I-IP ezinzile ku-Azure P2S VPN: kungani ikheli leklayenti lishintsha

Iklayenti ngalinye le-Azure point-to-site lithola ikheli esitsheni lapho lizigunyaza, futhi liligcina kuphela isikhathi eside leyo nxhumano isikhona. Awekho ithebula lokubekela eceleni, akukho ukumephwa komsebenzisi ngamunye, futhi akukho sethi yengosi esho ukuthi «nika lo muntu u-172.16.0.10 njalo». Yilo mshini owodwa uwona ochaza zombili izimpawu abantu abahlangabezana nazo kamuva: umthetho we-NSG ongasavumelani nomsebenzisi owawuvumelana naye ngaphambili, kanye nohlu lwezimvume olwamukela buthule umshini ongazange wengezwe ngamabomu. Ukushintsha umthetho ngomthetho we-IP ohlakaniphe ukwedlula akuphuli noma yikuphi kukho, ngoba lokho umthetho okushoyo kwabiwa kabusha ngohlelo lwezikhathi ongekho ngaphansi kokulawula kwakho.

Isitsha singumthamo, hhayi ubunikazi. Sikhona ukuze imigudu esebenza ngesikhathi esisodwa ithole amakheli ahlukile, futhi siwasebenzisa kabusha ngaso leso sikhathi lapho isivumelwano siphela. Uma lokho sekucacile, umbuzo owusizo awusabi «ngiyibopha kanjani le klayenti» futhi uba «yini engingabhala umthetho ngokumelene nayo engosi engeke iyisebenzise kabusha».

Ingosi yenzani ngempela lapho iklayenti lixhumana

Ingosi igcina isitsha samakheli eklayenti esilungisiwe futhi isiphatha njengethebula lezivumelwano. Ekuxhumaneni ithatha ikheli elilandelayo elivulekile, empeleni eliphansi kakhulu elitholakalayo, futhi ilinikeza isidlulisimigudu sengosi kuze kube iklayenti lixinene noma isivumelwano siphela. Ukulandelana kuyanquma, hhayi ubunikazi: noma ubani oxhumana kabusha kuqala ngemva kwesikhathi sokuthula uthola ikheli eliphansi kakhulu okwenzeka ukuthi likhululekile ngaleso sikhathi.

Ubukhulu besitsha bufihla ukuziphatha. Isitsha saselabhorethri esingamakheli amabili ngaphezu kwesibalo sabahloli sibonakala sinqumile, ngoba i-laptop efanayo ivamise ukuxhumana kabusha ngokulandelana okufanayo njalo ekuseni. Engeza umshini wesithathu, shintsha ubukhulu besitsha, noma shyiya isikhathi sokuxhumana sixhunyiwe phakathi nesidlo sasemini, iphethini iyaphuka. Ikheli alikaze lizinze; umugqa wawuzinzile.

Noma yikuphi ukushintsha ekulungiseni kwe-point-to-site kuphinde kusetha kabusha isikhala sezivumelwano. Uhlobo oluhlukile lokuqinisekisa, isitsha esishintshiwe ubukhulu, uhla olusha lwesitsha, noma ingosi ediliziwe futhi yakhiwa kabusha — konke kubuyisela amaklayenti esitsheni esingasavumelani namakheli awo amadala. Akukho lutho kulolo shintsho oluthinta i-NSG yakho, yingakho ukwehluleka kubonakala kwenzeka kuwedwa.

Ungakubona lokho kwenzeka cishe ngomzuzu owodwa. Xhumana, bhala ikheli lomgudu emininingwaneni yokuxhumana kweklayenti, nqamula, xhuma umshini wesibili, bese uphinde uxhume owokuqala. Ikheli olibuyiselwayo lincike kulokho umshini wesibili okubambile, futhi asikho isethingi sephothali esibuyisela eledlule ngokucela.

