AWS Site-to-Site VPN: ngaphandle, ngaphakathi kanye nephrefikhi le-LAN

Iningi lamaphutha ku-AWS Site-to-Site VPN amaphutha ekheli, futhi enziwa ngaphambi kokuba ngisho iphakethe elilodwa linyakaze. Amakheli angaphandle ethaneli afinyelela kozakwethu be-IPsec, amakheli angaphakathi akha isixhumanisi somzila phakathi kwabo, futhi amaphrefikhi avikelwe yiwo umzila lowo owenzelwe wona. Kopisha indima eyodwa kwenye, ithaneli liyaphakama kanti akukho okuhlelwayo. Nansi ukulandelana kokufunda-ukuhlola-ukuhlela engikusebenzisa esangweni lekhasimende le-BGP, futhi amanani athathwe kusimo somsukelo esilandiwe, hhayi enkumbulweni.

Izinhlobo ezintathu zamakheli, ithaneli elilodwa

Amakheli angaphandle asesidlangalaleni futhi angabozakwethu be-IPsec: elilodwa ngephaneli ngalinye ohlangothini lwe-AWS, kanye nobuwena obufinyelelekayo besango lekhasimende ohlangothini lwakho, obulungiselelwe uhlelo lwe-NAT onalo ngempela. Amakheli angaphakathi ayimfihlo futhi angomzila wengqondo, i-AWS ewabhala njenge-/30 ethathwe ku-169.254.0.0/16. Amaphrefikhi avikelwe amanethiwekhi e-VPC, angaphakathi noma edlulayo owahlelayo futhi uwamemezele kulo mzila.

Ukunikeza iphrefikhi le-LAN njengekheli lesixhumanisi sethaneli yisimo esijwayelekile sale phutha. Isixhumanisi sibonakala silungisiwe, i-LAN ayimemezelwa, futhi uhlangothi olungaphesheya alunayo indlela yokuya kuyo. Ithaneli lingaze lidlule ipingi yalo yangaphakathi ngenkathi lonke igama lohlelo liphelelwa yisikhathi. Inkomba yezinketho zethaneli ibala imikhawulo ye-CIDR yangaphakathi, kuhlanganise nobubanzi bamakheli okufanele ivele kubo.

Funda amanani kusimo esilandiwe

Landa isimo semodeli yedivayisi yakho ethile kusixhumanisi, bese uthatha ithebula lamakheli ayo njengomthombo weqiniso. Ikhonsoli ikhombisa amanani afanayo ngephaneli ngalinye: i-IP yangaphandle, i-CIDR yangaphakathi kanye nekheli lozakwethu be-BGP ohlangothini lwe-AWS. Womabili amathaneli yizinto ezihlukene ezinamaphoyinti okuphela angaphandle ahlukene kanye nama-/30 angaphakathi ahlukene, nakuba womabili ethwala amanethiwekhi afanayo avikelwe.

aws ec2 describe-vpn-connections --vpn-connection-ids vpn-0123456789abcdef0 \
  --query 'VpnConnections[0].Options.TunnelOptions[].[OutsideIpAddress,TunnelInsideCidr]'
aws ec2 describe-customer-gateways --customer-gateway-ids cgw-0123456789abcdef0 \
  --query 'CustomerGateways[0].[IpAddress,BgpAsn]'

Uma ifayela elilandiwe kanye nekhonsoli ebukhoma kungavumelani, ifayela liphelelwe yisikhathi. Landa futhi esikhundleni sokuhlela amakheli ngesandla, ngoba ukungafani phakathi kwebhangqa langaphakathi kanye nomakhelwane ohleliwe wozakwethu kuwukungaphumeleli kwe-BGP okuthule.

