womzila ukubona lokho njengengxenye yoxhumano. Ku-Azure, ithebula lemizila echazwe umsebenzisi lixhunyaniswa ne-subnet hhayi inethiwekhi ebonakalayo, ngakho hlola umzila osebenzayo ku-NIC yomsebenzi hhayi kubhulokhi le-VNet.
Isango le-Azure eliphethwe lingafunda iphrofikhi ekude ngokusabalala kwesango, futhi i-UDR ingachitha leso sinqumo. Engeza i-UDR uma unesizathu, hhayi ngomkhuba. Uma wengeza, yiqondise ekugxumeni okulandelayo isango elikushicilela endleleni ye-VPN esikhundleni sokuqamba ikheli ledivayisi. Bese ufunda kabusha imizila esebenzayo ku-NIC, ngoba isinqumo senziwa lapho ngempela.
Isinyathelo 4: vumelanisa ububanzi
Nge-BGP, qhathanisa lokho uhlangothi ngalunye olukumenyezelayo nalokho uhlangothi olunye olukufundile ngempela, iphrofikhi ngephrofikhi. Ngomzila ongaguquki, qhathanisa izikhala ezikude ezilungisiwe nemizila yomsebenzi oyibhale esinyathelweni 3.
Ubudlelwano be-IKE okuvumelana ngobuchwepheshe bokubhala akubona ubufakazi bokuthi noma yiluphi uhlangothi lufunde i-10.10.0.0/16 noma i-10.20.0.0/16. Amathumbu amabili angakhuphuka kuyilapho uhlangothi olulodwa lwamemezela i-/24 eyodwa esikhundleni se-/16 obuhlele. Hlola iphrofikhi ethebuleni lemizila, hhayi esimweni sethumbu. Ukungavumelani kuvela kamuva njenge-subnet eyodwa esebenzayo nenye engaphenduli neze.
Isinyathelo 5: hlola insizakalo, kusuka kumthombo wangempela
Vumela ukugeleza okuhlosiwe emaqenjini okuphepha naku-ACL zenethiwekhi ze-AWS, kuma-NSG e-Azure nakusihlungi sanoma yisiphi isaziso endleleni. Bese uvula uxhumano olulodwa kusuka ku-10.10.1.20 ukuya ekhelini elifunyenwe nembobo yensizakalo futhi uqinisekise ukuthi impendulo ibuyela emthonjeni ofanayo.
Womabili amaqembu okuphepha efwini nama-NSG anesimo, ngakho iphakethe lokubuya elinqatshiwe wuphawu lomzila, hhayi umthetho okhohliwe ukuwubhala ngokuhlanekezile.
I-ping evela kunoma yisiphi isango ayinqumi lutho. I-ICMP ekhelini lesango izilolonga indlela yendiza yokulawula, hhayi insizakalo ye-TCP edlulisiwe umsebenzi ayidingayo.
Ukubuyisela emuva namarekhodi
Qopha abanikazi bemizila eduze kwezikhombisi zethumbu, futhi gcina amathebula emizila angaphambi koshintsho. Uma ushintsho kufanele lukhishwe, susa imizila yomsebenzi ngaphambi kokudiliza ithumbu, ukuze kungabikho i-subnet ehlala ibheke ekugxumeni okulandelayo okungasekho.
Khona-ke ukuthuthwa kwe-subnet kamuva noma ukuxhumeka kwe-spoke kunendawo eyodwa echaziwe yokubuyekeza, esikhundleni sethumbu elisebenzayo elithwala icala lomzila elingakaze libe ngowalo.