I-VPN yesivakashi ku-ESXi: ukuhamba noma ibhuloho — ncika ngaphambi kweqembu lezimbobo
I-TUN ehambayo idinga imizila yokubuya; i-TAP enebhuloho idinga ukufinyelela kwezinga 2 kanye nenqubomgomo ebanzi yeqembu lezimbobo. Nquma indima ngaphambi kokwandisa imodi ye-promiscuous.
Hambisa amaphakethe noma wandise isizinda se-Ethernet: ushintsho lweqembu lezimbobo lulandela leso sincumo. Ngokombono wohlelo olunekheli yangasese imiphumela ingabonakala ifana, kuyilapho izidingo ze-hypervisor zihluke ngokuphelele. Yingakho iqembu lezimbobo landiswa kuqala futhi umbuzo wokuklama uphendulwa okwesibili, ngokuvamile ngemva kwesiphepho se-broadcast. Hamba kulezi zihlolwa ngokulandelana futhi ume ngenkathi isidingo sisacacile, ngoba asikho isilungiselelo seqembu lezimbobo esilungisa ukuklama okungakaze kukhethwe.
Isinqumo ngesomnikazi wensiza; ukulungiselelwa kwe-hypervisor kufanele kusisebenzise, hhayi ukusinquma ngengozi.
Hlola ukuthi ikhona yini ekugcineni ekude edinga ngempela
Bhala izinsiza okufanele zifinyelelwe amaklayenti akude kanye namaphrothokholi ewasebenzisayo. Uma uhlu luyizinsiza ezimbalwa ze-TCP kumaprefikhi aziwayo, ukuhamba kuyanele. Uma okuthile kudinga ukusondelana kwezinga 2 ngempela — ukutholwa okuncike ku-broadcast, amaphrothokholi angewona e-IP, idivayisi engayamukeli ingosi — ukuhamba akukwazi ukulingisa futhi lokho kufanele kushiwo kusenesikhathi. Thembeka mayelana nokufakwa okungewona e-IP kulolo hlu, ngoba yilapho ukuklama okuhambayo kwehluleka khona buthule ngemva kweviki.
Bese uhlola ichibi lamaklayenti. Ukuklama okuhambayo kudinga ububanzi bekheli kanye nomzila wokubuya ocacile ohlangothini olukude; ukuklama okunebhuloho kudinga ukuthi isizinda se-Ethernet esandisiwe sibe nokwabiwa kwekheli nokuhlukaniswa. Noma yini oyikhethayo, othile ngaphandle kwale VM kufanele avumelane nayo.
Yini ukuklama ngakunye okudingayo kunethiwekhi ebonakalayo
Izinhlobo ezimbili zokuklama zihluka kulokho inethiwekhi ebonakalayo okufanele ikubekezelele, futhi ithebula iyindlela emfushane yokukubona:
| Ukuklama | Indima ohlangothini lwesivakashi | Inethiwekhi ebonakalayo okufanele ikwamukele | Indlela yokwehluleka uma ukhetha kabi |
|---|---|---|---|
| I-TUN ehambayo | Umhambi phakathi kwamaprefikhi ahlukene | Ichibi lamaklayenti elihambayo kanye nemizila yokubuya ohlangothini olukude | Amaklayenti afinyelela ingosi kodwa awafinyeleli insiza engemuva kwayo |
| I-TAP enebhuloho | Ibhuloho lezinga 2 lamaklayenti ajoyinayo | Ubunikazi be-Ethernet obengeziwe, ithrafikhi ye-broadcast kanye nemithetho ye-VLAN | I-vSwitch ilahla amafreyimu, noma ukuklama kudinga imodi ye-promiscuous okungekho muntu oyigunyazile |
Ukuhamba kushiya isizinda se-broadcast lapho sikhona futhi kunikeza indawo yemvelo yokukhawulela ukuthi yiziphi izinsiza eziwela ingosi. Ukubhuloha kuhambisa umngcele: amaklayenti aba ababambiqhaza esizindeni se-Ethernet esandisiwe, futhi ukwabiwa kwekheli, ukuhlukaniswa kanye nanoma iyiphi inqubomgomo yezinga 2 manje kusebenza kubo. Bhala umugqa okhethiwe kurekhodi loshintsho. Umusho onjengothi «TUN ehambayo, ichibi lamaklayenti 10.90.0.0/24, umzila wokubuya kukho-khona» uvimbela unjiniyela olandelayo ukuthi aphinde aphikisane ngokuklama esebenzisa izilungiselelo zeqembu lezimbobo.