I-NSG esekelwe ku-IP yeklayenti empeleni iwumthetho mayelana nokulandelana kokuxhumana

Umthetho abantu abawubhala kuqala uwona osobala: umthetho wokungena ku-NIC ye-VM yokuphatha noma kunethiwekhi encane yayo, ngokuthatha ikheli langaphakathi leklayenti le-VPN njengomthombo. Ufushane, uyaphasa ukuhlolwa ngosuku okubhalwe ngalo, futhi uyehluleka ngokushesha uma isitsha sinamakheli avulekile angaphezu kwelilodwa.

Kulokho kuvela izindlela ezimbili zokwehluleka, futhi eyodwa kuphela ibonakala iyiphutha. Umsebenzisi osemthethweni uyenqatshwa ngoba omunye umuntu ubambe ikheli umthetho owushoyo ngaleso sikhathi, futhi lokho kuza njengephepha lokusekelwa elihlukumezayo. Noma umsebenzisi ongahlosiwe uvunyelwa ngoba uzuzwe njengefa ikheli umthetho osathembayo, futhi lokho akuzi njengalutho kuze kube umuntu uhlola ukufinyelela.

Ngoba umthetho ulandela isivumelwano, inqubomgomo esebenzayo ifundeka njengokuthi «umuntu wokuqala oxhumayo uthola ukufinyelela kokuphatha». Lokho kuyincazelo yokulandelana kokuxhumana egqoke ingubo yenhloso, futhi akukho ukuhlanzeka komthetho okukwenza kube ukuvezwa kwenhloso.

Isivumelwano seklayenti nekheli lengosi kuyizinto ezihlukene

Ukudideka okukhulu kuvela egameni elilodwa. Ingosi ine-IP yomphakathi ezinze ngokwanele; amaklayenti anamakheli angasese avela esitsheni angenzi njalo. Engosini ye-VPN engenakho ukusekelwa kwezweke, i-IP yomphakathi yabiwa ngokuguquguqukayo, kodwa iyasinda ekushintsheni kobukhulu, ekusethweni kabusha nasekunakekeleni okujwayelekile — iyashintsha lapho ingosi ngokwayo isuswa futhi yakhiwe kabusha. Ama-SKU engosi anokusekelwa kwezweke kanye nawesifunda asebenzisa i-IP yomphakathi ye-Standard SKU, futhi lokho kwabiwa kumele kube kugxilile.

Lokho kuzinza yikho okudingwa umlingani wasekhaya ekulungiseni kwakhe, futhi akusho lutho mayelana nokuhlonza iklayenti elilodwa. Uma umlingani ebuza ukuthi uzobona ikuphi ikheli, impendulo iyi-IP yomphakathi yengosi ngaphansi kwe-site-to-site, noma uhla lwe-NAT olwabiwe — hhayi neze isivumelwano somgudu se-laptop.

Amasitsha amaqembu akunika uhla okufanele ubhale imithetho ngokumelene nalo

I-Virtual WAN point-to-site isekela amaqembu abasebenzisi, futhi iqembu ngalinye linganikezwa isitsha saso samakheli eklayenti. Ubulungu bunqunywa ubunikazi, ngakho uhla iklayenti eliwela kulo luba okungalindelekile: ukusebenza kuhla olulodwa, abakwaqashi kuhla olunye, futhi uhla luyinto umthetho we-firewall noma we-NSG ongayisho ngaphandle kokuqagela.

Isethi yemitherho evelayo inesimo ongayihlola:

• isitsha esisodwa kubabukeli ngabanye, silinganiswe ngezikhathi zokuxhumana eziphezulu ngesikhathi esisodwa hhayi ngenani labantu;
• ubulungu beqembu busingathwa ngobunikazi, hhayi ngokuhlela imithetho njalo uma othile ejoyina;
• imithetho ye-NSG noma ye-Azure Firewall ibhalelwa izinhlaka zesitsha, hhayi neze izivumelwano ngazinye;
• isikhungo noma ingosi ehlukile kubabukeli abangamele bavumelane ngohla ngokuphelele.

