I-Azure P2S VPN ayikwazi ukuxazulula igama lephoyinti lokugcina eliyimfihlo

Uxhumanisa umhubhe we-point-to-site, wenza i-ping ekhelini eliyimfihlo, uvula uhlelo lokusebenza bese uthola u-403 noma iphutha lesitifiketi esikhundleni salokho. Zombili izimpawu zikhomba ku-DNS, kodwa zingamaphutha ahlukene: elinye lisho ukuthi iklayenti yaxazulula ikheli lomphakathi, elinye lisho ukuthi yaxazulula ikheli eliyimfihlo yabe isinikeza igama isitifiketi esingalihlanganisi. Landela izivivinyo ezingezansi ngokulandelana futhi ume ekuhlulekeni kokuqala, ngoba ukufakwa kwe-hosts noma impendulo egcinwe kukhashi kungenza zonke izivivinyo ezilandelayo ziphume ngesizathu esingalungile. Ngigcina lokhu kulandelana efayeleni lombhalo eceleni kwamaphrofayela ami e-VPN, ngoba ukulungisa akushintshi lutho emhubheni futhi kushintsha konke kulokho iklayenti elikwaziyo.

Qala ngekheli iklayenti elilithola ngempela

Buza isixazululi ngqo esikhundleni sokwethemba uhlelo lokusebenza. Ku-Windows, i-nslookup adminuidev-fedqcubyd9bfb2bq.canadacentral-01.azurewebsites.net ikhombisa ukuthi iklayenti lathola wuphi umbono. Impendulo yomphakathi isho ukuthi akukho okuzofinyelela iphoyinti lokugcina; ikheli eliyimfihlo lephoyinti lokugcina lisho ukuthi i-DNS isiphelile futhi isivivinyo esilandelayo ukuxhumana uqobo.

Iphoyinti lokugcina eliyimfihlo alishintshi igama lesevisi. I-akhawunti noma uhlelo lokusebenza kugcina igama layo eliphelele elivamile, futhi iphoyinti lokugcina lishintsha kuphela ikheli igama elixazululwa kulo kumaklayenti angaphakathi kwenethiwekhi ebonakalayo. Yingakho igama lomsingathi elifanayo lixazululwa njengeliyimfihlo lisuka ku-VM enethiwekhi futhi lingasesidlangalaleni lisuka kukhompyutha ephathekayo engakaze inikwe umbono oyimfihlo.

Ngaphambi komhubhe, hlola isifunda, isixhumanisi saso kanye nokurekhodiwe

Izimo ezintathu kufanele zibe khona ndawonye: isifunda esiyimfihlo sikhona, sixhumene nenethiwekhi ebonakalayo lapho isango le-VPN namaklayenti angena khona ku-Azure, futhi siqukethe irekhodi le-A lephoyinti lokugcina elikhomba ekhelini eliyimfihlo. Xhumanisa isifunda nenethiwekhi engahlobene futhi isango lizoqhubeka nokuxazulula irekhodi lomphakathi kuyilapho konke emhubheni kubonakala kuphilile.

Amagama ezifunda angezinsizakalo, hhayi ezesixhumanisi esiyimfihlo ngokujwayelekile. I-App Service ivamise ukusebenzisa i-privatelink.azurewebsites.net, isitoreji ne-SQL zineendawo zazo zamagama, futhi ukuboleka isifunda senye insizakalo kudala isifunda esikhona kodwa esingaphenduli lutho olusizo.

Nikeza iklayenti isixazululi esingafinyelela ngempela kuso

I-168.63.129.16 iphendula isuka emishinini ebonakalayo ye-Azure futhi ayisona iseva ye-DNS yekhompyutha ephathekayo ngaphesheya komhubhe we-point-to-site. Iklayenti lidinga isixazululi esifinyeleleka ngomhubhe: iphoyinti lokugcina lokungena le-Azure DNS Private Resolver, isidluliseli ngaphakathi kwenethiwekhi ebonakalayo, noma ukufakwa kweseva ye-DNS okuthwelwe kuphrofayela yeklayenti le-VPN ukuze iklayenti libuze inethiwekhi ebonakalayo ngqo.

Isixazululi esilungisiwe kodwa esingafinyeleleki siziphatha njengokungathi asikho isixazululi, futhi uphawu ukuphela kwesikhathi hhayi impendulo engalungile, yingakho kufundwa ngokungalungile njengenkinga yodonga lomlilo. Yivivinya ngombuzo okufanele umhubhe uwuthwale, hhayi ngegama lomphakathi elalizophumelela ngokuxhumana kwendawo noma kunjalo.

Uma udlulisela esikhundleni sokuphusha izilungiselelo, dlulisela indawo yamagama enesifunda esiyimfihlo, i-privatelink.azurewebsites.net hhayi yonke i-azurewebsites.net. Isidluliseli esinemibandela esigwinya lonke isijobelelo somzali sithumela yonke imibuzo yensizakalo ku-Azure, kuhlanganise leyo okufanele ihlale yendawo.