Ubani okufanele avunyelwe ukubona amafreyimu kabani
Buza umnikazi wepulatifomu umbuzo owodwa ngaphambi kokuthinta iqembu lezimbobo: ingabe ukuklama kudinga ukuthi le VM ithole amafreyimu akhonjiswe kwabanye ababambiqhaza? Uma impendulo ingu-cha, akukho okusebenzayo kulesi sigaba, ngoba i-TUN ehambayo ayidingi lowo mbono nhlobo. Uma impendulo ingu-yebo, isiqondiso se-Broadcom mayelana nemodi ye-promiscuous siwukufunda okubalulekile: sichaza ukuthi i-VM ingabona kangakanani ku-vSwitch futhi sincoma ukukhawulela leyo nqubomgomo eqenjini elilodwa lezimbobo.
Kuthathe njengokuhlolwa kwesidingo, hhayi imvume. Vula isilungiselelo ekuxhumaneni okukhethekile okukodwa uma isidingo sebhuloho sibhaliwe, futhi ushiye sivaliwe kwezinye izindawo zonke. I-trunk ye-VLAN ebanzi ekopishiwe kwesinye isibonelo sebhuloho iyingxenye okungekho muntu okhumbulayo ukuyisusa, futhi ukuklama kwe-VLAN eyodwa kufanele kuhlale kuyi-VLAN eyodwa.
Rekhoda ukuthi yiliphi iqembu lezimbobo elashintshayo nokuthi kungani, endaweni efanayo lapho wabhala khona umugqa wokuklama. Yilolo bhangqa olwenza ukuhlolwa okulandelayo kwenzeke.
Gcina izinto zesivakashi zicacile
Ngaphakathi kwe-Linux, ubulungu bebhuloho nokuba ngumnikazi wekheli kuyizinto ezihlukene, futhi ukuzihlanganisa kubangela isimo esididayo esisebenza ngesigamu. Yabela amakheli ku-interface yebhuloho noma emhubheni ohambayo, hhayi ezinhlangothini zombili zomzila ofanayo, futhi gcina izimbobo ezingamalungu zingenalo ukulungiselelwa kwe-IP.
Gwema ukubeka isub-nethi eyodwa ngokuzimela ku-TUN ehamabayo naku-interface ye-Ethernet engahlobene. Lokho kulungiselelwa kukhiqiza imizila emibili eya kuprefikhi efanayo, izimpendulo ezingalingani kanye nentambo yosekelo mayelana ne-flapping engasho lutho ngemizila. Uma isivakashi siphinde sisingathe iziqukathi noma i-hypervisor yasendaweni, hlola ukuthi azikakabi nebhuloho ocingweni olufanayo lwangaphezulu. Amabhuloho amabili ku-NIC eyodwa ukuklama, hhayi ingozi ofuna ukuyithola ngesikhathi sewindi loshintsho.
Qinisekisa ngomzila wephakethe, hhayi nge-ping
Qinisekisa umzila wangempela, hhayi ukufinyeleleka kuphela. Kusuka kuklayenti, qinisekisa ukuthi iyiphi ikheli lomthombo elifika ensizeni ekude, bese uqinisekisa ukuthi impendulo ibuya ngomzila ofanayo. Kusivakashi, hlola izibali zokudlulisa zomthombo othile, futhi eqenjini lezimbobo qinisekisa ukuthi akukho ukubonakala okwengeziwe okuvuliwe okudlula lokho okudingwa ukuklama okukhethiwe.
Ekugcineni, hlola uhlangothi lokwehluleka. Misa umhubhe noma uhlukanise iklayenti futhi uhlole ukuthi ithrafikhi ayiweli buthule emzileni ohambayo obucabanga ukuthi awusetshenziswa, ngoba lokho kuwa yikho okwenza ukuklama okunebhuloho kube umhambi ongahlosiwe buthule.