Ukushintsha i-IP yomphakathi yesango le-VPN ye-Azure nokuhambisa ukubhalisela

Ku-Azure izinto ezintathu ezahlukene zibizwa ngekheli lesango. Ikheli langasese linikezwa lisuka ku-GatewaySubnet. Ikheli lomphakathi liyinsiza ye-IP yomphakathi ehlukile okukhonjwa kuyo ukuhlelwa kwe-IP kwesango. Ukubhalisela nendawo yamafu yisimo isigobho sakho esisisebenzisayo ukuthola enye yazo. Shintsha enye futhi ezinye ezimbili zihlala endaweni yazo, yingakho umsebenzi wamakheli uvame ukuma phakathi.

Ngenza lezi zinguquko ngezigaba ezine: ukuhlunga izinto, isinqumo sokuthi i-IP yomphakathi iyahamba esangweni elikhona noma isango lakhiwe kabusha, ukusebenzisa ushintsho ngenkathi ikheli elidala lisemva kwesandla, bese uqinisekisa umgudu ngamunye kusuka kuzinhlangothi zombili ngaphambi kokususa noma yini. Isigaba abantu abasishiyayo ukuhlunga.

Iyiphi kwezinto ezintathu oyishintshayo ngempela

Qamba into ngaphambi kokuvula ingosi. Isango le-VPN lithatha ikheli langasese lisuka kunethiwekhi engaphansi okumele ibizwe ngokuthi GatewaySubnet ngqo, futhi i-Azure iyabela isuka kuleso siqalo; akukho nkambu evamile yokuyigxilisa. Ikheli libonakala lizinze kuphela ngoba inethiwekhi engaphansi izinzile. Shintsha ikheli lenethiwekhi engaphansi noma yakha isango kabusha futhi lihamba nayo.

Ikheli lomphakathi liyashintshwa, kodwa imithetho ye-SKU inquma ukuthi ushintsho lusemthethweni yini. Isango le-Basic lihambisana ne-IP yomphakathi eguquguqukayo ye-Basic, ama-SKU e-VpnGw adinga i-Standard ezinzile, futhi isango eliphindwe kabili ngezindawo lidinga i-IP yomphakathi ye-Standard enezindawo ezifanayo. I-SKU engalungile iyenqatshwa ngaphambi kokuba umgudu uwe.

Ukuhlunga ngaphambi kokuba kuhamba noma yini

Qinisekisa ukubhalisela kuqala, ngoba ngaphandle kwako ukuhlunga okusele akunasisekelo. Rekhoda isango, ukuhlelwa kwalo kwe-IP kanye nakho konke ukuxhumana okuphela kulo, futhi gcina umphumela eceleni kwerekhodi loshintsho.

Get-AzContext | Select-Object Subscription, Tenant, Environment
Get-AzVirtualNetworkGateway -ResourceGroupName rg-hub -Name gw-hub |
  Select-Object Name, Sku, EnableActiveActive, IpConfigurations
Get-AzVirtualNetworkGatewayConnection -ResourceGroupName rg-hub |
  Select-Object Name, ConnectionStatus, ConnectionType

Ama-ID ezinsiza abaluleke ukudlula amagama. Ukuxhumana kubamba izikhombo zesango kanye nesango lenethiwekhi yasendaweni, futhi lawo ma-ID avela kuma-script, izexwayiso nokwabiwa kwemigomo okungekho muntu okukhumbulayo. Bhala futhi okungaphandle kwe-Azure: igama le-DNS eliholela ekhelini, uhlu lwezimvume zomlingani, kanye ne-firewall yegatsha ebopha i-IP endala.

Ukushintsha i-IP yomphakathi esangweni elisebenzayo

Qala ngokwakha ikheli elishintshayo esifundeni esifanayo nangeqoqo lezindawo elihambisana nesango, bese ushiya insiza endala endaweni yayo. Bese wakha kabusha ukuhlelwa kwe-IP futhi uthumele ukubuyekezwa ngocingo olulodwa. Lolo cingo lushintsha lonke iqoqo lokuhlelwa, ngakho isango elisebenza ngamabili lidinga kokubili, uma kungenjalo uhlala nomgudu owodwa futhi ulahlekelwe omunye.

$gw = Get-AzVirtualNetworkGateway -ResourceGroupName rg-hub -Name gw-hub
$pip = New-AzPublicIpAddress -Name pip-gw-hub-2 -ResourceGroupName rg-hub `
  -Location westeurope -AllocationMethod Static -Sku Standard
$conf = New-AzVirtualNetworkGatewayIpConfig -Name gwipconfig1 `
  -SubnetId $gw.IpConfigurations[0].Subnet.Id -PublicIpAddressId $pip.Id
Set-AzVirtualNetworkGateway -VirtualNetworkGateway $gw -IpConfigurations $conf

Imigudu iya kuwa ngenkathi isango lilungiselelwa kabusha. Uhlangothi olukude ludinga ishejuli: i-firewall yomlingani iqhubeka inikeza ikheli elidala kuze kube umuntu uyilungisa, futhi ukuxhumana okulindelwe yi-IP yangaphambilini kuhlala phansi kungakhathaliseki ukuthi i-Azure ibukeka iphilile kangakanani. Yehlisa i-TTL ye-DNS ngaphambi kwewindi.

