Ukubala ama-VPN esizinda se-FTD asebenzayo: iyiphi inombolo oyishoyo?

Abalingani abalungisiwe, amaseshini e-IKE, izinhlangano zokuphepha kanye namathaneli aqashwe yizinto ezine ezihlukene zokubala. Khetha iyunithi nezinga lokuphatha ngaphambi kokubhala ikhodi.

Ngaphambi kokubhala umsebenzi we-Ansible, phendula umbuzo omncane: yini ebalwayo? Umlingani olungisiwe, iseshini ye-IKE, inhlangano yokuphepha ye-IPsec kanye nokurekhodwa kwesimo sethaneli eliqashwe yizinto ezine ezihlukene, futhi ukukhiqizwa kabusha kokhiye noma amanethiwekhi amaningi avikelwe kwenza izibalo zazo zehlukane. Uma idashibhodi ne-playbook zingavumelani, ngokuvamile zibala izinto ezihlukene, hhayi ukuthi enye yazo inephutha.

Izinto ezine abantu abazibiza ngokuthi ziyasebenza

Umlingani olungisiwe uyinto ye-topology: ukhona ngoba othile wayichaza. Iseshini ye-IKE iwubudlelwano obusezingeni lokulawula obungaba phezulu kuyilapho kungekho thrafikhi egeleza. I-SA ye-IPsec iyinhlangano yezinga ledatha yombhangqwana othile wokukhetha, futhi itaneli elilodwa lingathwala ambalwa. Isimo sethaneli eliqashwe isinqumo sokusebenza sepulatifomu ngokwayo, ngokuvamile esiseduze kakhulu nalokho umsebenzisi akushoyo uma ethi itaneli liphezulu.

Eyokugcina kuphela iyisisekelo esinengqondo sokubala kokusebenza. Eyokuqala uhlu lokulungiselela, futhi ukuyibika njengesebenzayo yindlela idashibhodi elibonisa ngayo okuluhlaza kumlingani obephansi kusukela ngoLwesibili. Nquma ukuthi iyiphi iyunithi umsebenzisi wenombolo ayidingayo, bese ufaka ilebula kumethrikhi ngaleyo yunithi egameni layo.

Isinqumo sokuqala: yiliphi izinga lokuphatha?

Uma idivayisi ilawulwa yi-FDM, indawo efanele yi-FTD REST API. Uma ilawulwa yi-FMC, leyo API ayiyona indawo yokushintsha, futhi izinto zihlala ngemuva kwe-API ye-FMC uqobo. Qinisekisa lokhu ngaphambi kokubhala ngisho isicelo esisodwa, ngoba izinga elingalungile libuyisela iphutha elizwakalayo elifana nenkinga yemvume.

Kubutho lwedivayisi, impendulo iphinda inqume ukuthi ukubala kukhona kuphi: ngedivayisi ngayinye nge-FDM, noma ngesifunda ngasinye nge-FMC. Lezi zindawo ezihlukene futhi zinikeza izinombolo ezihlukene kubutho olufanayo.

Isinqumo sesibili: iyiphi insiza ephendulayo?

Ngesibonelo esiboshwe kunguqulo, inkomba yezinto ye-FMC 7.3 API ibhala izinsiza ze-GET ngaphansi komzila we-health:

/api/fmc_config/v1/domain/{domainUUID}/health/tunnelstatuses
/api/fmc_config/v1/domain/{domainUUID}/health/tunnelsummaries

Isinsiza sesimo sethaneli sisekela izihlungi zedivayisi nesimo, kufaka phakathi TUNNEL_UP. Lokho kukunikeza insiza yokusebenza yangempela ongayihlola yaleyo nguqulo, hhayi ukuqagela mayelana negama lensimu.

Ngaphambi kokusebenzisa umhlaziyi, qinisekisa ukutholakala, izimvume, amapharamitha wesicelo kanye nohlaka lwempendulo ku-API Explorer ye-FMC efakiwe. Imibhalo yenguqulo eyodwa iyindawo yokuqala, hhayi isivumelwano saleyo oyisebenzisayo.

Bhala isivumelwano sokubala

Sho imethrikhi ngomusho owodwa: amarekhodi ethaneli okusebenza ayingqayizivele edivayisi nesifunda okuhlosiwe esimo salo esibikiwe kuyi-TUNNEL_UP. Bese ubhala ukuthi amadivayisi engeziwe namarekhodi amaningi esizinda esisodwa esinengqondo amelelwa kanjani, ngoba lezo zimo ezimbili zinquma ukuthi inombolo yakho iyafana naleyo yomhlangano.

Ungayishintshi ngokuthula iyunithi isuka kurekhodi lethaneli iye esizindeni esikude. Uma ibhizinisi lifuna izizinda, hlanganisa amarekhodi nezizinda ngokusobala futhi ushicilele lokho kuhlangana. Ukubala okuzichaza kabusha ngokuthula kubi kunokungabali, ngoba akekho ongasho ukuthi kwashintsha nini.

Thatha insiza yesifinyezo njengento elula kuphela ngemva kokuqinisekisa ukuthi ifinyeza ini. Ingase ihlanganise kahle lokho okudingayo, noma iphendule umbuzo ohluke kancane. Funda uhlaka lwayo kanye, bhala umehluko, futhi usebenzise insiza yesimo uma isifinyezo singakwazi ukuchazwa. Isifinyezo ongasikuqondi iyinombolo ongenakuyivikela ekubuyekezweni.

Vumela ukgeleza komsebenzi kugcine ukungaqiniseki

Sebenzisa i-HTTPS API egunyaziwe, qinisekisa isitifiketi, gcina amathokheni ngaphandle komphumela womsebenzi, futhi uthole ububanzi ngesihlungi nokufaka amakhasi okusekelwa inguqulo. Bese uqinisekisa uhlaka ngaphambi kokubala noma yini.

fetch intended domain/device runtime records
validate response, completeness and freshness
deduplicate by the documented tunnel identity
count records matching the approved up-state definition
report count with scope, timestamp and metric unit

Lokhu kuyi-pseudocode yokugeleza komsebenzi, hhayi i-playbook ehloliwe. Thatha amagama ezinsimu angempela ku-API efakiwe esikhundleni sokwenza ukhiye we-JSON obizwa ngokuthi active.

Umthetho obalulekile ukuziphatha lapho kwehluleka: iphutha lokugunyaza, insiza engasekelwe, isampula esidala noma isethi yamakhasi engaphelele kufanele kukhiqize unknown noma error, hhayi neze uziro oluphumelelayo. Uziro osho ukuthi angikwazanga ukubuza uwuhlobo lwephutha olubiza kakhulu.

Qinisekisa ngokumelene nombono wepulatifomu uqobo

Qhathanisa umphumela wokuqala nombono wokuqashwa kwe-VPN wenguqulo yedivayisi nomzuzu ofanayo. Uma zihlukile, thola ukuthi iyiphi iyunithi isetshenziswa yilowo nalowo ngaphambi kokushintsha i-playbook.

Gcina umongo ongewona imfihlo kuwo wonke ukusebenza: ububanzi, isigxivizo sesikhathi, iyunithi yemethrikhi kanye nenani lamarekhodi. inkomba yezinto ye-FMC 7.3 API ingumthombo wemizila yezinsiza engenhla, futhi i-API Explorer ekusetshenzisweni kwakho ingumthombo wakho konke okunye.

Izihloko ezihlobene