Ukuhlolwa kwe-NVA ku-Azure: kungani impendulo idlula kwenye firewall enye

Ukugeleza okusuka egatsheni kuya ku-Azure kungahlelwa kahle kuzo zombili izinhlangothi futhi kuhluleke, ngoba izinhlangothi ezimbili zidlula kumadivayisi ahlukene. Isicelo sishiya igatsha nge-VPN, sihla ku-NVA A futhi sifinyelela umthwalo womsebenzi. Impendulo ishiya umthwalo womsebenzi, ihambisana nomzila okhomba ku-NVA B futhi ife lapho. Wonke umzila kuleso sithombe ukhona, futhi iseshini ye-TCP isaphukile.

Request: branch -> VPN gateway -> NVA A -> workload
Reply:   workload -> NVA B -> VPN gateway -> branch

Leso sikhala siyisihloko sonke lapha: ukuhlangana komzila kanye nobunikazi besimo seshini kuyizinkinga ezihlukene ezibonakala zifana kudayagramu.

Yini i-Route Server eyihlelayo ngempela

I-Azure Route Server yenza i-peering nezipikha ze-BGP ezisekelwayo, ifunda imizila yazo futhi iyihlela emizileni esebenzayo yenethiwekhi ebonakalayo. Lowo umsebenzi wezinga lokulawula. Ayifundi ithebula leseshini le-firewall yomthengisi futhi ayazi ukuthi iyiphi idivayisi evumile ukuxhumana okuthile. Izinyathelo ezimbili ezilandelayo ezinendleko ezilinganayo, kule ndwangu, ziyizindlela ezimbili zokufinyelela isiqalo esifanayo, futhi izosebenzisa noma yisiphi.

Ngakho ukufunda umzila kufakazela ukufinyeleleka. Akufakazeli lutho mayelana nokuthi idivayisi engxenyeni enye ibona lo kugeleza ngaphambili.

Funda izinhlangothi zombili ngaphambi kokuklama

Qala ngokubhala ukuqondisa onakho ngempela ohlangothini ngalunye, hhayi lokho obukuhlosile. Imizila ye-BGP eqondile kakhulu, imizila echazwe umsebenzisi kanye nokuziphatha kwesango konke kuyancintisana, futhi owinile unqunywa ngendawo okuyiwa kuyo, hhayi ngeseshini. Umzila ozenzakalelayo ku-NVA awusho ukuthi sonke isiqalo sangasese sidlula kuwo.

Ukuhlola okuwusizo ukubuza, nge-IP ethile yomthwalo womsebenzi, ukuthi yisiphi isinyathelo esilandelayo ohlangothini ngalunye oluxazululwa kuso. Uma impendulo iyimadivayisi amabili ahlukene, unenkinga yokungalingani noma ngabe isivele yavela noma cha.

Isimo sihlala kuphi

I-firewall enesimo yamukela ukuxhumana futhi igcina okufakiwe kwethebula okhiwe nge-five-tuple. Impendulo kufanele ifinyelele idivayisi ephethe lokho kufakiwe, noma leyo divayisi kufanele ithole isimo ngendlela enye. Akukho lutho ku-data plane ye-Azure oludlulisela okufakiwe phakathi kwamadivayisi. Kungaba ukuthi ithrafikhi iqondiswa ibuyele kumnikazi, noma amadivayisi abelana ngesimo ngomshini womthengisi, noma ukuklama akusebenzi.

Yingakho ama-NVA amabili anempilo awukona ukuhlolwa kwempilo kokuhlola. Impilo imayelana nokufinyeleleka; ukuhlola kumayelana nokuthi yiluphi uhlobo oluphethe iseshini.

Amamodeli e-HA asekelwayo nokuthi yikuphi okuqinisekisayo

Microsoft's guidance on nenhloso yokuhlela ye-Virtual WAN sichaza ukuziphatha okulinganiselwe kokuxhumana kwendima ekabili kanye nama-NVA e-firewall, lapho ukuqondisa okuqondile kungadlula ukuphoqelelwa okulinganayo okujwayelekile kwe-hub. Funda leyo ncwadi njengemikhawulo ku-topology oyikhethile, hhayi njengokwenqatshwa kwamadizayini asebenzayo asebenzayo. Ipheya yomthengisi evumelanisa isimo, noma eqondisa ngokugeleza ngakunye, ingasekelwa. Ipheya enendleko elilinganayo engakwenzi kokubili ayisekelwa.

Bese uchaza okwenzeka kumaseshini akhona lapho i-node yehluleka. Ukuhlangana komzila kubuyisela ukufinyeleleka kokugeleza okusha phakathi namasekhondi, kanti isimo se-firewall esidala simane sinyamalale. Ukuxhumana kabusha kwekliyenti kungaba umphumela obhaliwe, futhi leso yisinqumo esithathwa ngaphambi kwesigameko, hhayi phakathi naso.

Yini okufanele uyihlole ngaphambi kokuyethemba

Test with inspection enabled and inqubomgomo yokufinyelela yomthwalo womsebenzi isendaweni yayo, ngoba noma yikuphi kwalokhu kungafihla ukungalingani. Thumela ukugeleza okusha okugunyaziwe kuzo zombili izinhlangothi futhi uqinisekise ukuthi idivayisi efanayo ibona izingxenye zombili. Bese ugijima ithrafikhi eqhubekayo futhi uvuse ukushintshwa okuvunyiwe, ubuka ukuthi amaseshini asekiwe ayaphila noma ayaxhumana kabusha.

Hlanganisa ukugeleza ngakunye nedivayisi okwakuphathwa yiyo. Ukubamba amaphakethe ku-NVA eyodwa akusho cishe lutho uma impendulo ingakaze ibuye lapho.

Ekugcineni, bhala uhlelo njengemigqa emithathu ehlukene: ubunikazi bemizila, ukuqondisa ithrafikhi kanye nobunikazi besimo seshini. Amadizayini ayaphuka lapho ezimbili zokuqala zixazululiwe kanti eyesithathu icatshangelwa.