Amakhasimende e-point-to-site adinga iphrofayili entsha, ngoba iphakethe elandisiwe lihamba nephoyinti lokugcina. Igama le-DNS elenziwe ngokwezifiso phambi kwesango likusindisa ekusatshisweni kabusha: gcina igama, shintsha irekhodi.

Ukuhambisa isango kwelinye ukubhalisela

Ukuhambisa izinsiza kuhambisa iqoqo, futhi isango lodwa liyilungu lalo elingasizi kakhulu. Inethiwekhi ebonakalayo, izinsiza ze-IP yomphakathi, amasango enethiwekhi yasendaweni kanye nokuxhumana kuhamba ndawonye ngoba ngakunye kubamba isikhombo kwesinye. Ukubhalisela okuyiwa kukho kufanele kube sendaweni efanayo, i-Microsoft.Network kufanele ibhaliswe lapho, futhi udinga ukufinyelela kokubhala kuzinhlangothi zombili.

Ukuqinisekisa kusebenza ngaphambi kwanoma yiluphi ushintsho, ngakho ukuhambisa okunqatshiwe kushiya izinsiza endaweni yazo. Yingakho ukuhambisa kufanele kuzanywe ngaphambi kokwakha kabusha: ukuhambisa okuphumelelayo kuhamba ne-IP yomphakathi, ngakho abalingani kanye nohlu lwezimvume kuqhubeka kusebenza, kanti isango elakhiwe kabusha alivamisile ukubuyisela ikheli elifanayo.

az resource move --destination-group rg-hub `
  --destination-subscription-id 00000000-0000-0000-0000-000000000000 `
  --ids /subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-hub/providers/Microsoft.Network/virtualNetworkGateways/gw-hub

Funda ukwehluleka kokuqinisekisa esikhundleni sokuphinda. Izimbangela ezijwayelekile ukuncika okushiywe ngemuva, uhlobo lwensiza olungeke luhambiswe, noma ukukhiya kwelinye lamaqembu ezinsiza. Uma ukuhambisa kungenzeki, yakha kabusha kokuqondisiwe bese ushintshela: qinisekisa umzila nokuqinisekisa umuntu kusuka kunethiwekhi engaphansi yokuhlola, misa ukuxhumana okudala esikhundleni kokukususa, bese ususa indlela endala kuwindi elizayo.

Uma isango libonakala lingekho, hlola isimo

Iphutha lokungatholakali ngokuvamile iyiphutha lobubanzi. I-akhawunti enezinto zokubhalisela eziningi ikhomba i-cmdlet kwelilodwa elingalungile, futhi umlayezo usola insiza. Kunalokho sesha into nge-ID yayo ephelele yensiza: i-ID ihamba nokubhalisela kwayo, ngakho uma ixazululwa, akukho okungekho futhi isimo sakho esizenzakalelayo asilungile.

Okunye ukungafani okubili kufundwa ngendlela efanayo. Isango lamafu ezentengiselwano alikho esikhathini esiqondiswe endaweni kahulumeni noma yaseChina, futhi izinguqulo zama-module amadala zigejile izimo zezinsiza i-API esezivele izibuyisela. Gxilisa ukubhalisela, fanisa indawo, bese uvula icala.

Set-AzContext -SubscriptionId 11111111-1111-1111-1111-111111111111
Get-AzResource -ResourceId /subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-hub/providers/Microsoft.Network/virtualNetworkGateways/gw-hub

Qinisekisa kuzinhlangothi zombili ngaphambi kokuhlanza

Ukuxhunyiwe kuyisimo, hhayi ubufakazi. Hlola isimo somgudu ngakunye ukuxhumana, isimo se-BGP uma usebenzisa umzila oguquguqukayo, kanye nemizila esebenzayo kunethiwekhi engaphansi yomsebenzi. Bese udlulisa isicelo sangempela ngohlelo oluncike emgudwini. Ukuxhumana kungabika ukuthi kuxhunyiwe ngenkathi isiqalo osidingayo singekho kuthebula lemizila.

Get-AzVirtualNetworkGatewayBGPPeerStatus -VirtualNetworkGatewayName gw-hub -ResourceGroupName rg-hub
Get-AzEffectiveRouteTable -NetworkInterfaceName nic-app -ResourceGroupName rg-app

Gcina i-IP yomphakathi endala ingaxhunyiwe esikhundleni sokuphindwa kususwa kuze kuvalwe iwindi lokubuyela emuva, futhi bhala izinguquko zomlingani ne-firewall ukuze zibuyiselwe ngokulandelana.

• Isimo sigxilisiwe ekubhaliseleni okungumnikazi wesango
• I-IP yomphakathi endala igciniwe, ukuncika kwayo kubhaliwe
• Konke ukuxhumana kuluhlaza futhi kunesicelo esisodwa sangempela
• Abasebenzisi be-point-to-site badluliselwe kwiphrofayili ebuyekeziwe
• Irekhodi le-DNS lishintshiwe futhi inani langaphambilini lirekhodiwe