Iroute eyisisekelo ye-tunneled ku-Cisco ASA: isebenza nini ngempela

Umsebenzisi wokufinyelela kude akafinyeleli lutho ngale kwe-ASA kuyilapho leyo seva isaphendula kuma-ping avela ku-LAN yangaphakathi. I-tunnel iyakhuphuka, iklayenti lithola ikheli elivela ku-pool, futhi iphakethe lisaphuma nge-default yase-inthanethi noma liyanyamalala. Leli phethini ngokuvamile lisho ukuthi ithrafikhi edekhodiwe ayitholanga indlela yayo futhi yawela ku-default evamile. Ukulungisa akusona omunye umthetho we-NAT; ukulungisa i-default route ye-tunneled.

Qala ngesibonakaliso, hhayi ngokucushwa

Bheka lapho iphakethe liya khona, hhayi lapho ubulindele ukuthi liye khona. Ukubamba iphakethe ku-interface yangaphandle phakathi nesikhathi somhlangano ohlulekile kubonisa iphakethe elidekhodiwe libheke egcekeni le-ISP nekhasi le-pool lisaqinile, noma akubonisi lutho ngoba ukusesha kwehlulekile. Kuzo zombili izimo i-tunnel ayiyona inkinga.

I-tunnel ibonakala iphilile ku-show vpn-sessiondb, futhi yikho kanye esikwenza abantu baqhubeke nokuxazulula i-IKE.

Okwehlukanisa lokhu nokudilizwa kwe-ACL ukuqondiswa. Ukudilizwa kwe-ACL kuyabhalwa futhi kubalwe, kuyilapho indlela engekho idala ukwehluleka kokusesha ngaphandle kombhalo ofanayo. Sebenzisa i-show route iye endaweni yeklayenti futhi ufunde ukuthi i-ASA ikhethe ini ngempela, kubandakanya nokuthi i-default route ikhethiwe yini nokuthi iyiphi.

Ukusesha kwe-tunneled kuhluke kanjani

Umhlahlandlela we-Cisco we-static routing ku-ASA 9.23 ubalula i-default route ehlukile yethrafikhi ye-VPN edekhodiwe engenayo indlela emile noma efundiwe. Igama elingukhiye elithi tunneled likhomba leyo ndlela, ngakho iphakethe elidekhodiwe lingawela kwenye i-hop elandelayo ehlukile kunaleya esetshenziswa yi-ASA ekuthwaleni kwayo. Izindlela ezicacile kakhulu zisawina, yikho kanye iklayenti lingafinyelela ku-10.0.0.0/8 ngokusebenzisa igceke langaphakathi bese lilahlekelwa yikho konke okunye.

Ukuhlelwa okuncane kugcina ama-default amabili anama-hop alandelayo ahlukene. Elinye lithwala ithrafikhi ye-ASA uqobo, elinye lithwala ithrafikhi edekhodiwe engenayo indlela engcono. Womabili ama-hop alandelayo kusamele afinyeleleke ku-interface owanamathisela kuyo.

route outside 0.0.0.0 0.0.0.0 198.51.100.1
route outside 0.0.0.0 0.0.0.0 10.20.30.1 tunneled

Uma womabili ama-default akhomba ku-hop elandelayo efanayo, igama elingukhiye alishintshi lutho futhi isibonakaliso ngeke sinyakaze.

Imikhawulo enquma ukuthi kuzosebenza yini

Umhlahlandlela ofanayo uvumela i-default route eyodwa kuphela ye-tunneled futhi uthi i-ECMP ayisekelwe kuyo, ngakho awukwazi ukwabela umthwalo kuleyo ndlela. Ibalula futhi imikhawulo ephathelene nokulandelelwa kwezindlela, ukuqinisekiswa kwendlela yokubuyela, kanye nokunye ukugeleza kokuhlola nokuphatha. Zifunde ngokuqhathanisa nokukhishwa okufakiwe kuphakethe lakho ngaphambi kokuklama mayelana nalesi sici. Ukuklama okungazinaki ngokuvamile kwehla endaweni eyodwa ethile hhayi yonke indawo, futhi yikho isibonakaliso sibonakala siza siphuma siphinde sibuye.

Ukuqinisekiswa kwendlela yokubuyela yikho okuluma emiklamweni engalingani. Uma impendulo izofika nge-interface ehlukile kunaleya elindelwe yi-ASA, iphakethe liyaphonswa ngaphambi kokuba ukuhlela indlela kube nencazelo. Lungisa isakhiwo noma indlela yokubuyela esikhundleni sokucisha ukuqinisekisa ukuze uphoqelele i-hop elandelayo.

Ukulandelelwa kwezindlela kuwugibe olwahlukile: into elandelelwayo ngokuvamile igada i-default evamile, hhayi leyo ye-tunneled.

Okungakwenzi yigama elingukhiye

Alikhethi ikheli lomthombo elisetshenziswa yi-ASA ukwakha i-IKE. Iphoyinti lokugcina le-tunnel langaphandle lilandela ukukhethwa kwe-interface nomthombo kwepulatifomu uqobo, futhi i-default route ye-tunneled ayinayo ingxenye kuleso sinqumo. Ukushintsha kwayo ngeke kulungise i-phase 1 eqala ekhelini elingalungile.

Futhi akwenzi i-hop elandelayo ibe i-proxy. Uma indawo ilindele ukushintshana nge-HTTP CONNECT, ukuthumela amaphakethe e-IP aluhlaza ku-host ye-proxy kukusa ku-host engawazisi lawo maphakethe. Esikhundleni salokho lungiselela indlela ye-proxy esekelwa iklayenti.

Futhi akudali ukudluliswa okuya phansi. Igceke olibhekisayo lisadinga indlela ebuyela ku-pool ye-VPN, kanye nokuhunyushwa komthombo lapho ukuklama kukufuna khona.

Qinisekisa indlela kusukela ekuqaleni kuze kube sekupheleni

Lapho indlela isibekiwe, hlola izinto ezine ngokulandelana: i-show route yendawo edingwa yi-pool, ukubamba iphakethe ku-interface ebheke ku-hop entsha elandelayo, ukubamba iphakethe egcekeni uqobo, kanye nendlela yokubuyela isuka kulelo gceke iya ekhelini le-pool. Ezimbili zokuqala zifakazela ukuthi i-ASA ikhethe leyo ndlela, kanti ezimbili zokugcina zifakazela ukuthi ukhona ophendulayo kuyo.

Uma igceke liphendula kodwa iklayenti lingaliboni impendulo, bheka ukuhunyushwa komthombo nendlela yokubuyela ngaphambi kokuthinta ithebula lezindlela futhi.

Bhala phansi ukukhishwa okuqinisekise kukho, ngoba uhlu lwemikhawulo luncike kunguqulo futhi ukuklama okusebenza kolunye uhlobo kungadinga enye indlela kolunye. Lowo mbhalo uhlala isikhathi eside kunesiqeshana sokucushwa.