I-ExpressRoute ne-VPN: yiziphi izigaba zokwehluleka ozimbozayo?
Ithubhu lesibili le-IPsec limboza indawo yokugcina eyodwa, hhayi isekethe engaphansi kwayo. Hlela isigaba ngasinye sokwehluleka, bese unquma ukuthi ingabe indlela yokubuyela emuva engenakho ukubethelwa ivunyelwe.
Ithubhu le-IPsec elisebenza phezu kwe-peering yangasese ye-ExpressRoute lengeza ukubethelwa ekuthuthukisweni okukhona kakade. Ithubhu lesibili lithuthukisa ukutholakala kwendawo yokugcina, futhi alwenzi lutho nhlobo endleleni yomthwali engaphansi kwazo zombili. Lomehluko kulula ukuwulahlekelwa lapho amabhodi okubonisa abonisa amathubhu amabili aluhlaza futhi ukubuyekezwa komklamo kubuza omunye umbuzo: yikuphi ukwehluleka okufanele le nxhumano ikwazi ukukudlula? Phendula lokho kuqala, bese ubala amathubhu, ngoba inani lezinkomba eziluhlaza liyisici sesendlalelo sokubethelwa futhi inani lezigaba zokwehluleka liyisici sendlela yonke.
Qala ngokwehluleka, hhayi ngamathubhu aluhlaza
Bhala imigqa emine ngaphambi kokudweba noma yini: indawo yokugcina ye-VPN eyodwa noma isibonelo se-peer esisodwa sehluleka, irutha yendawo noma uxhumano lwemayela lokuqala lwehluleka, indlela ehlanganyelwe ye-ExpressRoute yehluleka, kanye ne-IPsec engatholakali ngenkathi i-peering yangasese isahambisa ithrafikhi. Umugqa ngamunye usho lokho umklamo okufanele ukugcine, futhi ngamunye uphendulwa indlela ehlukile.
| Failure | What must survive | What does not cover it |
|---|---|---|
| One VPN endpoint or instance | An alternate encryption endpoint and a route to it | A second tunnel terminating on the same instance |
| One local router or first mile | Independent local equipment and transport reachability | Any number of logical tunnels |
| The ExpressRoute path | A separately designed surviving underlay | An IPsec tunnel layered on the same circuit |
| IPsec unavailable, peering up | The intended encrypted-only or approved fallback policy | Assuming the tunnel is the only route |
I-Microsoft ibhala i-VPN yesayithi-kuya-sayithi ene-IP yangasese phezu kwe-peering yangasese ye-ExpressRoute, kanye nokuhlalisana okusekelwayo nokuxhumana kwesayithi-kuya-sayithi okusekelwe ku-inthanethi. Lokho kuhlalisana kuwumklamo wezendlalelo ezingaphansi ohlukile, futhi akubonakali nje ngoba wengeze enye indawo yokugcina yethubhu yangasese.
Isigaba sokwehluleka 1: indawo yokugcina ye-VPN
Amathubhu amabili egedlowayini elilodwa ngokuvamile ayizithandani ze-active-active eziphela kusisetshenziswa esisodwa sohlangothi lwe-Azure. Zivikela enkingeni yethubhu elilodwa noma isibonelo esisodwa, futhi azivikeli ekutheni leso sisetshenziswa singatholakali, siphinde silungiswe noma siphelelwe umthamo. Ukwengeza kwendawo yokugcina kusho enye indawo yokugcina esekelwayo, enendlela yayo nokuhlelwa kwayo, kanye nomzila ongayifinyelela.
Hlola lokho okukusebenzisile ngempela hhayi lokho okushiwo umdwebo, ngoba ingosi ihlanganisa lezi zinsiza ngezindlela ezifihla ubudlelwano bazo:
az network vpn-connection show -g rg-connectivity -n vpn-to-hub --query '{conn:connectionStatus,tunnels:tunnelConnectionStatus}'
az network vnet-gateway show -g rg-connectivity -n gw-hub --query '{sku:sku.name,activeActive:enableBgp,peers:bgpSettings.peers}'Uma womabili amathubhu ekhomba egedlowayini elilodwa eline-IP eyodwa yomphakathi, unokwengeza kwendawo yokugcina kohlobo oluthile nolunomkhawulo. Lokho kungase kube yilokho okudingwa yimfuneko, futhi kufanele kushiwo kanjalo esikhundleni sokuchaza njengoxhumano olwengeziwe.
