I-S2S VPN ku-Azure ixhunyiwe kodwa akukho traffic: funda ilogi ye-IKE

Iphothali ithi Connected, ithumbu linesibali sikhathi sokusebenza, futhi i-trace evela kumshini wakho ongabonakali iyafa ku-hop yesibili. Isimo sokuxhumana sichaza ukuxoxisana kwe-IKE ne-IPsec, hhayi ukuthi iphakethe elilodwa liyadlula yini kungqimba lwenqubomgomo nhlangothi zombili. Amaphutha amabili achaza iningi lamathikithi, futhi alikho nelilodwa elilungiswa ngokushintsha umzila we-Azure. Womabili asevele abhaliwe kulogi eyakhiwe isango, yingakho ngiqala lapho hhayi kuthebula lemizila.

I-Connected ifakazela ini ngempela

Ukuxhumana kwe-site-to-site okuxhunyiwe kusho ukuthi isigaba 1 nesigaba 2 kuqediwe futhi izinhlangano zokuphepha ziyasebenza. Leso yisitatimende mayelana nokuxoxisana: izinhlangothi zombili zavumelana ngesiphakamiso, zashintshana ngokhiye futhi zafaka ipheya le-SA. Akusho lutho mayelana nokuthi abakhethi be-traffic bayahambisana yini namasubneti ocabanga ukuthi avikelekile, futhi akusho nokuthi uhlangothi olukude luzohambisa iphakethe endaweni ethile ngemva kokulikhipha. Ithumbu lingahlala livuliwe amasonto ngenkathi lilahla konke ukugeleza okuthakazelisayo, futhi yilowo mkhuba oqondile owenza abantu bakhe kabusha isango elinempilo.

Amaphutha amabili okufanele ahlolwe kuqala yi-peer ephakamisa i-AH esikhundleni se-ESP, kanye nenethiwekhi ebonakalayo efakwe izinombolo esikhaleni isango elingayithathi njengengaphakathi.

Vula ilogi ekhishiwe ngaphambi kokuthinta imizila

Kuphothali, vula isango lenethiwekhi ebonakalayo bese wenza umsebenzi we-VPN troubleshoot kukuxhumana, bese ulanda ibhandela elikhiqizayo bese uyayivula. Ngaphakathi kunelogi ye-IKE enokushintshana kwesigaba 1 nesigaba 2, enezimpawu zesikhathi futhi efundeka njengombhalo ojwayelekile. Sesha kuyo umugqa we-transform esikhundleni sokufunda kusuka phezulu kuye phansi, ngoba umbhalo othakazelisayo uvame ukuba ngaphakathi kwamakhulu ambalwa emigqa. Uma ungenakho ukufinyelela kuphothali, izinto zokuxilonga ezifanayo zivela endaweni yelogi yesango uma izilungiselelo zokuxilonga zivuliwe.

Imibhalo emibili ithwala ingxenye enkulu yenani. Eyokuqala ifundeka cishe expected ESP with combined authentication and cipher, received AH. Eyesibili yiphutha le-payload elingavumelekile ngesikhathi sokushintshana kwe-IKE, okuvame ukusho inkambu yesiphakamiso eyakhiwe kabi noma engasekelwe.

Womabili achaza lokho okwahlongozwa idivayisi yasendaweni, ngakho womabili ayizilungiselelo ohlangothini lwe-peer. Ukukhiqiza kabusha uhlangothi lwe-Azure lokuxhumana akushintshi isiphakamiso esithunyelwa i-firewall yakho, futhi ukukwenza noma kunjalo yihora elimoshwa kakhulu kulo msebenzi. Ku-peer, setha isigaba 2 ku-ESP ngokuqinisekisa nokubhala okuhlanganisiwe bese uyeka ukuthi ixoxisane nge-algorithm, bese uhlola ukuthi ibhokisi lokumaka lomthengisi elinegama elifana ne-combined mode likhetha ngokuthula isiphakamiso se-AH ngaphansi kwayo.

