FortiGate ngemuva kwe-NAT: local-gw, localid kanye ne-IP yomphakathi

I-FortiGate engemuva kwe-NAT ingaba ne-10.0.0.2 kusixhumi esibonakalayo se-WAN sayo ngenkathi i-inthanethi iyiveza njenge-198.51.100.40, futhi zombili izinombolo zingokoqobo. Ikheli elibophezela idivayisi kanye nobuwena elikuthumelayo ngesikhathi sokuqinisekisa i-IKE yizinqumo ezihlukene, ezenziwe ezinkambeni ezihlukene, kubabukeli abahlukene. I-NAT ibhala kabusha ikheli langaphandle endleleni; ayibhali kabusha ubuwena obuqinisekisiwe bube yilokho i-peer ekude ekulindele. Iningi lokwehluleka kwesigaba 1 kuleli fomu livela ekubekeni inani elifanele endaweni engafanele.

Amanani amathathu, abanikazi abathathu

Qala ngokuqamba amanani amathathu nokuthi ubani ungumnikazi welinye ngalinye. local-gw iyikheli elisetshenziswa yi-FortiGate njengomthombo we-IKE kusixhumi sangaphandle, futhi kufanele kube ikheli idivayisi enalo ngempela. Iphuzu lokugcina lomphakathi iyikheli ledivayisi ye-NAT, futhi lingelowo owenza ukuhumusha. Ubuwena be-IKE iwuchungechunge i-peer eliqhathanisa nokucushwa kwayo, futhi akudingeki neze ukuthi kube ikheli le-IP.

Amagama ezinkamba aseduze ngokwanele ukumema ukushintshwa, futhi yilokho okuyisicupho. localid kanye ne-localid-type kuchaza ukukhonjwa; local-gw kuchaza ukubophezela kwendawo.

Isibonelo senza umehluko ube sobala. Ku-FortiGate, vula config vpn ipsec phase1-interface, bese kuba set interface "wan1" kanye ne-set local-gw 10.0.0.2 — ikheli elinalo ibhokisi, futhi yilokhu okwenza isokhethi ye-IKE ibophezele ngempumelelo. Shiya i-local-gw ku-0.0.0.0 bese kusetshenziswa ikheli lesixhumi, okuvamise ukuba yinto efanayo kodwa kungacacile. Ungabeki i-local-gw ku-198.51.100.40, ngoba idivayisi ayinalo lelo kheli futhi isokhethi ngeke ibophezele kulo. Ukwenza amanani amabili abukeke elingana ephepheni akukona ukucushwa.

Isinyathelo 1: khetha ubuwena i-peer ezokwamukela

Manje ubuwena, okuyisinqumo esihlukile. set localid ithatha inani i-peer ezoliqhathanisa, kanti i-set localid-type itshela i-FortiGate ukuthi ilihumushe kanjani: ikheli, i-FQDN, i-FQDN yomsebenzisi noma i-ID yokhiye. Nge-auto idivayisi iyikhipha, ngokuvamile kusukela ekhelini lesixhumi esiphumayo, okuyilo kanye inani idivayisi ye-NAT esezolishintsha.

Yikho lokhu kukhipha okuyisizathu sokuthi ubuwena obucacile bubalulekile kule-topology. Uma i-peer ilindele ubuwena bekheli, beka i-localid-type address kanye ne-localid ekhelini lomphakathi i-peer ezolibona, bese uqinisekisa ukuthi i-peer yamukela lelo nani njengobuwena hhayi njengomgomo wokuhambisa. Uma i-peer ilindele i-FQDN, sebenzisa i-localid-type fqdn kanye negama eyacushwa ngalo. Qinisekisa ukuthi kwathunyelwani ngempela nge-diagnose vpn ike gateway list, ekhombisa isimo sesango kanye nezihlonzi ezisetshenziswayo, hhayi lokho obuhlose ukukuthayipha. Ungacabangi ukuthi inketho yohlobo lobuwena yamukela noma yiliphi ikheli elingelona lendawo; qala uhlole incazelo ebhaliwe yokukhishwa.

Isinyathelo 2: dlulisela i-UDP 500 kanye ne-4500 kudivayisi

Inani lesithathu lingeledivayisi ye-NAT, futhi yilo abantu abakhohlwa ukuliqinisekisa. Iphuzu lokugcina lomphakathi kufanele lidlulisele i-UDP 500 kanye ne-UDP 4500 ku-FortiGate, ngoba ukutholwa kwe-NAT-T kanye ne-ESP ehlanganisiwe elandelayo kokubili kuncike ekufikeni kwalezi zimbobo. Lo mklamo uthatha ukuthi kunokuhlelwa kobuso obubodwa; ukwabelana ngekheli elilodwa lomphakathi ngezimbobo phakathi kwama-peer amaningi kungenye i-topology enemikhawulo ehlukile.