Akha isixhumanisi ngekheli elifanele

Esangweni le-Linux ithaneli yisixhumanisi se-VTI noma se-XFRM, futhi i-/30 yangaphakathi ibekwa kuleso sixhumanisi. Amathaneli amabili asho izixhumanisi ezimbili kanye nomakhelwane ababili be-BGP, oyedwa ngephoyinti ngalinye lokuphela le-AWS. Umkhuba i-AWS ewushicilelayo kusimo sedivayisi esilandiwe ubeka isango langasese elingokoqobo ekhelini lokuqala le-/30 ngayinye yangaphakathi kanye nesango lakho lekhasimende kwelesibili, ngakho uthatha ikheli eliphakeme futhi wenza ubuzakwethu nelephansi. Akukho okudinga ikheli le-LAN lapha.

ip tunnel add tun0 mode vti local 203.0.113.10 remote 18.230.1.1 key 42
ip addr add 169.254.10.2/30 dev tun0
ip link set tun0 up mtu 1400
ip tunnel add tun1 mode vti local 203.0.113.10 remote 18.230.2.1 key 43
ip addr add 169.254.10.6/30 dev tun1
ip link set tun1 up mtu 1400

Uma ifayela lemodeli yedivayisi yakho lishicilela ibhangqa elihlanekezelwe, sebenzisa izinombolo zalo futhi gcina umthetho: ikheli elikusixhumanisi ngelakho, ikheli lozakwethu ngele-AWS. Ukwenza lokhu ngokuhlanekezelwe kukhiqiza ithaneli elingafiki neze ku-Established, ngoba umakhelwane owumhlelile yikheli isixhumanisi sakho esivele sinakho.

Gcina umaka kanye nokhiye we-VTI kuhambisana nalokho i-IKE daemon ekusebenzisayo ukubopha i-SA yengane kusixhumanisi, uma kungenjalo ithrafikhi ifika ethaneli ngaphandle kwesixhumanisi sokuhlala. Hlola i-MTU ngokumelene nomzila nangokumelene nezilungiselelo ze-IKE daemon uqobo esikhundleni sokukopisha inombolo kusayithi enye.

Qinisekisa i-BGP ngaphambi kokuthi uqinisekise imizila

Ukuphakama kwe-IPsec kufakazela ukuthi ozakwethu bavumelene ngobudlelwano bokuphepha futhi akukho okunye. Isikhathi se-BGP siyingxoxo ehlukile phezu komzila wangaphakathi, ngakho funda isimo somakhelwane kanye nezibali zamaphrefikhi, bese uziqhathanisa nalokho obuzimisele ukukumenyezela.

ip -s addr show dev tun0
vtysh -c 'show bgp summary'
vtysh -c 'show bgp neighbors 169.254.10.1'
vtysh -c 'show ip bgp neighbors 169.254.10.1 advertised-routes'

Isimo se-Established namaphrefikhi angu-zero atholiwe kuyinkinga yenqubomgomo noma yokumemezela, hhayi inkinga yethaneli. Phinda ukuhlola konke ethaneleni lesibili; ithaneli lokuqala elisebenzayo likutshela ukuthi amakheli anengqondo, hhayi ukuthi ithaneli lesibili lahlelwa nakancane.

Landela iphakethe elihleliwe, bese uma

Lapho isikhathi sithwala amaphrefikhi, hlola umzila kuzo zombili izinhlangothi kusukela esangweni: ikheli lomthombo, ukugxuma okulandelayo kanye nenqubomgomo yokuphepha evumela ithrafikhi. Isikhathi se-BGP singase sibe phezulu kanti iphrefikhi ethile edingwa uhlelo lwakho ihlungiwe, ifingqelwe noma ikhomba isixhumanisi esingalungile.

I-Reachability Analyzer iyithuluzi lohlangothi lwe-AWS elithatha umthombo, indawo ekuyiwa kuyo kanye nomzila, bese libika ukuthi yisiphi isigaba esikusimweni esisekelwayo esikuvimbile. Yisebenzise ukuhlola umzila osuka ku-VPC uya ekhelini lesango lakho lekhasimende, hhayi usuka kumsingathi wohlelo. Ihlaziya isimo futhi ayithumeli iphakethe ngodonga lomlilo lwasekhaya, ngakho hlukanisa isinqumo sayo nezibali zakho zesixhumanisi nokubanjwa kwamaphakethe.

Rekhoda ibhangqa langaphandle, i-/30 yangaphakathi kanye namaphrefikhi amenyezelwe ethaneleni ngalinye etafuleni elilodwa. Yilelo tafula elenza ushintsho olulandelayo lukwazi ukubuyekezwa.