Ukusetha i-GatewaySubnet ku-Azure: gcina indawo ngaphambi kwesango

Vula inethiwekhi ebonakalayo kuphothali bese ubheka isikhala samakheli ngaphambi kokuthinta i-blade yesubneti. Uma leyo /24 isivele ihlukaniswe ngamasubneti omsebenzi ngaphandle kwesikhala esikhululekile, asikho isikhala sokugcinwa kwe-/27, futhi ekugcineni uzobe usihlukanisa kabusha noma ukhulisa i-VNet, okuwushintsho olunye olunokunye ukubuyekezwa. Nquma isikhala kuqala, bese udala isubneti.

Lokho kuhleleka kubalulekile ngoba isubneti yesango akuyona isubneti yomsebenzi enegama elikhethekile. Ingukugcinwa kwamakheli ezingxenyeni zesango ezilawulwayo, futhi i-Azure izonqaba isango uma ukugcinwa kungalungile.

Qala ngesikhala samakheli

Bhala isiqalo se-VNet, amasubneti omsebenzi kanye nokugcinwa kwesango emugqeni owodwa ngaphambi kokuthayipha noma yini. I-VNet ku-10.60.0.0/16 inesikhala; khetha ububanzi ekugcineni ukuze ukukhula komsebenzi kuhlale kuhlangene.

Isibonelo, i-10.60.255.192/26 ishiya amakheli angu-64 esangweni kuyilapho imisebenzi isala ku-10.60.0.0/20. Lesi yisibonelo sokuhlela amakheli, hhayi isithembiso sosayizi. I-Microsoft njengamanje idinga i-/27 noma enkulu kumasango e-VPN angewona awase-Basic, lapho enkulu isho amakheli amaningi: i-/26 inika angu-64, kanti i-/28 inika angu-16. Phendula phezulu, ungalokothi phansi, ngenkathi uhlelo lwamakheli lusanyamalala.

Dala isubneti ngegama eliqondile

Kuphothali, engeza isubneti bese uthayipha igama elithi GatewaySubnet ngokunemba, u-G omkhulu no-S omkhulu, ngaphandle kwezikhala noma isijobelelo. I-Azure iqhathanisa leyo ntambo, ngakho-ke i-Gateway-Subnet noma i-gateway ikhiqiza isubneti isevisi yesango engayisebenzisi.

Isinyathelo esifanayo esivela ku-CLI, okulula ukusibhala ekubuyekezweni:

az network vnet subnet create --resource-group rg-hub --vnet-name vnet-hub --name GatewaySubnet --address-prefixes 10.60.255.192/26

Shiya isubneti ingenalutho. Akukho VM, akukho endpoint eyimfihlo, akukho kudluliselwa kwesevisi. Uma kukhona osekuvele kuhlala lapho, ukusetshenziswa kuyahluleka futhi iphutha alivamisile ukusho insiza evimbelayo, ngakho-ke hlola uhlu lwezinsiza zesubneti ngaphambi kokuqala.

Gcina isubneti elawulwayo ingenamithetho yomsebenzi

Ungaxhumanisi iqembu lokuphepha lenethiwekhi kule subneti; i-Microsoft ikumaka njengokungasekelwe. Ungaxhumanisi ithebula lomzila okuthi umzila walo ozenzakalelayo uthumele i-0.0.0.0/0 kwenye indawo, ngoba lokho kungaphula ukusebenza kwesango, futhi gcina ukusabalala kwemizila yesango kuvuliwe.

Beka imikhawulo yokufinyelela owawuyifuna ngempela kusubneti yomsebenzi noma emngceleni wokuhlola. Ukuphatha i-GatewaySubnet njengesubneti evamile yiphutha elikhiqiza isango elisetshenziswa kahle bese lingadlulisi noma yikuphi ukuhamba.

Ukungena emhubheni okuphoqelelwe kunomklamo walo obhaliwe. Umzila ozenzakalelayo owenziwe ngokushesha kusubneti yesango awuyona leyo.

Hlola ukuncika okungakubonisi iphothali

Ngaphambi kokucindezela dala, hamba ohlwini: igama eliqondile, isiqalo ngaphakathi kwesikhala se-VNet, akukho ukugqagqana nobubanzi basendaweni, akukho zinsiza zomsebenzi ngaphakathi, akukho NSG, futhi akukho thebula lomzila elinomzila ozenzakalelayo. Ngakunye kwalokhu kuke kwaphula ukusetshenziswa kwangempela. Bese uqinisekisa umklamo obanzi: isango lenethiwekhi yasendaweni ohlangothini lwasendaweni, izikhala zamakheli ohloselwe ukuzihambisa, kanye nokuthi kuhlelwe ukusebenza okubili noma ukubambisana. Lezo zinqumo zishintsha ingxoxo yosayizi, futhi kushibhe kakhulu ukuzixazulula manje.

Uma othile ebuza ukuthi kungani isubneti ingakwazi ukugcina i-VM, ikhasi okufanele licashunwe yi-isikhombo sezilungiselelo zesango se-Azure.

Uma isango selivele likhona

Ukushintsha usayizi noma ukushintsha isubneti yesango akukona ukuhlela imaski. Qala uhlole inqubo yoshintsho esekelwe ye-SKU nesizukulwane sesango, bese ubala izinto ezincikile: ukuxhumana, ama-IP omphakathi, umzila kanye nanoma yisiphi isidingo sokubuyisela.

Uma inqubo idinga ukuthi isango lenziwe kabusha, kuhlele njengokufuduka kwesevisi okunewindi kanye nokuhlehla. Bhala phansi ukugcinwa okukhethile, isizathu sosayizi kanye nemithetho ongayixhumanisanga ngamabomu, ukuze umbuyekezi olandelayo angalungisi isubneti engenalutho ngokwengeza i-NSG.