Imikhawulo ye-Cloud VPN ongakwazi ukuyilungisa: isikhathi se-IKE ne-NAT ye-peer

Nika idivayisi ekude isikhathi sesigaba 1 samahora angu-24 futhi umhubhe we-Cloud VPN uzohlala phansi, ngisho nakuba konke ohlangothini lwe-Google kuhlelwe kahle. I-peer iphakamisa inani i-responder engayikwamukela, ngakho ukuxoxisana kwehluleka ngokuphelele noma kuqale kabusha ngokungapheli. I-Cloud VPN ibeka isigaba 1 kumasekhondi angu-36,000, okungamahora ayishumi, futhi lowo mkhawulo awusona isilungiselelo ongasikhuphula. Ushintsho lungolwedivayisi ekude.

I-peer iyabuza, i-responder iyanquma

I-IKE iwumsebenzi wokufanisa phakathi kwamasethi amabili eziphakamiso. Umhubhe wakheka kuphela lapho amasethi ehlangana khona ngaphakathi kwemingcele eyamukelwa i-responder, yingakho isikhathi esingaphandle kwebanga singakhi mhubhe oyingxenye nhlobo. Iphutha elivamile ukuthatha ukuhlelwa kwe-peer njengohlu lwezifiso hhayi njengesiphakamiso. Ukuhlangana okungenalutho kushiya umhubhe phansi, kungakhathaliseki ukuthi ukuhamba kwendlela nezinketho zilungile kangakanani.

Funda isimo somhubhe uqobo ngaphambi kokuvula icala, ngoba isimo esinemininingwane ngokuvamile sisho isigaba esihlulekile:

gcloud compute vpn-tunnels describe office-tunnel \
  --region europe-west1 \
  --format="value(status,detailedStatus)"

Qhathanisa okubuyayo nesethi esekelwe yohlobo lwengeango yakho kanye nenguqulo ye-IKE, futhi urekhode zombili izinketho zokuhamba ngesikhathi ukhona. Ukungafani kwesikhethi kunikeza uphawu olufanayo lombhubhe ophansi njengokungafani kwe-algorithm, futhi ngokungafani ne-algorithm, lokhu kufanele ukulungise wena.

Amasekhondi angu-36,000 awumkhawulo ophezulu

Isigaba 1 siyama kumasekhondi angu-36,000. Idivayisi esethelwe ku-86,400 icela into i-responder engayikuvuma neze, futhi ukuphinda akushintshi umqondo wayo. Buyisela isiphakamiso esikude ngaphakathi kwebanga futhi ukuhlelwa okufanayo kuzokwakha; ukungalingani kuyisona sonke isifundo, ngoba ungahlisa inani lakho kodwa awukwazi ukukhuphula elika-Google.

Bhala inani elikhethiwe kumanothi okuklama. Uma kungenjalo unjiniyela olandelayo uzophinda ukuhlolwa kwamahora angu-24 futhi ashayise udonga olufanayo.

Isethi esekelwe ishicilelwa ngohlobo lwengeango nenguqulo ye-IKE ku- mbono jikelele we-Cloud VPN, ngakho funda isigaba sohlelo lwakho lwenethiwekhi esikhundleni somhlahlandlela we-IKE ojwayelekile.

Umhubhe owela ngesikhathi esimisiwe

Isigaba 2 senza ngendlela ehlukile: lapho iziphetho ezimbili zingavumelani, ukuvuselelwa kokhiye kulandela isikhathi esifushane. I-peer ethatha ukungafani njengento ebulalayo iyawisa umhubhe esikhundleni salokho, ngakho ukungafani okukodwa kungabonakala njengezinkinga ezimbili ezingahlobene. Bheka isigqi sokuvuselelwa kokhiye, hhayi kuphela ukuxhumana kokuqala. Umhubhe okhuphukayo bese uwela ngesigqi esivamile ngokuvamile uwukungafani kwesikhathi hhayi ukukhubazeka kokuhamba kwendlela.

Hlanganisa lezo zimpawu zesikhathi zokuwa namalogi e-peer uqobo ngaphambi kokushintsha noma yini, ngoba ukushintsha kwesikhethi noma komzila kungalingisa isigqi esifanayo. Uma isigqi sihambisana nesibali sesikhathi sesigaba 2, imbangela isitholakele ngaphandle kokuthinta isiphakamiso.

Amasethi avela ohlotsheni lwengeango

Amasethi e-cipher nobuqotho awasiwo iphrofayela yomhubhe ngamunye oyihlelayo njengoba i-strongSwan ikuvumela. Uwakhetha ngohlobo lwengeango nenguqulo ye-IKE, futhi ukufuna iphrofayela engekho kuchitha intambama.

Idivayisi endala enganikeli lutho ngaphakathi kwesethi esekelwe ishiya izindlela ezimbili eziqotho: shintsha idivayisi, noma qeda engeangweni yesofthiwe oyilawulayo bese uqondisa ungene ku-VPC ukusuka lapho. Noma yini enye iyisixazululo sedlula esizohluleka ekubuyekezweni okulandelayo.

Ikheli elilodwa langaphandle ngedivayisi ngayinye

Ikheli langaphandle le-peer kufanele lihambisane ngokwayodwa-ku-eyodwa nekheli lalo langaphakathi. Ichibi le-PAT eligcwele ngokweqile ngeke lisebenze, ngoba izisetshenziswa eziningi ngemuva kwekheli elilodwa lomphakathi azinikezi i-responder indlela yokuzihlukanisa. Lapho izisetshenziswa eziningi kufanele zabelane ngekheli, umhubhe kufanele uphele endaweni engazihlukanisa.

Gcina nalelo kheli langaphandle lizinze. Hambisa idivayisi ngemuva kwenye i-NAT futhi ukuxhumana kuyaphuka nakuba isiphakamiso ngasinye sisahambisana. Kufanelekile ukubhala ukuthi yimaphi amanani ka-Google nokuthi yimaphi akho: izikhathi, amasethi ne-NAT eyodwa-ku-eyodwa kuginqiwe ohlangothini lwabo, kuyilapho iziphakamiso, izikhethi, ukuhamba kwendlela nokubaluleka kwe-BGP kungokwakho.