Shintsha ikheli le-peer ye-IPsec ku-ASA ngaphandle kokuphula i-tunnel
Ukuhambisa ikheli le-peer kuthinta uhlu lwezicelo, ukufana kwephrofayela, i-underlay namaseshini asebenzayo. Landela uhlu lokuhlola ngokulandelana.
Ushintsho lwekheli le-peer lubukeka njengomugqa owodwa, kodwa luziphatha njengokufuduka. Okunyakazayo ngempela iqoqo lezinto: uhlu lwezicelo ze-peer ku-crypto map, iphrofayela noma imephu yokuqinisekisa ekwazi ukuphela okude,i-underlay efinyelela kukho, kanye nokuxhumana okusebenzayo okwakhiwe ngamavelu amadala. Thatha ukuhlelwa kwesimo njengokugcina kwaleqoqo, hhayi okokuqala.
1. Bhala isimo samanje ngaphambi kokuthinta noma yini
Qala ngohlu oluphelele lwezicelo lwangokufakwa kwe-crypto-map efanele, ngokulandelana, hhayi ngekheli ocabanga ukuthi liyasetshenziswa kuphela. Ukulandelana kubalulekile ngoba yikho okuzanywayo yidivayisi.
Kubhale nge-show run crypto mapbese ufunda okufakwayo okusebenzayo nge-show crypto map, bese ugcina kokubili okukhiphayo eceleni kwevelu elisha elihleliwe. Bhala futhi ukuthi iyiphi i-peer eyakhethwa ukuxhumana ngakunye okukhona, ngesikhathi ulapho.
Yenza okufanayo esigabeni samaseshini, usebenzisashow vpn-sessiondb l2lkanyeshow crypto ipsec sa peer <old-address>. Lokho okukhiphayo okubili isithombe sakho sangaphambi lapho umuntu ebuza ukuthi kungani i-tunnel yawa ngo-02:10.
2. Bonisa ukuthi i-peer entsha iyafinyeleleka ngaphansi kwenqubomgomo efanayo
Bonisa ukufinyeleleka ngaphambi kokuhlela ukushintsha. Ukugijima kwe-packet-tracerkusuka kusixhumi sangaphakathi siya kunethiwekhi evikelwe ye-peer entsha kukhombisa ukuthi ukuhamba kwedatha, ukukhululwa kwe-NAT nenqubomgomo yokufinyelela ziyavumelana. Bese uqinisekisa indlela yokuthutha, ngoba i-IKE ne-IPsec zidinga i-UDP 500 ne-4500 ukuze zidlule noma yisiphi isihlungi phakathi kwamasango. I-ping ephumelelayo ayibonisi lutho kwalokho iyodwa.
Uma i-underlay idinga umzila noma ushintsho lokuhumusha, lokho kuwushintsho lwesibili olunobungozi bwayo. Hlanganisa esikhaleni esifanayo noma uhlele ngokwehlukana, kodwa ncika ukuthi yikuphi, esikhundleni kokukuthola phakathi nokushintsha.
3. Hambisa imephu yephrofayela, hhayi ikheli kuphela
Ukukhethwa kwe-peer nokukhethwa kwephrofayela kungukusesha okubili okuhlukene. Iphrofayela yoxhumano lwe-LAN-to-LAN igcina izimiso ezijwayelekile futhi ingafana ngekheli, ubunikazi besitifiketi noma igama leqembu. Ukushintsha i-IP akushintshi ukuthi iyiphi iphrofayela efanayo uma iphrofayela isekelwe kusihloko sesitifiketi.
| Into | Kuboshelwe kukho | Ikheli le-peer elisha lithinta ini |
|---|---|---|
| Uhlu lwezicelo lwe-crypto map | Okufakwayo kwe-peer okuhleliwe kanye nokulandelana kwakho | Lapho i-ASA ithumela khona amaphakethe ayo okuqala |
| Iphrofayela yoxhumano | Ikheli, ubunikazi besitifiketi noma iqembu | Amaphrofayela aboshelwe ekhelini kuphela |
| Iziqalo ezivikelwe | Izinto zenethiwekhi zasendaweni nezikude | Lutho, ngaphandle uma nawe uzishintsha |
Gcina isivumelwano sobufakazi singashintshiwe. Ukushintsha ikheli akusona isizathu sokukhulula ukuhlolwa kobunikazi, futhi akusona isizathu sokunamathisela i-pre-shared key yesibonelo kwithikithi.
4. Qapha amaseshini asebenzayo ngesikhathi kukhona zombili izicelo
Ngesikhathi womabili amakheli akuhlu lwezicelo, ncika ngokubhaliwe ukuthi elidala liyisipele noma insalela. Isimo esiqukethe kokubili sivumelekile, futhi asibonisi lutho ngokuthi iyiphi i-peer eyathwala iseshini yokugcina.
Hlanza ukuxhumana kokuphepha okudlule ngesikhathi kuphela ngendlela ekhawulelwe nge-peer yokukhishwa kwakho,clear crypto ipsec sa peer <address>, futhi ulindele ukuthi ama-tunnel athintekile axoxisane kabusha. Ukusetha kabusha komhlaba wonke kuwisa wonke amaseshini kudivayisi futhi ngeke kuxolelwe ngesikhathi somsebenzi.
Bese udlulisa ukuhamba kohlelo lokusebenza kwangempela kusuka kusibungu esivikelwe futhi uqinisekise ukuthi impendulo ibuya ngendawo yokugcina ehlosiwe.show vpn-sessiondb l2lkufanele ibale i-peer entsha yalowo seshini, futhi izibali zamabhayithi kufanele zinyakaze.
5. Qeda noma buyisela emuva
Bhala ukubuyisela emuva ngaphambi koshintsho: uhlu lwezicelo oludala, imephu yephrofayela endala nokufakwayo kwe-underlay endala. Gcina indlela yokuphatha ezimele eya ku-ASA, ngoba ukuhlelwa kwekheli le-peer okukuthatha nokufinyelela kwakho ubusuku obude. Susa i-peer edlule nokufakazi kuphela ngemuva kokwamukelwa nangemuva kokubhalwa kwesinqumo sesipele. Qinisekisa futhi ukuthi inqubomgomo yokufinyelela kumanethiwekhi avikelwe ayizange ishelele.
Ukufuduka kuqedwa lapho i-peer ehlosiwe iziqinisekisa futhi ithwala insizakalo edingekayo ngaphansi kwenqubomgomo egciniwe. Ikheli elisha kusimo esisebenzayo liwubufakazi bokuthayipha, hhayi lokuphumelela.