I-VPN gateway ehlanganisiwe noma ehlukene: khetha ngokwesigaba sokuwohloka

Amadivayisi amabili abonakala eqinile kunelilodwa kuze kube yilapho ubona ukuthi ahlanganyela isitishi samandla esisodwa, i-hypervisor eyodwa kanye nokuxhumana okuphezulu okukodwa. Ukubala amabhokisi kuphendula umbuzo ongewona obuzwe muntu; umbuzo owusizo ukuthi yini ehlulekayo ngesikhathi esisodwa. Bhala isivumelwano sokuwohloka kuqala, bese uyeka ukuthi sikhethe i-topology. I-runbook engezansi ikhiqiza lokho kubhalwa.

Yini ema ngesikhathi sokuqalisa kabusha okukodwa

Kugateway ehlanganisiwe, bhala yini elahlekayo ngesikhathi sokuqalisa kabusha, ukubuyekezwa okwehlulekile noma ukulimala kwengxenyekazi. Uma ukufinyelela kwi-inthanethi nokuxhumana okuyimfihlo kuma kanyekanye, lokho kuphazamiseka okwabiwe manje sekuyingxenye yemfuneko yakho yokutholakala, kungakhathaliseki ukuthi ubani uyibhalile noma cha. Umsebenzi ofanayo ukhuluma nedivayisi eyodwa eqeda izindima eziningana: uhlu lwezinsizakalo eluzihlisayo yilona oluyisici sangempela.

Kumagateway ahlukene, bhala okusalayo kwabiwe: amandla, umsingathi we-virtualisation, ukuxhumana okuphezulu, umhlinzeki wobunikazi, inethiwekhi yokuphatha. Amadivayisi amabili ngemuva kweswishi eyodwa ehlulekile isigaba esisodwa sokuwohloka esinamagama amabili okusingatha. Ukwehlukanisa okunganaki lokho kuncika kuwumdwebo, hhayi umklamo.

Bala nobunikazi besondlo. Elinye idivayisi liletha ukucushwa, ukuqapha, amakhophi agciniwe kanye nenqubo yesibili yokubuyisela, futhi akukho kulokho okumahhala.

Maka lapho umthetho ngamunye uqinisekiswa khona

Landela iphakethe elilodwa lisuka kuklayenti liya kumthombo oyimfihlo futhi libuye, bese umaka yonke indawo lapho umgomo usetshenziswa khona. I-router yesibili yengeza elinye iphuzu lapho ukuthandwa komzila, ukuhumusha noma isimo sokuxhumana kungavumelani nokokuqala. Iningi lokuwohloka okuyimfihlakalo kumklamo wamagateway amabili kuhlala kuleyo mthungo.

ip route get 10.20.30.40
traceroute -n 10.20.30.40
conntrack -L -p tcp --dport 443

Bhala lapho ukuvikelwa kwe-VPN kuphela khona nokuthi umgomo wangaphakathi uqala kuphi. Uma indlela phakathi kwamadivayisi amabili ivumela konke, ibhokisi lesibili alizange lidale umngcele; lishesise indawo lapho umngcele wawungaba khona. Eplatifomu eyodwa, izindawo zomgomo ezihlukene zingase zisebenze, futhi ukusebenza kwazo kufanele kuhlolwe kusukela emithethweni kunokuba kuchithwe ngenxa yokuthi ingxenyekazi yabiwe.

Yima uma ungakwazi ukusho ukuthi yiliphi idivayisi eliqinisekisa umthetho obalulekile. Leyo gebe iwukutholakala, hhayi imininingwane ezoxazululwa kamuva.

Ukugcina kuwumngcele, hhayi i-chassis

Idivayisi elihlukene ligcina ukuphazamiseka kuphela lapho indlela edlula kulo isilinganiselwe kulokho ohlangothini olunye olukudingayo. Uma womabili amadivayisi amukela noma yikuphi ukuxhumana komunye nomunye, isihlaseli esihlala kwelinye sinokufinyelela okufanayo nangaphambili. Isimangalo sokugcina siyingxenye yemithetho, hhayi uhlu lwezinto. Funda imithetho, usho ukuthi yimiphi imifudlana evunyelwe, bese unquma ukuthi ukwehlukanisa kwathenga okuthile yini.

Umqondo ofanayo ukhuluma nabasebenzisi. Umsebenzisi we-VPN othembekile ngenxa yenethiwekhi aqhamuka kuyo wethemba indawo esikhundleni sobunikazi, futhi isiqondiso se-NIST sokwethemba okuqandile sichaza enye indlela: qinisekisa futhi ugunyaze isicelo ngasinye ngokuya kumthombo. Lowo mgomo uhlala noma iyiphi i-chassis eqeda umhubhe.

Uma ukwehlukanisa kukhona ukuze kugcwaliswe umugqa wokuhambisana hhayi ukushintsha umfudlana, kusho lokho embhalweni. Ukulawula okungekho muntu ongakuchaza yikona okukhishwa kuqala ngaphansi kwengcindezi.

Buyisela lokho ongakufinyelela ngempela

Buza ukuthi iyiphi indlela yokubuyisela esindayo uma noma iyiphi indima ifa. Uma indlela eyodwa kuphela eya kugateway we-VPN ephukile idlula kuleyo gateway, idivayisi eyisipele kwenye indawo ayisizi umphathi okufanele ayilungise. Indlela engaphandle kwebhendi, i-console kanye nokubuyela emuva okubhaliwe yizingxenye ezenza umklamo ubuyiseke.

systemctl status strongswan
nft list ruleset
ip -brief address

Linganisa umklamo womsebenzi ogcwele osekelwe hhayi inombolo yokubethela ehlukile, ngoba ukuhlunga nokuhlola kusebenzisa ingxenyekazi efanayo. Sebenzisa imibhalo yomthengisi nezilinganiso zakho esikhundleni sokucabanga ukuthi ukwehlukanisa kuyashesha noma kuyaphuza. Bese ubhala umbhalo wesinqumo: yimiphi imifudlana evunyelwe, yikuphi ukuncika okwabiwe, iwini yokulungisa yehlisa ini, yibuphi ubufakazi bamandla onabo futhi ubani ongumnikazi wesinyathelo ngasinye sokubuyisela. Lowo mbhalo mfushane ngokwanele ukubuyekezwa futhi uqondile ngokwanele ukuphindela kuwo.

I-runbook iphela lapho isivumelwano sokuwohloka sibhaliwe, indlela yokudlulisa inephuzu elilodwa eliqinisekiswayo eliqanjwe ngomthetho ngamunye, ukugcina kuchazwa ngemifudlana hhayi ngenani lamadivayisi, futhi ukubuyisela kusebenza ngaphandle kwengxenye ehlulekile. Khetha ukuhleleka okulula okuhlangabezana nalezo zidingo.