I-NAT ye-Azure VPN ayixazululi amakheli e-VNet angenelana
Ama-VNet amabili anebanga elifanayo langasese awasoze axhumane ngenxa nje yokuthi i-NAT ikhona. Hlola uhlobo lokuxhumana kuqala, bese uphinda inombolo noma ube ngumnikazi wegama lesiteketiso lokuhumusha.
Womabili ama-VNet asebenzisa i-10.40.1.0/24, amathumbu ayaphuma, futhi akukho okusebenzayo. Ukwengeza isango lesibili le-VPN akukushintshi lokho, futhi nomkhawulo womzila ophansi awukushintshi, ngoba inkinga ayikho ekukhetheni umzila. Imisebenzi emibili ephendula ikheli elifanayo langasese ishiya iphakethe ngalinye linendawo engacacile kanye nomzila wokubuya ongaqinisekiseki. Ngaphambi kokuhlela noma yikuphi ukuhumusha, thola ukuthi hlobo luni lokuxhumana olwakha ngempela, ngoba lokho kukhetha okukodwa kunquma ukuthi isici se-NAT se-Azure sikhona nhlobo yini.
Lokhu kubonakala kukutshelani ngempela
Lapho isiphathi esikwi-VNet A sithumela ku-10.40.1.10, ithebula lomzila lingakukhombisa endaweni ethile kuphela. Uma i-VNet B nayo iqukethe i-10.40.1.10, lelo kheli akuyona indawo ithebula elingayihlukanisa; likheli elilodwa elinabanikazi ababili.
Isango lesibili abantu abajwayele ukulisebenzisa alisizi. Likunikeza omunye umhubhe, hhayi elinye ikheli, futhi ibanga eliphindwe kabili lihamba ngaphakathi komhubhe lingashintshile. Liphindaphinda nokuhleleka okufanele ukugcine kufana. Engakwazi ukukwenza ukwenza ikheli elilodwa lisho iziphathi ezimbili.
Ukushintsha amakheli omphakathi ozakwabo be-VPN nakho akwenzi lutho. Lawo makheli akhomba iziphetho zomhubhe, kuyilapho ukungqubuzana kusebangeni langasese elithwalwa ngaphakathi.
Uhlobo lokuxhumana lunquma ukuthi i-NAT iyatholakala yini
I-Azure VPN Gateway inekhono le-NAT ngempela, futhi kuchazwe emibhalweni yokuxhumana kwe-IPsec phakathi kwezindawo okusekelwe emizileni kuma-SKU esango athile. Umbhalo ofanayo awubandakanyi ukuxhumana kwe-VNet-to-VNet kanye ne-point-to-site, ngakho lesi sici akusona isikhwama sokuhlola esivela kubo bonke ubudlelwano besango.
| Connection type | NAT support | Overlap workaround |
|---|---|---|
| Site-to-Site (route-based IPsec, documented SKUs) | Supported with configured NAT rules | Translate the range in the rules |
VNet-to-VNet (Vnet2Vnet) | Not supported | Renumber, or redesign as a site-to-site connection |
| Point-to-site | Not supported | Choose client address pools that do not collide |
I-VNet-to-VNet yendabuko nayo idinga ukuthi amabanga e-VNet kanye nenethiwekhi yasendaweni angangeneleli kusukela ekuqaleni, okuhambisana nalokhu kukhishwa. Ukuhlangana kwe-VNet nakho akusona isixazululo sokungenelana ngesizathu esifanayo.
Kukhona enye indlela esekelwayo abantu abayihlanganisa nohlobo lwendabuko: yenza i-VNet enye ibe yinethiwekhi yasendaweni bese uyixhuma njengokuxhumana kwesiza-nesiza. Leyo ingcebo ehlukile nokuklama okuhlukile, ngakho thatha ukuxhumana okuqanjwe kabusha njengoshintsho oludinga ukuqinisekiswa, hhayi njengokushintsha kwegama nje.
Phinda inombolo, noma humusha ngento engumnikazi we-alias
Uma womabili ama-VNet kungawenu, qhathanisa ukuhlelwa kabusha kwenombolo nezindleko eziqhubekayo zokuhumusha. Ukuhlelwa kabusha kwenombolo kuthinta ukuhleleka kohlelo lokusebenza, amarekhodi e-DNS, imithetho yezokuphepha kanye nakho konke ukuxhumana okukhona, kodwa kusala inethiwekhi efundeka ngokujwayelekile ngemva kwalokho. Kwenze kube yisifunda esisodwa ngesikhathi, ukushintsha kwe-DNS kube kokugcina. Ibanga elihlelwe kabusha ingxenye libi kunazo zombili izinqumo, ngoba lapho iziqalo zombili zibonakala zinegunya kulowo ofunda ithebula ngokulandelayo.
Lapho ukuhlelwa kabusha kungenakwenzeka, sebenzisa ukuklama okuhunyushiwe okunomnini wangempela we-alias. Abafoni abakwi-VNet A bangase bafinyelele i-10.40.1.10 ye-VNet B njenge-10.140.1.10, kodwa leyo alias idinga idivayisi ehumushayo, umzila oya kuyo kanye nokuziphatha okuhambisanayo kwimpendulo. Ikheli elengezwe ku-DNS kuphela akulona ukuhumusha.
Bhala womabili amabanga kuzo zombili izinhlangothi: lokho umfoni akushayayo, lokho indawo ekubonayo njengomthombo, kanye nokuthi yiluphi uhlangothi olungaqala. Imithetho ye-NAT ye-Azure ngokwayo ihlanganisa ukuhumusha okuphambene kokwabiwa kwayo kwe-SNAT, ngakho awubhali umthetho we-DNAT ohambisanayo ngesandla, kodwa lokho kulula kuphela ezinhlotsheni zokuxhumana ezisekelwa yilesi sici.
Okungeke kusebenze
Umzila ochazwe umsebenzisi noma umkhawulo womzila awukwazi ukwakha umehluko wekheli ongekho. Kokubili kusebenza endaweni engacacile, futhi iphakethe lifika esinyathelweni esilandelayo ithebula elikukhethayo.
Ukwengeza ibanga eliphindwe kabili kuthebula lomzila njengesiqalo esicace kakhulu kuhambisa kuphela ukungacaci isinyathelo esisodwa. Futhi kuvame ukwephula olunye uhlangothi, lapho impendulo inemithombo emibili ekholakalayo manje.
Yamukela ukuklama ngethrafikhi kuzo zombili izinhlangothi
Fakazela ukuklama ngokusebenza okusha okuvunyelwe okuvela ohlangothini ngalunye, hhayi ngesimo somhubhe. Umhubhe we-IPsec oxhunyiwe uthi ozakwabo bayavumelana ngokubethela; awusho lutho ngokuthi izindawo ziye zahlukaniseka yini.
Bese ugijima imizila enqatshiwe: ikheli okufanele lihlale lingafinyeleleki, kanye nensizakalo umgomo okufanele uyivimbe. Uma kokubili kusaphumelela, ukuhumusha kubanzi kunalokho obekuhlosiwe ukuklama.
Vala ngamaqiniso azochaza ukusethwa kamuva: ibanga lokuqala, ibanga elilethiwe, idivayisi ehumushayo, kanye nendlela uhlangothi ngalunye olungaqala ngayo. Uma okukodwa kwalokho kungena, unjiniyela olandelayo uzuza inethiwekhi lapho iziphathi ezimbili zabelana ngegama futhi akekho okhumbula ukuthi kungani esisodwa sazo siphendula.