I-VPN ye-Azure yendawo-kuyendawo enomuntu ogxile ngemuva kwe-NAT: uhlu lokuhlola

Yenza lezi zahlolo ngokulandelana futhi ume kokokuqala okuhlulekayo. Iningi lezicelo ezithi i-Azure ayisekeli idivayisi engemuva kwe-NAT ziba ikheli lomuntu ogxile i-Azure engakwazi ukulifinyelela, noma umhubhe ongaqali nhlobo ohlangothini olufanele. Ukuthutha kwangaphandle nokuhlela kwangaphakathi kuyizinkinga ezimbili ezihlukene, futhi ukuzihlanganisa kuchitha intambama. Isinyathelo ngasinye esingezansi siveza umbono ongawunikeza omunye umuntu.

Isinyathelo 1: qinisekisa ukuthi umuntu ogxile usekude ne-NAT ngempela

Qhathanisa ikheli elikusihlanganisi se-WAN sedivayisi nekhleli i-Azure elibona kuyo. Uma ehlukene, kukhona okuhumushayo, futhi lowo mhumushi manje uyingxenye yedizayini yakho ye-VPN. Buza umhlinzeki ukuthi ukumephwa kumi ngaso sonke isikhathi noma kwabiwe, ngoba ukumephwa okwabiwe kushintsha lokho ongakwethemba. Idiyayisi enekheli le-WAN eliyimfihlo futhi engenakudluliswa iyicala elihlukile kunelo elingemuva kwe-NAT yezinga lomhlinzeki enokumephwa komphakathi okuzinzile.

Uma amakheli womabili efana, ma lahla lapha: i-NAT akusiyo inkinga yakho futhi ingxenye esele yalolu hlu ngeke isize.

Bhala amakheli womabili kanye nohlobo lomhumushi kuthikithi. Lowo mugqa owodwa uvimbela umjikelezo olandelayo wemibuzo wokuthi kungani umuntu ogxile ohlelwe engaphenduli.

Isinyathelo 2: vumelana ukuthi ubani oqalayo

Imibuzo evamile ye-Azure VPN Gateway ichaza ukusekelwa kwe-NAT-T futhi yengeza ukuthi idivayisi yasendaweni kufanele iqale umhubhe we-IPsec uma ingemuva kwe-NAT. Lokho kuhambisana nendlela ukuhumusha okunesimo okusebenza ngayo, ngoba umhumushi ugcina ukumephwa ngoba idivayisi yangaphakathi yathumela iphakethe lokuqala. Uma kulindeleke ukuthi i-Azure iqale futhi kungafiki lutho oludala lokho kumephwa, umhubhe awuqali nhlobo.

Hlela umuntu ogxile ukuze iphutha lokuphendula kuphela libonakale, bese uhlola ukuthi idivayisi izama yona ngokwayo noma idinga isisusa. Amanye amadivayisi aphakamisa umhubhe kuphela lapho kuvela ithrafikhi enentshisekelo, futhi lokho kulungile kuze kube yilapho ithrafikhi enentshisekelo iyinhlolo yezempilo engafi futhi engafiki.

Bheka ukushintshana kwe-IKE kudivayisi ngesikhathi sokuqalisa ngesandla; ukuthula lapho kuyimpendulo yokuhlela noma yocingo lomlilo, hhayi impendulo ye-Azure.

Isinyathelo 3: thola ikheli lomuntu ogxile ngendlela efanele

I-Azure idinga ikheli lomphakathi elifinyelelekayo lomuntu ogxile entweni yesango lenethiwekhi yasendaweni, ngokuvamile ikheli lomphakathi lomhumushi hhayi ikheli langaphakathi ledivayisi. Ubunikazi idivayisi ezifakaza ngabo iyinkambu ehlukile futhi ingahluka ngokusemthethweni kukheli i-Azure elishayayo. Gcina kokubili kuhlukene, ngoba ukukushintsha kukhiqiza ukwehluleka kokuqinisekisa okubonakala kufana ncamashi nenkinga ye-NAT.

Uma ikheli lomphakathi lishintsha, leyo nto kufanele ishintshe nayo. Igama elixazulula ekhelini eliphelelwe yisikhathi libi kune khleli eliqinile okufanele ulibuyekeze ngesandla.

Bhala womathathu amanani: ikheli lasendaweni ledivayisi, ikheli lomphakathi elihumushiwe, kanye nobunikazi bomuntu ogxile obuhleliwe.

Isinyathelo 4: vula kuphela izimbobo i-NAT-T ezidingayo

I-NAT-T ithwala i-ESP ngaphakathi kwe-UDP, futhi i-RFC 3948 ichaza lokho kufakwa ngaphakathi kwesikhwama ngembobo engu-4500 esetshenziswa ngemuva kwezingxoxo zokuqala embobeni engu-500. Ucingo lwakho lomlilo kanye nomhumushi kufanele kokubili kuvumele ukushintshana nethrafikhi yako ebuyayo. Ukuvumela imbobo ye-TCP engahlobene akufakazi lutho ngalo mzila, futhi umthetho ovumela ukuphuma kodwa hhayi impendulo uzohluleka noma kunjalo.

Ukudluliswa kwembobo yokungena okuqinile akudingeki ngokuzenzakalela uma umuntu ogxile eqala futhi umhumushi egcina isimo. Kuba yisidingo lapho ukumephwa kungazinzile noma lapho okuthile endleleni kuphelelisa isimo ngolaka.

Thwebula ohlangothini olubili lomhumushi kanye; umehluko wokufakwa ngaphakathi kwesikhwama ubonakala ngokushesha.

Isinyathelo 5: hlukanisa ukuthutha kwangaphandle nokuhlela kwangaphakathi

Umhubhe osungulwayo ongathwali lutho uyinkinga yokuhlela, hhayi inkinga ye-NAT-T. Iziza zisadinga izikhethi zethrafikhi ezihambisanayo, izikhala zamakheli ezifanayo, imithetho yokufinyelela kanye nomzila wokubuya wamanethiwekhi ezinhlelo. Akukho kulokhu okunikezwa ukushintshana kwe-IKE okuphumelelayo.

Uma iziza ezimbili zisebenzisa izigaba eziyimfihlo ezigqagqanayo, ukuhumusha ngaphakathi komhubhe kuwudizayini ohlukile onemithetho yawo. Ungaphindi unikeze inombolo isubneti ngoba nje isango langaphandle liseduze komgwaqo wasekhaya.

Hlukanisa ukwehluleka ngesigaba ngaphambi kokushintsha noma yini, futhi gcina lokho kuhlukanisa kuthikithi ukuze umuntu olandelayo aqale lapho wena ugcine khona.