Isigaba sokwehluleka 2: indlela yendawo kanye nomthwali
Ngaphansi kokubethelwa kukhona iqiniso lomzimba nelokuhweba: idivayisi yomkhawulo weklayenti, uxhumano lokuphambana, inethiwekhi yomhlinzeki kanye nendawo ye-peering. imihlahlandlela yokutholakala ye-ExpressRoute icacisa ukuthi ukwengeza kusuka ekupheleni kuya ekupheleni kuhlanganisa izingxenye zeklayenti nomhlinzeki wesevisi, hhayi uhlangothi lwe-Microsoft kuphela. Izindlela ezimbili ezinengqondo ezabelana ngerutha, umthombo wamandla noma uxhumano lwemayela lokuqala zisabelana ngalokho kuncika.
Yilapho umklamo ngokuvamile uhluleka khona ekubuyekezweni okuqotho. Amasekhethi amabili avela kumhlinzeki oyedwa, aphela esakhiweni esisodwa, kumishini evela ku-oda lokuthenga elilodwa, awazona izigaba zokwehluleka ezimbili. Ziyisigaba esisodwa sokwehluleka esinama-invoyisi amabili.
Buza umthwali umbuzo ngokubhala: yiziphi kulezi zindlela ezehlukana, kuphi, futhi yikuphi ukuziphatha okubhaliwe lapho ingxenye ehlanganyelwe yehluleka? Isiqinisekiso somlomo ngesikhathi socingo lomklamo asidluli ukuphazamiseka owenzela kona.
Isigaba sokwehluleka 3: umzila ophila ngaphandle kwe-IPsec
I-peering yangasese ne-IPsec zinganikeza imizila eqhudelanayo eya esiqwini esifanayo sohlelo lokusebenza. Uma umzila ovikelwe unyamalala, umzila oqondile we-ExpressRoute osele ungase usasebenza, ngaphandle kwesendlalelo sokubethelwa okwakunikezwa ithubhu. Ukuthi lokho kwamukeleka yisinqumo senqubomgomo, futhi yisinqumo esivame ukushiywa singashiwo.
Izidingo zokubethelwa nezidingo zokutholakala zingashayisana ngempela lapha. «Noma yimuphi umzila osele ubhekwa njengempumelelo» isitatimende sokutholakala esiphendula buthule umbuzo wokubethelwa ngokuthi «cha». Bhala ukuthi yikuphi okunqobayo, kuyiziphi iziqalo, nokuthi ubani okugunyazile.
az network vnet-gateway list-advertised-routes -g rg-connectivity -n gw-hub --peer 10.0.0.1
az network vnet-gateway list-learned-routes -g rg-connectivity -n gw-hub -o tableQhathanisa imizila efundiwe neziqalo obukulindele. Indlela yokubuyela emuva ethwala umthwalo omncane wokuphatha ingase yanele ngokuphelele kulowo mthwalo futhi ibe kude kakhulu nomthamo odingwa yisidingo sokukhiqiza, ngakho bhala isimo somthamo eceleni komzila.
Bhala imigqa emithathu ehlukene, hhayi isinqumo esisodwa
Gcina ukwengeza kwendawo yokugcina, ukwengeza kokuthutha kanye nokululama ngemuva kwenhlekelele njengamarekhodi ahlukene kurekhodi lomklamo, ngalinye linendlela yalo, ukuqinisekiswa kwalo kanye nomnikazi walo. Lapho ukubuyekezwa kwesigameko kubuza ukuthi kungani uxhumano lwedlule ukuqalwa kabusha kwegedlowayini kodwa hhayi ukunqanyulwa kwefayibha, imigqa emithathu iphendula ngomusho owodwa; ibhokisi lokumaka elilodwa elithi «okwengeziwe» alikwazi.
Bese uhlola imigqa ongayihlola ngokushibhile. Yenza ithubhu elilodwa lihluleke futhi uqinisekise ukuthi ithrafikhi iyahamba futhi ibethelwa kabusha. Hoxisa umzila owodwa futhi uqinisekise ukuthi umzila osele yiwona obuwuhlosile, bese uqinisekisa ukuthi usabethelwe yini. Bhala phansi ukwehluleka ongakwazanga ukukulingisa, ngoba umugqa ongahloliwe uyisimo futhi kufanele umakwe kanjalo.
Umphumela owusizo yithebula elifushane kanye nomusho owodwa ngomugqa ngamunye. Uma umugqa ungenayo indlela, yilokho okutholakele, futhi kushibhile kakhulu ukukuthola ekubuyekezweni komklamo kunangesikhathi sokuphazamiseka komthwali okwakungeke kudlulwe yiwona womabili amathubhu.