I-UDR ye-Azure eya esangweni le-VPN: indawo eyodwa, hhayi konke okuphumayo

Khombisa isiqalo esisodwa se-Azure esangweni le-VPN ngaphandle kokuhambisa konke okuphumayo. Funda imizila esebenzayo, hlanganisa isizinda somthwalo womsebenzi, bese uqeda indlela yokubuya.

Unega uhambo oluchazwe umsebenzisi lwengxenye eyodwa yangaphandle, ulubhekisa esangweni le-VPN, futhi ithrafikhi isaphuma ngendlela ye-inthanethi ye-Azure. Noma iphuma ngendlela efanele futhi impendulo ayibuyi. Imiphumela yomibili ivela ephutheni elilodwa: ukuthatha igxathu elilandelayo le-Azure njengayo yonke idizayini. Ithebula lemizila linquma kuphela ukuthi iphakethe likhipha ngawuphi umnyango ngaphakathi kwe-Azure. Okwenzeka ngayo ngemva komhubhe, nokuthi impendulo ibuyiswa kanjani, yingxenye yesibili okufanele uyokhe.

Igxathu elilandelayo isango, hhayi i-IP yedivayisi

I-UDR ithumela isiqalo esihambisanayo kuhlobo lwegxathu elilandelayo, futhi i-VirtualNetworkGateway wuhlobo, hhayi ikheli. Abantu banamathisela i-IP yangasese yesango emzileni we-VirtualAppliance bese bezibuza ukuthi kungani lutho lungahambisani, ngoba lolo hlobo lulindele i-NIC noma isibhalansi somthwalo sangaphakathi. Imibhalo kaMicrosoft yokuhamba kwemizila nayo ikhawulela igxathu elilandelayo lesango kunethiwekhi ebonakalayo enesango eliyisango le-VPN. I-ExpressRoute, i-Route Server kanye nehabhu ye-Virtual WAN azikhonjwa yilelo khetho.

Hlola ukuthi inethiwekhi ebonakalayo inakho ngempela yini ngaphambi kokubhala umzila. Uma idizayini ihamba ngehabhu, umzila ungowomnikazi wokuhamba walehabhu, hhayi owesigaba osihlelayo.

Funda umzila osebenzayo ngaphambi kokushintsha noma yini

I-Azure ihlanganisa imizila yesistimu, iziqalo ezifundwe nge-BGP kanye nama-UDR etafuleni lemizila elisebenzayo nge-NIC ngayinye, futhi isiqalo esihambisanayo eside kunazo zonke siyawina kungakhathaliseki ukuthi sivelaphi. Ngesiqalo esifanayo, i-UDR iyahlula umzila we-BGP. Yilowo hlelo olwenza i-UDR endala evela ekuhloleni kwangaphambili ikwazi ukweqa buthule isiqalo osanda kusifunda ngomhubhe.

Bheka ithebula elisebenzayo kuqala, bese unquma ukuthi wengeza umzila noma ushintsha owodwa:

az network nic show-effective-route-table \
  --resource-group rg-net --name vm-web-nic -o table

Funda futhi ikholomu yomthombo, hhayi isiqalo kuphela. Umzila onesiqalo esifanele nomthombo ongafanele ukutshela ukuthi iyiphi into okufanele uyihlele, futhi kukusindisa ekwengezeni umzila wesibili ohlulwa owokuqala.

Bhala umzila ngokwesiqalo sangempela nangesizinda sangempela

Sebenzisa isiqalo sangempela sendawo, esithathwe kusebhisi osifinyelela ngempela, esikhundleni sobubanzi bomphakathi obukotshwe embhalweni weforamu. Qala ngesebhisi esisodwa esigunyaziwe ngaphambi kokucabanga ngomzila ozenzakalelayo ohambisa konke okuphumayo. Bese uhlanganisa ithebula lemizila nesizinda somthwalo womsebenzi. Isizinda sesango sinezidingo saso, futhi ukuhlanganisa ithebula lakho lapho kwephula isango esikhundleni sokuqondisa umthwalo.

Dala umzila, bese uhlanganisa ithebula nesizinda esigcina umthwalo womsebenzi:

az network route-table route create --resource-group rg-net --route-table-name rt-egress \
  --name to-partner --address-prefix 203.0.113.0/24 --next-hop-type VirtualNetworkGateway
az network vnet subnet update --resource-group rg-net --vnet-name vnet-app \
  --name snet-web --route-table rt-egress

Ukusakazeka nakho kubalulekile. Uma ukusakazeka kwe-BGP kunikwe amandla kulelo thebula, iziqalo ezifundiwe zivela eceleni kweziqalo ozibhalile, futhi isiqalo esifundiwe esicacile singahlula i-UDR ebanzi. Khubaza ukusakazeka kuphela lapho ufuna ukuthi isethi ye-UDR ibe negunya kuleso sizinda.

Qeda ingxenye yasekhaya kungenjalo ukugeleza kuyofa lapho

Isango lasekhaya kufanele lamukele umthombo we-Azure, liwudlulisele endaweni futhi livumele uhlelo lokusebenza. Umzila walo olandelayo ungaba ukuphuma kwe-inthanethi noma elinye igxathu langasese, kodwa leso sinqumo singesohlelo, hhayi ithebula lemizila le-Azure. Ukwehluleka okuvamile ukuwukubuya. Indawo ye-inthanethi ngeke iqondise umthombo wangasese we-Azure ukubuyela kuwe, ngakho impendulo iya esangweni layo elizenzakalelayo futhi ife, noma ingaphumi nakancane.

Izindlela ezimbili zixazulula lokhu futhi azikwazi ukushintshana. Humusha umthombo lapho kuphuma khona, ukuze indawo iphendule ikheli lomphakathi eliphethwe inethiwekhi yasekhaya. Noma gcina umthombo futhi wakhe ubudlelwano bokubuya obuqondisiwe ukuze izimpendulo zibuye ngomhubhe. Khetha eyodwa bese ubhala ukuthi uhlelo luzobona liphi ikheli.

Izinqumo kanye nohlu lwezimvume zehlukene kukho konke lokhu. Ukukhetha igxathu elilandelayo le-Azure akukukhulisi izinqumo zethrafikhi ye-VPN, futhi akushintshi uhlu lwemithombo evunyelwe yesevisi yangaphandle.

Qinisekisa ngomthombo obonwa yindawo

Thumela isicelo kusuka kumthwalo womsebenzi wangempela hhayi kusuka kumsingathi wokugxuma kwesinye isizinda, bese ufunda ikheli lomthombo elibonwe yindawo. Lelo nani elilodwa likutshela ukuthi iyiphi kwezindlela ezimbili zokubuya ekhona. Bese uhlola indlela yempendulo, futhi uqinisekise ukuthi ithrafikhi evamile yokuphatha eya ku-VM isasebenza, ngoba umzila ozenzakalelayo owengezwe ngephutha ubonakala njengesikhathi se-SSH esiphukile ngaphambi kakhulu kokubonakala njengohlelo olwephukile.

Ukudlula ngesiqalo esikhethiwe kuwushintsho oluncane kakhulu kunomhubhe ophoqelelwe. Gcina uncane futhi ukuhoxa kuwukususa umzila owodwa.

Izihloko ezihlobene