Ukufaka isitsha sonke ohlwini lwezimvume kuyiqiniso kodwa kuyamhlambalaza: iklayenti ngalinye elixhunyiwe kulolo hla lithola ukufinyelela okufanayo. Lokho kuyisinqumo senqubomgomo okufanele sikhulunywe phezulu esikhundleni sokutholwa phakathi nokubuyekezwa. Noma yini esadinga impendulo ngomuntu ngamunye ingeyensiza ngokwabiwa kwendima, hhayi ingeyisihlungi samaphakethe.

Lapho ukuthunyelwa kungakwazi ukuya ku-Virtual WAN

Amangosi amaningi ahlala engamangosi e-VPN ajwayelekile, futhi ukuya ku-Virtual WAN akulona ushintsho olulula. Impendulo esebenzayo iwukuhambisa isinqumo somsebenzisi ngamunye sisuke esihlungini samaphakethe siye entweni eseyazi ukuthi umsebenzisi ungubani.

Ubunikazi bezinsiza buyingxenye eshibhile. I-Storage, i-SQL ne-Key Vault konke kusekela ukuqinisekisa kwe-Entra ID nokwabiwa kwendima ngomsebenzisi noma ngeqembu, ngakho i-VPN kumele ifakazele ukufinyeleleka kwenethiwekhi kuphela. Isikhungo sokugxuma esinamakhawunti anamagama senza umsebenzi ofanayo emsebenzini wokuphatha, ngoba isikhungo siqopha umuntu futhi umgudu uthwala amaphakethe kuphela. Ukubhalisa amaklayenti ku-DNS nokuvumela igama esikhundleni senombolo kuphakamisa umthetho isigaba esisodwa. Ubunikazi bezigaba zohlelo lokusebenza — isihloko sesitifiketi, isimangalo sethokheni, ubulungu beqembu — kusebenza lapho okucelwayo ukuthi kunqume kuyihlelo lokusebenza, hhayi inethiwekhi.

Kumlingani ogcizelela ikheli lomthombo eliqinile, impendulo i-site-to-site noma i-ExpressRoute enesimaphambili somlingani esichaziwe. Bavumela isimaphambili somlingani, ikheli elivela ohlangothini lwabo lingelengosi, futhi alishintshi uma othile eqalisa kabusha i-laptop.

Hlola isitsha ngaphambi kokuhlela olunye uhlu lwezimvume

Izici ezimbili zesitsha zibangela iningi lokuziphatha abantu abakubeka eklayenti. Isitsha esincane kakhulu sisebenzisa kabusha izivumelwano ngokushesha, ngakho amakheli abonakala enyakaza njalo futhi noma umuphi umthetho osekelwe ekhelini ubonakala ungazinzile ngokwakhiwa. Isitsha esihlangana nezinhlaka zasekhaya noma nesikhala samakheli senethiwekhi ebonakalayo sidala ukungacaci komzila okungekho mthetho we-firewall owukulungisayo.

Beka izinto ezintathu ekhasini elilodwa ngaphambi kokuthinta umthetho: isitsha se-point-to-site, isikhala samakheli senethiwekhi ebonakalayo kanye nezinhlaka zasekhaya. Akumele zihlangane, futhi isitsha sidinga isikhala seklayenti ngalinye elisebenza ngesikhathi esisodwa kanye nomkhawulo wokuxhumana kabusha.

Bese uvala umjikelezo ngalokhu kulandelana:

• Xhumana kusuka kumishini emibili ngakho kokubili ukulandelana bese uqhathanisa amakheli; uma engashintshana, awukho umthetho osekelwe ekhelini ophephile.
• Hlola ukuthi ingosi iyi-Virtual WAN yini; uma kunjalo, sebenzisa amasitsha amaqembu esikhundleni semithetho yekheli ngalinye.
• Buza ukuthi kwenzekani uma umthetho uthinta umuntu ongafanele; uma impendulo iyisigameko sokufinyelela, hambisa ukulawula kubunikazi.
• Bhala ukuthi luphi uhla olungolaluphi iqembu endaweni yokugcina efanayo nezincazelo ze-NSG.
• Phinda uhlole ngemva kokushintsha kwesitsha, kokuqinisekisa noma kwengosi, ngoba lokho kushintsha kubhala kabusha ukumephwa ngaphandle kokumemezela.