I-Azure IP VPN yangasese ku-ExpressRoute ngaphandle kwe-NVA

Inganekwane iwukuthi ukubethela ithrafikhi nge-peering yangasese ye-ExpressRoute kudinga idivayisi yenethiwekhi ebonakalayo. Akudingi. I-Azure isekela i-Site-to-Site VPN Gateway okuphela kwayo kwethumbu ikheli langasese le-RFC1918 elithwalwa ngesekethe, futhi idivayisi iyazikhethela, ayisona isakhiwo. Lokho inganekwane yedivayisi ekufihlayo yingxenye ebuhlungu ngempela: ukuvula indawo yokuphela yangasese entweni eyodwa esikhundleni sezinto ezimbili, nokuvumela umzila we-peering oqondile ukuba unqobe ngokuthula umzila obethelwe.

Inganekwane yaqhamuka kuphi

Lesi simangalo sinesizinda esihloniphekile. Iminyaka eminingi indlela esebenzayo ye-IPsec phezu kwe-peering yangasese kwakuyi-NVA, ngoba isango eliphethwe laliveza kuphela izindawo zokuphela zomphakathi. Lokho kwashintsha, futhi izimpendulo ezabhalwa ngaphambi kwalokho zisacashunwa emicu lapho kungekho ohlola usuku. Ukulungiswa kuncane: isango le-VPN elinekheli langasese likhona, futhi lishintsha indawo yokuphela, hhayi umqondo womzila ozungezile.

Akukho kulokhu okuthumela i-NVA emhlalaphansi. Kuthumela emhlalaphansi umcabango wokuthi idivayisi iyona ndlela kuphela eya emfunekweni.

Vula indawo yokuphela yangasese emazingeni womabili

Qala ngoxhumano lwe-peering yangasese ye-ExpressRoute olusebenzayo futhi oluxhunywe ku-VNet equkethe isango le-VPN. Uhlangothi lwasekhaya kufanele lube selufinyelela amakheli angasese afanele ngesekethe, ngoba ithumbu lizosebenzisa lawo makheli njengokuthutha. Bese kuba umbandela wesango: inqubo ye-Microsoft ye-VPN ye-IP yangasese idinga isango elakhiwe phezu kwensiza ye-IP yomphakathi ye-Standard. Ukukheliwa kwethumbu langasese akususi lowo mbandela, okumangaza abantu abacabanga ukuthi «yangasese» kusho «akukho IP yomphakathi ndawo yonke».

Manje vula ifulegi kuzo zombili izindawo. Ukuhlelwa kwesango kunokushintsha kwayo kwama-IP angasese, futhi uxhumano lwe-Site-to-Site olulodwa lunomunye ongokwesibili okuphoqa lowo xhumano ukuthi lusebenzise ikheli langasese. Ukusetha okukodwa hhayi okunye ukuhlelwa okungaphelele okuvame kakhulu; ithumbu lingahlangana noma lihlangane endaweni yokuphela engalungile.

az network vnet-gateway update -g rg-net -n vpngw-prod --set enablePrivateIpAddress=true
az network vpn-connection update -g rg-net -n conn-onprem --set enablePrivateIpAddress=true
az network vnet-gateway show -g rg-net -n vpngw-prod \
  --query '{sku:sku,priv:enablePrivateIpAddress,active:activeActive}'

Qinisekisa amagama ezakhiwo uma uqhathanisa nenguqulo ye-CLI efakiwe, ngoba amalebula esango nezici ze-CLI akuhlali zisebenzisa igama elifanayo. Isango elisebenzayo-elisebenzayo liveza amakheli amabili ethumbu langasese, futhi idivayisi yasekhaya idinga ukuthi kokubili okubhangqwana kuhlelwe uma ufuna lokho kweqile kube nomqondo. I-BGP ayidingeki nje ukuze kumiswe leli thumbu elinekheli langasese, nakuba ngokuvamile iyingxenye yendlela osabalalisa ngayo iziqalo.

Inganekwane yesibili: ithumbu elimisiwe libethela ithrafikhi yakho

Manje izindlela ezimbili zifinyelela inethiwekhi yohlelo lokusebenza: umzila oqondile we-peering yangasese nomzila nge-VPN. Zombili ziyasebenza. Yinye kuphela esebenzisa lolu ungqimba lwe-IPsec. I-Microsoft ibhala ukuthi lapho iziqalo ezifanayo zimenyezelwa nge-ExpressRoute nange-VPN, i-Azure ikhetha umzila oqondile we-ExpressRoute, ngakho ithumbu eliphilile elinezibali eziphilile alifakazi lutho mayelana nalapho amaphakethe ohlelo aya khona.

Izindlela zokuqondisa ezibhaliwe iyisigaba esimbozayo ku-ExpressRoute nesigaba esivikelekile esicacile ku-VPN, noma iziqalo ezihlukene emizileni emibili. Ngokwesibonelo, i-peering yangasese ingathwala 10.40.0.0/16 kuyilapho i-VPN imenyezela 10.40.12.0/24. Isiqalo esicacile siyanqoba futhi ingxenye esele yesigaba ihlala iqondile.

az network vnet-gateway list-advertised-routes -g rg-net -n vpngw-prod
az network vnet-gateway list-learned-routes -g rg-net -n vpngw-prod
az network vpn-connection show -g rg-net -n conn-onprem --query connectionStatus

Yenza ukuhlola okufanayo ohlangothini lwasekhaya, ngoba ukukhetha kwesiphambanisi sakho kunquma ukuthi ithrafikhi ephumayo iphuma ngakuphi uhlangothi. Futhi gcina ukuthutha kwethumbu uqobo emzileni we-ExpressRoute; umzila odonsa indawo yokuphela yangasese yesango ungene ethumbini wenza ithumbu lincike kulo uqobo.

Nquma ukuthi kwenzeka ini lapho ithumbu liwa

Umzila we-VPN ocacile uyanyamalala lapho ithumbu liwa, kuyilapho umzila oqondile obanzi usala. Ithrafikhi ibe isigeleza ngaphandle kokubethelwa futhi konke kubonakala kuphilile, okuyisimo sokwehluleka esibi kakhulu emfunekweni ekhona ukuphefumulela ukuvikeleka kokubethelwa. Uma umfuneko uvimbela lokho kubuyela emuva, umzila nenqubomgomo yokufinyelela kufanele kusho lokho ngokucacile esikhundleni sokuthembela ekutholakaleni kwethumbu.

Bhala phansi ukuthi yiziphi iziqalo ezingahlala zifinyeleleka ngqo nokuthi yiziphi okufanele zime lapho umzila obethelwe ungekho. Bese uhlola icala elivunyelwe ngethrafikhi yangempela futhi uqhathanise izibali zoxhumano, ngoba itafula lemizila lodwa ngeke likutshele ukuthi umfuneko wokubethela usasebenza yini.

Lolo hlaka lukuvumela futhi ukuthi uhlole i-NVA ngezici zayo zangempela, njengezithumbu eziningi, ukudlula noma ukuhlolwa komhlinzeki, esikhundleni sokuyithenga ngoba indawo yokuphela ingasese.