Qinisekisa ukudlulisela ngokuthwebula hhayi ngethemba: diagnose sniffer packet any "udp port 500 or udp port 4500" 4 kukhombisa ukuthi amaphakethe ayafika yini nokuthi izimpendulo ziyaphuma yini.

I-Google Cloud VPN ibhala i-NAT yobuso obubodwa ne-NAT-T njengelungiselelo elisekelwayo le-peer engemuva kwe-NAT, futhi lowo umkhawulo okufanele kuklanywe ngawo uma uhlangothi olukude luyisango le-Cloud VPN. Ukwabelana kobuso obubodwa kuya kwabaningi noma ngezimbobo akusona isimo esisekelwayo esifanayo, futhi akukho kulungiswa kobuwena bendawo okushintsha lokho. Uma uhlangothi olukude lungedivayisi enye, imibhalo yalo iqobo yona ichaza ukuthi izokwamukela ini njengobuwena nokuthi iyabekezelela yini ikheli le-peer elihunyushiwe. Funda lokho ngaphambi kokushintsha inkamba yendawo, ngoba uhlangothi lwendawo alunakuxoxisana ngomthetho uhlangothi olukude olungawusebenzisi.

Isinyathelo 3: hlola ukuthi isigaba 1 asikuxazululi ini

Ukudlula kwe-NAT kukhulisa ithumbu, ukuvumelana kobuwena kunquma ukuthi i-peer izolwamukela yini, futhi ukuhambisa kwesiqalo sangaphakathi kunquma ukuthi kwenzeka ini ngempela. I-ID yendawo efanele ayikwazi ukunikeza umzila omile ongekho noma isikhethi sokuhamba esingekho.

Ngakho-ke qinisekisa ngezingqimba. get vpn ipsec tunnel details kukhombisa ukuthi ithumbu likhona yini nokuthi yiziphi izikhethi okwavunyelwana ngazo, futhi ukungafani phakathi kwesubnet ekude ecushiwe nesikhethi okwavunyelwana ngaso kuyinkinga yokuhambisa egqoke isigaba 2. execute vpn ike gateway clear kuphoqa ukuxoxisana kabusha, ngakho uhlola ukucushwa kwamanje hhayi iseshini eyasungulwa ngaphambi koshintsho lwakho lokugcina. Bese uthumela ukuhamba kumgcini osesiqalweni esikude futhi uqinisekise ukuthi izibali ziyanyakaza, ngoba ithumbu elikhulisiwe nelingadlulisi lutho libukeka lifana nelisebenzayo kuze kube uyahlola.

Gcina amanani amathathu endaweni eyodwa kumanothi akho: ikheli lendawo idivayisi enalo, iphuzu lokugcina lomphakathi idivayisi ye-NAT elivezayo, kanye nomucu wobuwena i-peer ewulindele. Ayashintsha ngezizathu ezihlukene nangezikhathi ezihlukene.

Ukufaka izinombolo kabusha kudivayisi ye-NAT akusona isizathu sokuthinta i-local-gw ye-FortiGate, futhi ukushintsha kobuwena akusona isizathu sokufaka izinombolo kabusha noma yini. Ukuhlanganisa kokubili yikho okwenza ithumbu elisebenzayo lakhiwe kabusha ngesikhathi sewindi lokunakekela elingahlobene. Umhlahlandlela we-NAT we-Cloud VPN uyisithenjwa se-topology esekelwayo ngalolo hlangothi.

Ukuhlola okunqumayo kuyisicefe futhi kuyashesha: thwebula kusixhumi sangaphandle, qinisekisa ukuthi i-UDP 500 kanye ne-4500 zivela ku-peer, qinisekisa ukuthi ubuwena ekushintshisweni kwe-IKE buyahambisana nalokho i-peer eyayicushwe ukukulindela, bese uqinisekisa ukuthi izikhethi okwavunyelwana ngazo zihlanganisa ama-subnet okukhathazayo. Uma ukuhlola kokuqala kwehluleka, umsolwa idivayisi ye-NAT. Uma owesibili wehluleka, izinkamba zobuwena. Uma owesithathu wehluleka, i-NAT noma ubuwena akuzange kube yinkinga neze.