Indlela yokwenza i-AWS iqale ithumbu le-Site-to-Site VPN
Isenzo sokuqala nesenzo sesikhathi esiphelayo se-DPD ziphendula imibuzo ehlukene. Setha leso esenza i-AWS iqale, bese uhlola ikheli lika-peer nomzila wohlelo.
Ngokuzenzakalelayo, i-AWS Site-to-Site VPN ilinda ukuthi i-customer gateway iqale izingxoxo. Lokho okuzenzakalelayo kuyisilungiselelo, hhayi umthetho, futhi isilungiselelo sibizwa nge-Startup action. Ngaphambi kokufinyelela kuso, hlukanisa imibuzo emibili ehlale ihlanganiswa: ubani owakha ithumbu, nokuthi ingabe amaphakethe okukhathazayo anomzila odlula kulo. Eyokuqala kuphela esezinkethweni zethumbu.
Hlukanisa isenzo sokuqala nesenzo sesikhathi esiphelayo se-DPD
Izinketho ezimbili ngethumbu ngalinye zilawula izehlakalo ezimbili ezihlukene, futhi ukusetha okukodwa akusho lutho ngokunye.
| Event | Option | Useful values |
|---|---|---|
| A new or modified VPN connection needs a tunnel | Startup action | add waits for the peer; start asks AWS to initiate |
| Dead peer detection times out | DPD timeout action | clear ends the session, restart reinitiates, none does nothing |
Uma i-AWS kufanele yakhe ithumbu elisha noma elishintshiwe, khetha start. Uma i-AWS kufanele futhi iqale kabusha izingxoxo ngemva kwesikhathi esiphelayo se-DPD, lungiselela restart kuleso sehlakalo ngokwehlukana. Akukho kulezi zinketho okuyinqubomgomo yokuphinda yezicelo yohlelo, futhi akukho okuyisikhala sokushintsha ukhiye: i-DPD ihlola ukuthi i-peer iyaphila yini, kanti ukushintsha ukhiye kushintsha ama-security associations ethumbini elisebenzayo.
Uhlelo oluphelelwa isikhathi ngesikhathi ithumbu lisabika up luhlangabezana nenkinga yomzila wedatha. Ukufinyeza isibali sikhathi se-DPD ngeke kukulungise lokho, futhi kungengeza umsindo okufanele uwuchaze kamuva.
Hlola ukuthi i-AWS inendawo yokuthumela izingxoxo
Ukuqala ohlangothini lwe-AWS kusebenza kuphela nge-IKEv2, futhi i-AWS idinga ikheli lomphakathi le-customer gateway ukuze yazi ukuthi ithumelela kuphi isiphakamiso. Icala elibuhlungu kakhulu isisetshenziswa se-customer gateway esiqinisekiswe ngesitifiketi esakhiwe ngaphandle kwekheli: imibhalo ye-AWS ichaza ukwakha isisetshenziswa esisha se-customer gateway nekheli bese ishintsha ukuxhumana kwe-VPN ukuze kukhombise kuso.
Isitifiketi sifakaza ukuthi i-peer ingubani. Asitsheli i-AWS ukuthi i-peer ikuphi, futhi lezi izimfuno ezimbili ezihlukene. Yingakho isixazululo kuyisisetshenziswa esisha se-customer gateway hhayi isitifiketi esisha. Ukushintsha isitifiketi kushiya i-AWS nenjongo efanayo elahlekile.
Uma i-customer gateway ingemuva kwe-NAT, i-AWS idinga futhi i-responder identity elungiselelwe, IDr, ukuze ubunikazi be-peer buhambisane nalokho okulindelwe idivayisi. Qinisekisa lelo nani kanye nomzila womlilo ovumela ukuhamba kwe-IKE ngaphambi kokusola inketho oyishintshe manje. Ukukhetha start akukwazi ukuphoqa i-peer engafinyeleleki noma ekhonjwe ngokungalungile ukuthi yamukele isiphakamiso.
Sebenzisa ushintsho ethubeni elilodwa futhi ulindele ukuphazamiseka
Ukuxhumana kwe-VPN kunezithumbu ezimbili ezinezinketho ezizimele, ngakho qinisekisa ngekheli langaphandle ukuthi yikuphi okuhlelayo. I-AWS ivumela ukushintshwa kwethumbu elilodwa ngesikhathi, futhi ukuxhumana ngethumbu elikhethiwe kungaphazamiseka imizuzu embalwa.
- Khetha ukuxhumana kwe-Site-to-Site VPN bese uvula i-Modify VPN tunnel options.
- Khetha ithumbu ngekheli le-IP langaphandle bese uqinisekisa inguqulo ye-IKE kanye nesisetshenziswa se-customer gateway.
- Setha izenzo zokuqala neze-DPD ozifunayo ngempela, bese ugcina esikhathini osilawulayo.
- Qinisekisa ukuthi ithumbu elishintshiwe liyasungulwa, bese uhlola elinye ithumbu nokuhlela umzila ngaphambi koshintsho olulandelayo.
Kukhona okukodwa okufanele kuqashelwe ngaphambi kwesondlo. Uma ukuqala kwe-AWS kuvuliwe akukho sikhathi esiphelayo: i-AWS iqhubeka izama kuze kube ithumbu liphakama, futhi iqala kabusha uma i-customer gateway ithumela umyalezo we-delete-SA. Uma wehlisa i-peer ngamabomu, i-AWS iyoqhubeka ingqongqoza, futhi amalogi e-peer azokukhombisa lokho.
Qinisekisa umzila wohlelo, hhayi isimo sethumbu kuphela
Ithumbu elibika up alifani nesicelo esisebenzayo. Umsebenzi we-Lambda oxhunywe ku-VPC usadinga umzila we-subnet oya esiqalweni sekhasimende, imithetho ye-security group ne-network ACL evumela ukuhamba, ukuxazululwa kwamagama okubuyisa ikheli elifanele, kanye nomzila wokubuyela ohlangothini lwekhasimende.
Hlola kanye ngesicelo sangempela esivela kumongo wohlelo, bese ufunda ama-flow logs uma kuhluleka. Ukuhamba kwe-keepalive kuyinketho esemthethweni uma ukuqala kwe-AWS kuvaliwe futhi ithumbu elingenzi lutho lidinga amaphakethe ukuze lihlale liphakeme, kodwa kufanele kube isinqumo sokuqapha ongasisho ngegama, hhayi umjikelezo we-ping ongachazwanga oboshelwe emsebenzini.
Qala ngokukhetha ukuthi ubani owakha ithumbu, bese uxilonga ukwehluleka okusele esigabeni salo. Imibhalo ye-AWS mayelana nokuqala ihlanganisa izimfuno zekheli, ubunikazi nokuphinda ngemininingwane eningi kunamathiphu ekhonsoli.