I-Azure i-point-to-site iyaxhumanisa kodwa asikho isisetshenziswa esiyimfihlo esiphendulayo
Ukuxhunyaniswa kusho kuphela ukuthi umhubhe ukhuphukile. Hlola ukuthi isango lingathwala ini, qhathanisa izikhala zamakheli, bese uxazulula igama futhi uhlole isevisi ngokwayo.
Ukuxhunyaniswa yisimo somhubhe, hhayi isitatimende mayelana nokufinyeleleka. Iklayenti le-point-to-site lingaqeda i-IKE, lithole ikheli futhi lingafinyeleli lutho, ngoba isango lidlulisa ithrafikhi kuphela kumaxhumano aziwa yi-VNet kakade. Yenza lezi zihlolo ezinhlanu ngokulandelana futhi ume ekwehlulekeni kokuqala. Ukweqa phambili yiyo indlela inkinga ye-DNS ethathwa ngayo njengenkinga ye-firewall ihora lonke.
Ukulandelana kubaluleke kakhulu kunohlu.
Uhlolo 1: nquma ukuthi umhubhe kufanele uthwale ini
I-Azure VPN Gateway iqeda umhubhe futhi idlulisa ithrafikhi engokwe-VNet; ayiyonaindlela yokuphuma ejwayelekile ye-inthanethi. Uma abasebenzisi belindele ukuthi ukubhrawuza kwabo kuphume nge-Azure, umklamo awulungile ngaphambi kokuthi noma yisiphi isilungiselelo seklayenti singene. Vula i-split tunneling ukuze i-inthanethi yasendaweni iqhubeke isebenzisa indlela yasendaweni, futhi usebenzise i-NAT instance noma umhubhe we-site-to-site uma ikheli lokuphuma eliqinile lidingeka ngempela.
Bhala phansi ukuthi iklayenti kufanele lifinyelele kuphi ngaphambi kokuhlola noma yini. Ngaphandle kwalolo hlu, yonke imiphumela engaphelele ibonakala njengenqubekelaphambili.
Uhlolo 2: qhathanisa izikhala zamakheli ngaphambi kwezitifiketi
Ukugqagqana kubhekwa ngezikhathi ezibanzi, ngakho amaxhumano amabili abonakala ehlukile ezingeni le-subnet asashayisana uma amabhuloko awo angabazali egqagqana. I-subnet yesango kumele ibe yeyakho futhi ibe nkulu ngokwanele kwi-SKU, futhi ichibi lamakheli eklayenti akumele lishayisane ne-VNet noma nanoma yini efinyeleleka nge-peering. Shintsha uhlelo futhi uphinde ukhiphe, ngoba ukwengeza imizila ukunxephezela kudala umhubhe osebenza kwezinye izindawo kodwa ngendlela engachazeki ungasebenzi kwezinye. Ukuhlinzeka kwehluleka kakhulu lapha, futhi leso yisimo esihle.
Ukuqinisekisa ukuthi ungubani yisango elilandelayo. Amaphrofayili esitifiketi, i-RADIUS ne-Entra ID awashintshisani, futhi iphakethe leklayenti liyahluka kwelinye nelinye.
Uhlolo 3: xazulula igama eliyimfihlo ngaphakathi
Iklayenti ligcina isixazululi salo ngaphandle uma iphrofayili elandisiwe iletha amaseva e-DNS e-VNet, futhi lolo hlu lufakwa ngaphakathi ngesikhathi sokulanda. Engeza i-forwarder ngaphakathi kwe-VNet, yibeke njengeseva ye-DNS ye-VNet, bese ulanda futhi ungenise iphakethe leklayenti futhi. Ukusebenzisa kabusha iphakethe elidala kuhlola uhlu lwakudala lwezixazululi kuphela.
Hlola ikheli kuqala, ngoba lokho kuhlukanisa umzila nokuqanjwa kwamagama esigabeni esisodwa: Test-NetConnection 10.20.1.4 -Port 3389.
Uma ikheli liphendula kodwa igama lingaphenduli, buza isixazululi ngqo nge-Resolve-DnsName files.corp.example -Server 10.20.0.4. Uma kokubili kwehluleka, iphutha aliyona eye-DNS futhi kufanele uyeke ukuhlela izilungiselelo ze-DNS. I-DNS yeplathifomu ye-Azure ku-168.63.129.16 iphendula kuphela ngaphakathi kwe-VNet, ngakho iklayenti elingaphandle ayikwazi ukusebenzisa lelo kheli njengesixazululi.
Uhlolo 4: hlola isevisi engemva komhubhe
Umhubhe onempilo nembobo evaliwe kubonakala kufana kusukela kuklayenti. Hlola i-firewall yesivakashi, bese iqembu lokuphepha kwenethiwekhi ku-subnet noma ku-NIC, bese ukuthi isevisi ilalela ikheli eliyimfihlo hhayi i-loopback kuphela. Vumela ichibi lamaklayenti njengomthombo esikhundleni sokuvula umthetho oya ku-inthanethi, futhi khumbula ukuthi i-SMB eya ku-Azure Files idinga indlela ye-endpoint eyimfihlo edlula emhubheni. Uma isisetshenziswa siphendula nge-IP kodwa hhayi ngegama, buyela kuhlolo 3 esikhundleni sokuthinta isango.
Ithebula elilodwa lihlukanisa izendlalelo ngenkathi usebenza:
| Symptom | Layer to check |
|---|---|
| Name fails, private IP works | Resolver setting or forwarder |
| Private IP also fails | Address plan, NSG, guest firewall |
| Private works, internet fails | Expected; the gateway is not an egress |
| Connects, then drops | Tunnel type or certificate mismatch |
Uhlolo 5: rekhoda iphrofayili ngaphambi kokunyusa
Faka uhlobo lwesango, uhlobo lomhubhe, indlela yokuqinisekisa kanye nohlelo lokusebenza lweklayenti kwithikithi. Iphrofayili ye-IKEv2 enesitifiketi nephrofayili ye-RADIUS yehluleka ngezizathu ezihlukile, futhi iklayenti elakhelwe olunye uhlobo lomhubhe lixhumanisa kuphela uma isango linikela ngephrothokholi ehambisanayo.
Eqenjini elincane umklamo ohlala isikhathi uphathekile yi-VNet eyodwa, i-forwarder ye-DNS eyodwa kanye neklayenti le-split-tunnel elibhaliwe. Uma imfuneko iyindlela yokuphuma yomphakathi eqinile, qeda umhubhe we-site-to-site ku-firewall oyilawulayo futhi uqondise ithrafikhi ye-inthanethi lapho, esikhundleni sokucela isango le-point-to-site into engakaze yakhelwe yona.