Sebenzisa igama isitifiketi esakhishwa lona

Lapho ikheli selilungile, iphutha lesibili liyavela. Isitoreji ne-App Service zishicilela isiteketiso i-privatelink, futhi leso siteketiso akudingekile ukuthi kube igama elikusitifiketi. Ukulayisha kwe-AzCopy okubhekiswe ku-privatelink.blob.core.windows.net kwehlulekile ukuqinisekiswa; ukulayisha okufanayo ku-<account>.blob.core.windows.net/<container> kwaxazululwa kwaya ekhelini eliyimfihlo futhi kwadlula, ngakho kwahlala endleleni eyimfihlo ngaphandle kokweqa.

Umthetho usebenza kusiphequluli naku-App Service: xhumana negama lomsingathi elihlanganiswa isitifiketi bese uvumela i-DNS inikeze ikheli eliyimfihlo. Ungafuni indlela yokweqa ukuqinisekiswa, ngoba iguqula iphutha lamagama libe ukuhlehla kwezokuphepha. I-ping ephumelelayo ifakazela indlela futhi ayisho lutho ngegama elingaphakathi kokuxhawulana, yingakho lokhu kuhlala kuyizivivinyo ezihlukene.

Ukulandelana kwezinyathelo ezine okuhlukanisa ungqimba ngalunye

1. Qinisekisa ukuthi iklayenti le-VPN linekheli elisuka echibini le-point-to-site nendlela eya ekhelini eliyimfihlo lephoyinti lokugcina.
2. Xazulula igama eliqondile elisetshenziswa uhlelo lokusebenza bese uqhathanisa impendulo nekheli lephoyinti lokugcina.
3. Vula ukuxhumana kwe-TCP ukuya kuphoyinti lokugcina embobaneni yensizakalo, bese ufunda igama lesitifiketi elethulwa kulokho kuxhumana.
4. Manje kuphela viviya ukugunyazwa, ngoba indlela esebenzayo nesitifiketi esivumelekile akukuniki ukufinyelela kusisetshenziswa.

Ukuxhumana okwenqatshiwe ngenkathi ikheli lilungile kukhombisa iqembu lokuphepha lenethiwekhi noma isimo sokuxhumana kwephoyinti lokugcina eliyimfihlo, hhayi i-DNS, ngakho hlola lokho ngaphambi kokuhlela kabusha izilungiselelo zesixazululi. Ukungafani kwegama le-TLS kukubuyisela egameni lomsingathi ku-URL naku-subject yesitifiketi. Gcina ndawonye umphumela wokuxazulula, igama lesitifiketi kanye ne-URL eqondile; lawo makhelo amathathu achaza iningi lalezi zimo ngaphandle kokuthinta isango.

Sebenzisa i-VM ngaphakathi kwenethiwekhi ebonakalayo njengokulawula. Uma igama lixazululwa njengeliyimfihlo lapho futhi lisuka emhubheni njengelomphakathi, isifunda nokurekhodiwe kulungile futhi umehluko oyedwa indlela yesixazululi sekhayenti, okucaciswa ngokushesha kunokunye ukudlula kusilungiselelo sephoyinti lokugcina.

Amaklayenti nawo agcina kukhashi. Irekhodi elaphendula esidlangalaleni emizuzwini eyishumi edlule liyaqhubeka nokuphendula ngemva kokuthi ulungise isifunda, ngakho sula ikhashi ngaphambi kokuphinda uvivinye. Ku-Windows, i-ipconfig /flushdns isula ikhashi leklayenti; imithetho yenqubomgomo yokuxazulula amagama isala, inquma ukuthi isiphi isijobelelo esiya kusiphi iseva, futhi ingaqhubeka nokuthumela indawo yamagama kusixazululi osanda kusishintsha.

Ukufakwa kwe-hosts kufanele kube kuphi

Ukungeza ikheli lephoyinti lokugcina efayeleni le-hosts kuwukuxilonga okuhle nokuklama okubi. Kufakazela ukuthi ukumephwa kwegama kuya ekhelini yingxenye engekho futhi kukuvumela ukuthi uvivinye konke ngemva kwalelo nyathelo, kodwa akubonakali kubasebenzisi bakho, kuyaphuka lapho ikheli lephoyinti lokugcina lishintsha, futhi kufihla isifunda okufanele siphendule.

Ukufakwa kokuvivinya okusalile kubi kunekhashi elidala, ngoba kungenza indlela elungisiwe ibonakale iphukile noma indlela ephukile ibonakale ilungisiwe kuye ngokuthi iphutha liya ngakuphi. Kususe ngaphambi komgijimo wokugcina futhi uxazulule ngesixazululi sokukhiqiza kuphela.

Amagama amafushane adinga isijobelelo sokusesha kanti amagama aphelele awasidingi, ngakho vivinya igama eliphelele kuqala, bese unquma ukuthi uhlelo lokusebenza ludinga yini isijobelelo esiphushwa ngephrofayela yeklayenti. I-Microsoft ibhala phansi amagama ezifunda kanye nezimo zokurekhodi ngesinsizakalo ngayinye kuyi-miqondiso yayo ye-DNS yamaphoyinti okugcina ayimfihlo; funda ukufakwa kwensizakalo yakho esikhundleni sokukopisha isifunda kwesinye.