Cisco ASA kuya ku-Azure VPN: amapheya weziqalo zomkhethi wethrafikhi

Ithuneli liyaphuma, i-IKE ibonakala iphilile, kepha akukho okudlulayo kuyo. Lona uhlobo olujwayelekile lwenkinga yomkhethi we-ASA kuya ku-Azure, futhi yingakho ngibhala isivumelwano ngaphambi kokuthinta noma iyiphi ikhonsoli. Isivumelwano yizinto ezine: izinto ezikhomba i-peer ngayinye, imodeli yokuxhumana, amapheya weziqalo aqondile, kanye nokuqinisekisa okufakazela ipheya ngalinye. Uma wehluleka lapha, yonke imiyalo elandelayo izolungisa ukucushwa obekungafanele ukwakhe. Le runbook iwukulandelana engikusebenzisayo, kanye nemiyalo ekhombisa ukuthi iyiphi into eyiphutha ngempela.

Bhala izinto ezine ngaphambi kokucushwa

Qala ngokukhishwa nge-platifomu ye-ASA, i-endpoint yomphakathi, uhlobo ne-SKU yesango le-Azure VPN, kanye nesango lenethiwekhi yasendaweni elimele uhlangothi lwakho. Lawo magama amane ayisilulumagama sayo yonke into elandelayo, futhi ngalinye linomnikazi ohlukile lapho okuthile kwephuka.

Uma ezimbili zazo kusengimibono, yima. Uhlu lweziqalo olungalungile esangweni lenethiwekhi yasendaweni akulona inkinga yokulungisa.

Khetha imodeli eyodwa yokuxhumana futhi uyeke ukuhlanganisa amathempulethi

Idizayini ye-crypto map nedizayini ye-tunnel interface izilungiselelo ezihlukile, futhi ithempulethi yeyodwa ayibi semthethweni kwenye ngokuhlela ikheli le-peer. Bhala ukuthi iyiphi oyakhayo ngaphambi kokunamathisela noma yini, ngoba ukungafani kuvela kamuva njengenkinga yomkhethi hhayi njengephutha lokucushwa. Umhlahlandlela wokusebenzisana we-ASA ka-Microsoft uhlanganisa zombili izindlela futhi usho ukuthi iyiphi imodeli yesango le-Azure umuntu ngamunye ayicabangelayo. Uma amanothi akho engawusho umfanekiso, awukabi nayo idizayini.

Isango le-Azure elisekelwe emzileni elinezikhethi zethrafikhi ezisekelwe kunqubomgomo iyinketho ethile ebhaliwe, hhayi okuzenzakalelayo. Uma idizayini yakho incike kuyo, idizayini kufanele isho lokho, ngoba imodeli yomkhethi esekelwe emzileni ezenzakalelayo iziphatha ngendlela ehlukile ohlangothini lwe-Azure.

Imikhawulo yenguqulo nayo iyingxenye yesivumelwano. Umbiko wasendaweni wakudala mayelana nomkhawulo wezizinda zokubethela uyidatha mayelana nokukhishwa okuthile, akusona isici saphakade se-ASA ngayinye.

Bala amapheya weziqalo, hhayi ama-aggregate

Bhala i-matrix. Kusukela ku-A no-B basendaweni kuya ku-X no-Y e-Azure amapheya amane, futhi ipheya ngalinye lidinga ukumbozwa noma ukukhishwa okucacile. Ukuhlanganisa u-A no-B kube i-aggregate eyodwa kufaka nayo yonke into ephakathi kwabo, futhi yileyo ndlela idizayini ekhulisa imbobo ngokuthula.

Hlola lokho ama-peer akuxoxile, hhayi lokho okugcinile. Uhlu lwenethiwekhi yasendaweni neyakude ku-ASA luyinhloso; ama-CHILD SA ayumphumela.

Uma ipheya lingekho, ukulungisa ngokuvamile umugqa we-access-list noma ukufakwa komkhethi, hhayi ithuneli elisha.

Qinisekisa ngemiyalo ebiza into

Ku-ASA qinisekisa iseshini ye-IKE, bese kuba ama-SA e-IPsec, bese kuba amapheya omkhethi. Umyalo ngamunye uphendula umbuzo ohlukile, futhi ukusebenzisa owokuqala kuphela yikho okwenza «ithuneli liphume» kube isiphetho esingamanga. Funda okukhiphayo kwi-peer oyicushile ngempela, hhayi i-SA evele ibe ngeyokuqala ohlwini. Uhlangothi lwe-Azure luphendula imibuzo emithathu efanayo ngokombono walo.

show crypto ikev2 sa detailed
show crypto ipsec sa peer 203.0.113.10
show run access-list AZURE-SELECTORS
packet-tracer input inside icmp 10.1.10.10 8 0 10.2.20.20 detailed

Bese ubuza i-Azure ngesimo sokuxhumana nge-az network vpn-connection show --name <connection> --query connectionStatus. Ukuxhumana okunamabhayithi angu-zero emzileni wedatha inkinga yomkhethi, hhayi yomzila.

Hlola ukugeleza okukodwa okuvunyelwe ngepheya ngalinye, hlola ikheli lomthombo elibonakala ngaphesheya, futhi uzame insiza eyodwa obekufanele yenqatshwe. Ukuhlolwa kokugcina kuphela okufakazela ukuthi umngcele usekhona.

Hlukanisa ububanzi bokubethela nemvume yokufinyelela

Umkhethi obanzi akusona imvume. Uma isakhiwo esisekelwayo sibanzi kunequbomgomo yohlelo lokusebenza, gcina izinsizakalo ezincane emithethweni ye-firewall futhi ushiye ububanzi bokubethela lapho kufanele ube khona.

Imizila yomthwalo osebenza we-Azure nemizila yokubuya yasendaweni ibuyekezwa ngokwehlukana. Izimemezelo ze-BGP, ububanzi benethiwekhi obumile kanye nemizila echazwe umsebenzisi kufanele kuchaze umzila ofanayo, futhi akukho kuzo okungabamba ukuthuthwa kwe-peer ngokuphindaphinda.

Ukubuyiselwa emuva nobufakazi bokuthi kwasebenza

Gcina ukucushwa okusebenzayo kwangaphambilini ngaphambi kokushintsha izikhethi, futhi wazi umyalo owodwa owubuyiselayo. Ku-ASA lokho kusho ikhophi egciniwe kanye nomzila wokubuyisela ohambisanayo, hhayi inkumbulo yalokho okuhlele. Bhala umyalo wokubuyisela kuthikithi yoshintsho ngenkathi ushintsho luseyinganekwane. Bese uphinda usebenzise lokho kuhlolwa okuthathu: isimo se-IKE, amapheya e-SA e-IPsec, ukugeleza okukodwa okuvunyelwe ngepheya ngalinye.

Uma ipheya lihluleka namanje ngemuva kokubuyisela, ushintsho kwakungesona isizathu, futhi usanda kuzisindisa ekuphazamisekeni kwesibili.