AWS Client VPN: ukungena kuyaphumelela kodwa i-subnet ayifinyeleleki

Iklayenti lakho lithi Connected, isitifiketi sisebenza, kodwa ikhasi le-intranet lisaphela ngesikhathi. Leli gebe cishe alilona ukutholwa kobunikazi. I-AWS Client VPN igunyaza izindawo ngokwehlukile ekungeneni, futhi izimbangela ezimbili ezijwayelekile yinani leqembu elingahambisani nalokho okuthunyelwe umhlinzeki wobunikazi kanye nomthetho wendawo oqondile odlula umthetho obanzi. Kokubili kuyabonakala ekulungiselelweni kwe-endpoint uma wazi ukuthi ubheke kuphi.

Ukungena kuphumelele; umthetho awuzange uhambisane

Ukutholwa kobunikazi kuphendula ukuthi umsebenzisi ungubani. Imithetho yokugunyaza iphendula ukuthi lowo muntu angafinyelela kuziphi iziqalo zenethiwekhi. Umsebenzisi angadlula owokuqala kodwa ahluleke kowesibili, futhi iklayenti likunika okungaphezu nje koxhumano oluhlala luvuliwe ngesikhathi zonke izicelo ziphela ngesikhathi.

Qala ngokuqinisekisa ukuthi i-endpoint inomthetho wokugunyaza okufaka ikheli elihlulekayo endaweni yawo. Uma kungekho mthetho ohambisanayo, uxhumano luziphatha kahle; okushodayo inqubomgomo.

Inani leqembu livela kuphi ngempela

Ku-Active Directory, inkambu ye-access-group igcina i-SID yeqembu, hhayi igama elibonakalayo. Ku-SAML federation, igcina i-ID noma igama leqembu elithwalwa ngempela isici seqembu le-SAML elilungiselelwe. Kopisha inani kusuka ku-assertion noma ekusesheni kwedijithali, hhayi ekhasini le-wiki.

Iqembu le-IAM liyindawo ehlukile yokulawula. Ilungelo lokuphatha i-endpoint ye-Client VPN alilifaki iqembu le-IAM njengeqembu le-VPN lomsebenzisi, futhi ukunamathisela igama leqembu le-IAM kunkambu ye-access-group akuliguquli libe yi-SID ye-AD noma inani lesici se-SAML.

Iqembu elinegama elifanayo kwedijithali elinye alifakazi lutho. Hlola indlela yokutholwa kobunikazi ye-endpoint kanye nobulungu noma i-assertion yomsebenzisi kulowo hlelo olufanayo.

Isiqalo eside kakhulu siyawina, kufaka ne-0.0.0.0/0

Ukugunyazwa kuhlolwa ngokuhambisana kwesiqalo eside kakhulu, futhi umthetho wazo zonke izindawo uhlolwa ekugcineni, hhayi ekuqaleni. Engeza umthetho ongu-10.46.0.0/16 we-Engineering kanye nomthetho ongu-0.0.0.0/0 wawo wonke umuntu, futhi umsebenzisi ongaphandle kwe-Engineering akakwazi ukufinyelela ku-10.46.20.10 ngomthetho obanzi.

Yilapho ukulungisa kungahamba kabi. Ukususa umthetho omncane kubuyisela ukufinyelela komsebenzisi futhi kunikeza leyo subnet kubo bonke abantu abamboziwe umthetho obanzi. Yakha imatrix yamaqembu-kuya-kunethiwekhi ngaphambi kokususa noma yini, futhi ubhale ukuthi yimaphi amaqembu okufanele afinyelele kuluphi ububanzi. Le mithetho ivumela kuphela; awukho umugqa wokwenqaba wokusika okuhlukile emvumweni obanzi.

Izinguquko zidinga noxhumano olusha ukuze zihlolwe ngobulungisa. Xhuma kabusha iklayenti ngemva kokuhlela imithetho, bese uhlola futhi.

Hlukanisa ukugunyazwa nendlela yedatha

Umthetho ohambisanayo awuwona umzila. I-endpoint idinga i-subnet exhunyiwe kanye nomugqa kuthebula lezindlela wendawo, futhi iqembu lokuphepha lomthombo ohlosiwe kufanele lamukele ithrafikhi. Ithrafikhi ebuyayo ne-DNS nakho kufanele kusebenze.

Hlola umsebenzisi okufanele aphumelele kanye nomsebenzisi okufanele ahlale ngaphandle. Bobabili bangangena kodwa munye kuphela ofinyelela i-subnet, futhi lowo mehluko uwubufakazi obufunayo.

Uma ikheli le-IP lisebenza kodwa igama lomsingathi lingasebenzi, bheka i-resolver ngaphambi kokuthinta ukugunyazwa. Uma kungekho mzila ohlanganisa ikheli, lungisa ukuxhumana noma ithebula lezindlela. Uma iphakethe lifika futhi insizakalo iyinqaba, isigaba esilandelayo inqubomgomo yaleyo nsizakalo. Ukwandisa imatrix yokugunyazwa kubo bonke abasebenzisi kufihla ukuthi yiluphi ungqimba olwaluphukile ngempela.

Ngaphambi kokuvala ithikithi, bhala umthombo wobunikazi, inani eliqondile leqembu, iziqalo zendawo kanye nomzila othwala ithrafiki. Lowo mbhalo wenza umbiko olandelayo wokuxhunyiwe kodwa ungenakufinyelela ube ukuqhathanisa kwemizuzu emibili esikhundleni somunye umjikelezo wokuqagela.