Qinisekisa isikhala sekheli senethiwekhi ebonakalayo

Isango lilindele ukuthi inethiwekhi ebonakalayo ibe sezikhawu zangasese. Inethiwekhi efakwe izinombolo kubhloki lomphakathi, isibonelo eliqala nge-111.x, ingakhuphula ithumbu ngenkathi i-Azure inqaba ukuthatha leso sikhala njengesangaphakathi, ngakho ukuxhumana kubonakala kunempilo futhi akukho kugeleza okwamukelwayo. Qinisekisa isikhala sekheli ngaphambi kokuchitha intambama kubakhethi. Uma izinombolo ziyimfuneko eqinile evela ekwabiweni kwakudala, isisombululo ukushintsha uhlelo lwamakheli hhayi esinye isango.

Bhala ukugqagqana nezikhawu zasendaweni ngenkathi usekubhodi yezikhala zamakheli, ngoba iziqalo ezigqagqanayo zikhiqiza okunye ukwehluleka okubonakala kufana kusuka kumklami.

Qinisekisa iziqalo ezinhlangothini zombili

Insiza yesango lenethiwekhi yasendaweni igcina iziqalo zasendaweni, futhi kufanele zihambisane namasubneti avikelwa ngempela idivayisi ekude. Isifinyezo esihlanganisa amakheli adilizwa idivayisi sizodlulisa okunye ukugeleza bese sihluleka kokunye, futhi lokho kufundwa njengokwehluleka komzila ngezikhathi ezithile hhayi njengokungahambisani kokucushwa. Bheka nohlangothi olukude: uhlangothi olulodwa lubala i-/16 ngenkathi olunye lubala ama-/24 amathathu ngaphakathi kwayo — lokho ukwehluleka okuyingxenye okujwayelekile. Alukho uhlu olugunyaziwe lodwa, ngakho qhathanisa womabili eceleni esikhundleni sokwethemba lolona olubonayo.

Ushintsho lwesiqalo alutholakali njalo ngokwalo, ngakho hlela ukugcina noma ukwakha kabusha into yokuxhumana bese uqinisekisa ukuthi iziqalo ezintsha zivela ezinhlangothini zombili.

Hlola umzila, hhayi i-ping

I-trace ehlukanisa ithumbu elisebenzayo kumzila osebenzayo ibonakala kanje: i-hop yokuqala isango lasendaweni, bese kuba nama-hop ambalwa angaphenduli, bese uphendula umphathi wezindawo ekude. Uma i-trace ingafinyeleli kumphathi nhlobo, hlola iphothi le-TCP elisetshenziswa ngempela uhlelo, ngoba i-ICMP ihlanjululwa kaningi ngokwanele ukuthi i-ping ehlulekile ifakaze okuncane kakhulu. Gijima leyo trace kusuka kumphathi wezindawo ekude ukuya kumshini obonakalayo ku-Azure. Ukungalingani phakathi kwemiphumela emibili iyona ndlela esheshayo yokuthola umzila wokubuya ongekho noma umthetho ovumela uhlangothi olulodwa kuphela.

Bhala isiphakamiso se-peer, izikhala zombili zamakheli kanye nesikhathi sokwakhiwa kokuxhumana kuthikithi, ukuze unjiniyela olandelayo azi ukuthi imaphi amanani akhiwe kabusha nokuthi yimaphi angakaze athintwe.

Uma ilogi ibuya ingenalutho, kungenzeka ukuthi isango alikuphethi ukuxhumana kwakho nhlobo. Qinisekisa ukuthi ikheli le-peer esangweni lenethiwekhi yasendaweni lihambisana nedivayisi obala kuyo ilogi, ngoba amasango amabili kusethulo esisodwa kukhohliswa kalula ngesikhathi sokwakhiwa kabusha. Lelo phutha lithatha usuku futhi alishiye mkhondo kunoma iyiphi ilogi.