GCP HA VPN: iseshini ye-BGP imile ku-Waiting for peer, ukushintshana kwepheya lamakheli
Iseshini ye-BGP ye-Cloud VPN emile ku-Waiting for peer ngokuvamile ishintshisane ikheli lomhubhe nelekhompani. Hlola ipheya ngaphambi kokwakha kabusha noma yini.
Iseshini ye-BGP engalokothi ifinyelele ku-Established kumhubhe we-Cloud VPN ngokuvamile ayiyona inkinga yokuhambisa. Inkinga yezintambo: amakheli amabili okufanele abonise omunye komunye afakwe ngokulandelana okungalungile, noma ipheya lomhubhe wokuqala lasetshenziswa futhi kowesibili. Umhubhe ngokwawo ungaba nempilo ephelele kuyilapho iseshini imi ku-Waiting for peer, ngoba i-IPsec ne-BGP yizingxoxo ezihlukene phakathi kwamaphoyinti amabili afanayo okugcina. Nquma ukuthi yikuphi kulawa mabili okugqekeziwe ngaphambi kokwakha kabusha noma yini.
Umbuzo owodwa uxazulula izimo eziningi: ingabe idivayisi yekhompani iyabona ikheli le-Cloud Router nakancane?
Isimo somhubhe nesimo seseshini kuyizinto ezihlukene zokuhlola
I-IKE ne-ESP kuza kuqala. Uma umhubhe ungakamiswanga, akukho lutho ngaphakathi kwawo olubalulekile futhi ingxoxo ngekheli le-BGP ishesha kakhulu. Funda isimo somhubhe nesimo esinemininingwane, bese ufunda isimo sekhompani ye-BGP yomhambisi walowo mhubhe.
Umhubhe umile kuyilapho ikhompani yawo ye-BGP imile kwezinye izindlela, lokhu kunciphisa iphutha eseshini: ikheli lekhompani, i-ASN noma i-TCP 179 efika ekhelini langaphakathi. Umhubhe umile, iseshini imile futhi akukho migwaqo ku-VPC okwamanje lesi yisimo sesithathu. Ukushintsha amakheli akusizi lapho, ngoba iseshini isivele iyasebenza futhi isiqalo asimemezelwa noma asikhethwa. Ukwehlukanisa lezi zimo ezintathu yikhona okuyingxenye enkulu yomsebenzi.
Umhubhe ngamunye udinga i-/30 yawo, zombili iziphetho zigcwalisiwe
Umhubhe ngamunye we-HA VPN uthola i-/30 ye-link-local ku-169.254.0.0/16, ikheli elilodwa kusixhumi se-Cloud Router nelinye kukhompani yakho. Inkambu yekhompani kumele ibize isiphetho esikude, hhayi ikheli lomhambisi ngokwakhe.
Imihubhe emibili isho izixhumi ezimbili ku-Cloud Router, ngayinye ine-/30 ehlukile. Ukusebenzisa futhi ipheya lomhubhe 0 kumhubhe 1 iyiphutha elibonakala lihle kwithebula lesifinyezo bese lifa kuphakethe le-OPEN.
| Tunnel | Router interface | Peer address | What a swap produces |
|---|---|---|---|
| tunnel 0 | 169.254.1.1/30 | 169.254.1.2 | OPEN sent to itself or to nothing; session waits |
| tunnel 1 | 169.254.1.5/30 | 169.254.1.6 | same failure on the second session |
| both | one pair reused | one address reused | one session up, the other never leaves waiting |
Funda ipheya kusisetshenziswa somhambisi hhayi kusifinyezo sekhonsoli. Isifinyezo sibala ikheli lekhompani kukholomu okulula ukulifunda kabi, futhi i-ipRange yesixhumi kanye ne-peerIpAddress yekhompani kumele kuchaze iziphetho eziphikisanayo ze-/30 eyodwa.
Ukushintshana ngokuvamile kwenzeka ngesikhathi sokwakha kabusha
Yilapho kwakhiwa kabusha umhubhe lapho amapheya aphambana khona. Ikheli lekhompani lomhubhe wakudala likopishwa enkambini yesixhumi somhubhe omusha, noma iseshini entsha ikhonjiswa kukhompani yeseshini edlule. Kunoma yikuphi, i-Cloud Router ithumela amaphakethe e-OPEN ekhelini osekuyiyo ngokwayo noma ekhelini elingenalo umhubhe ngemuva.
Bhala amapheya ngaphambi kokuvula ikhonsoli: igama lomhubhe, isixhumi, ikheli lomhambisi, ikheli lekhompani, i-ASN yekhompani. Bese wakha imihubhe yomibili ngasikhathi sinye, ukuze owesibili ungagcwaliswa ngezinsalela zowokuqala.
Ezinye izizathu ezintathu zokuthi iseshini ilinde
Eyokuqala i-ASN yekhompani: uhlangothi ngalunye kumele luhlelwe nge-ASN yolunye uhlangothi, futhi ukungafani kufinyelela kukhompani kodwa akukakhi. Eyesibili i-firewall yekhompani ngokwayo, okumele ivumele i-TCP 179 kusixhumi somhubhe; umthetho we-IKE noma we-ESP awukuhlanganisi lokho. Eyesithathu ikhompani ephendula isuka ekhelini lomthombo elihlukile kunalelo elihlelwe njengomakhelwane wayo.
Ilogi yekhompani ngokwayo iyona ehlukanisayo. Uma isifinyezo sayo se-BGP singabali makhelwane walele kheli, amaphakethe awafiki futhi ipheya noma umzila awulungile. Uma umakhelwane emi ku-Active noma ku-Connect, amaphakethe ayafika futhi amapharamitha eseshini awavumelani.
Hlola ngokulandelana okuhamba ngakho amaphakethe
Sebenza uphumele ngaphandle: isimo somhubhe, bese isimo sekhompani ye-BGP yomhambisi, bese isifinyezo se-BGP sekhompani, bese imigwaqo. Uma ezimbili zokuqala zinempilo, yeka ukuhlela uhlangothi lwe-Cloud VPN futhi usebenze kudivayisi yekhompani. Uma umhambisi ubika ukuthi ikhompani imile futhi idivayisi yakho ayinaye umakhelwane, ipheya alilungile noma imbobo ye-BGP iyahlungwa. Ukubamba amaphakethe kusixhumi somhubhe wekhompani kuxazulula lokhu ngokubuka okukodwa, ngoba amaphakethe e-OPEN ayafika lapho noma awafiki nakancane.
I-gcloud compute routers get-status ROUTER --region=REGION iphrinta isimo sekhompani eceleni kwekheli eliyisebenzisayo, futhi yiloyo pheya okufanele uliqhathanise.
Lapho iseshini isikhulile, qinisekisa ukuthi isiqalo esifundiwe sibonakala kuthebula lemigwaqo le-VPC nokuthi isivakashi esisodwa ohlangothini ngalunye siyaphendula. Bese ubhala amapheya okugcina eceleni kwamagama emihubhe, ukuze ukwakha kabusha okulandelayo kuqale kuthebula eliqinisekisiwe hhayi kusifinyezo sekhonsoli.