I-GCP HA VPN iyala i-FortiGate: uhlobo lwe-ID yasendaweni aluhambisani
I-Google iqhathanisa ubunikazi obushiwo yi-FortiGate, hhayi ukhiye owabiwe ngaphambili kuphela. I-ID yasendaweni yohlobo lwe-FQDN iyahluleka kulolo hlolo kuyilapho ilogi isathi ukuqinisekisa.
I-AUTHENTICATION_FAILED evela ku-Google Cloud HA VPN ivamise ukubuyisela abantu kukhiye owabiwe ngaphambili, futhi ukhiye uvamise ukuba ulungile. Ithuneli ima esigabeni 1 ngoba i-Google iqhathanisa nenye into futhi: ubunikazi obushiwo umlingani ngesikhathi sokushintshana kwe-IKE. Ku-FortiGate lobo bunikazi bungashintsha uhlobo ngaphandle kokuthi othile ahlele ikheli. Uma ukhiye usufakwe kabusha izikhathi ezimbili, funda ilogi njengokungafani kobunikazi.
Ukwehluleka okukodwa, izivivinyo ezimbili
I-IKE iqinisekisa umlingani ngezinyathelo ezimbili ezihlukene. Ukhiye owabiwe ngaphambili ufakazela ukuthi izinhlangothi zombili zinomsito ofanayo, futhi ubunikazi obushiwo butshela ophendulayo ukuthi umlingani uzibiza ngokuthi ungubani. I-Google iqhathanisa lobo bunikazi nomlingani ebilungiselelwe nawo. Uma ishiywa yodwa, i-FortiGate ithumela ubunikazi obusekelwe ekhelini olususelwe kusixhumanisi sayo sokuphuma, futhi ukuqhathanisa kuyadlula ngaphandle kokuthi othile abone.
Izinyathelo zombili ziwela emgodini ofanayo kulogi, okuchaza umjikelezo ojwayelekile wokuthayipha kabusha ukhiye izikhathi ezine ngaphambi kokuthi othile afunde umthwalo wobunikazi.
Yini i-FortiGate eyifaka kumthwalo wobunikazi
Inkinga iqala lapho othile ebeka i-ID yasendaweni ukuze izinhlangothi zombili zivumelane. Izakhiwo ezintsha ze-FortiOS ziphawula lobo bunikazi njengegama lesizinda elifanelekile ngokuphelele ngisho nalapho inani elifakiwe liyikheli elinamachashazi. Ngakho i-Google ithola ubunikazi be-FQDN ngesikhathi ilindele ikheli, futhi iyenqaba isikhathi sokusebenza. Akukho lutho kumyalezo olusho ukuthi yiluphi uhhafu olwehlulekile, ngakho umbiko ufundwa njengokwehluleka kokuqinisekisa.
Khiqiza kabusha lokhu kanye ngokuthi ukulungisa amaphutha kwe-IKE kuvuliwe bese ufunda umthwalo wobunikazi okhipha ngempela udonga lomlilo.
Esigabeni esifanayo, qinisekisa amaqiniso amathathu ashibhile: inguqulo ye-IKE esetshenziswa izinhlangothi zombili, ukhiye oqondile kuhlanganise nezinhlamvu zokugcina ezingabonakali, nekheli lomlingani elilindelwe yi-Google. Aphendula imibuzo ehlukene, futhi ukhiye ohambisanayo awusho lutho ngobunikazi.
Izinketho, kanye nezindleko zayo ngayinye
Ikuphi ukuphuma kulungisa ungqimba oluhlukile, futhi akukho okukhona kukho konke ukusetshenziswa.
| Option | When it works | What it costs |
|---|---|---|
| Set an address identity on the firewall | Your firmware lets you choose the type | Behaviour you must retest per release |
| Put a public address on the negotiating interface | The firewall can hold a routable address | Not possible behind NAT |
| Terminate on a peer that accepts your identity | Another endpoint validates what you produce | A topology change |
Ukulungisa ubunikazi kudonga lomlilo iyimpendulo ehlanzekile kakhulu lapho i-firmware ikuvumela ukuthi ukhethe uhlobo futhi ugcine inani. Inkambu ikhona kwezinye izakhiwo futhi igcwalisa uhlobo ngendlela engalungile kwezinye, ngakho hlola inguqulo yakho esikhundleni sokuthemba amanothi okukhishwa.
Ikheli lomphakathi elingahamba emzileni kusixhumanisi sezingxoxo liyisixazululo esibhaliwe, ngoba lapho ubunikazi obuzijwayele buhambisana nalokho okulindelwe yi-Google futhi akukho ukubhala phezulu okudingekayo. Yilapho ukusetshenziswa okuningi kuphela khona, uma udonga lomlilo lungakwazi ukubamba ikheli elinjalo.
Ukuqeda kumlingani oqinisekisa lokho okukhiqizayo wushintsho lwe-topology. Kuthatha njengesinqumo somklamo hhayi njengesixazululo esinencazelo ethambile.
Lapho i-NAT isusa inketho eyodwa
Ngemuva kwe-NAT indlela yokuphuma ngokheli lomphakathi iyanyamalala, futhi okusele kuncike ekuziphatheni kwe-firmware ongakulawuli. Leli yiphuzu lokukhetha ngamabomu phakathi kokuthuthukisa, ukuhambisa umlingani, noma ukwamukela enye indawo yokugcina yefu. Lezi yizabelomali ezintathu ezihlukene, futhi ukukhetha okukodwa ngengozi yikho okwenza isixazululo sesikhashana sibe wukwakhiwa. Bhala ukukhetha nesizathu saso eceleni kwethuneli.
Ngaphambi kokuhumusha noma yini yalokhu, qinisekisa isimo sethuneli ohlangothini lwe-Google nokuthi i-IKE ayilahlwa nje endleleni. Iphakethe elilahliwe liphelelwa isikhathi; alikhiqizi ukwenqaba.
Yini okufanele ibhalwe ngesikhathi isebenza
Bhala uhlobo lobunikazi, inani laso, inguqulo ye-firmware nekheli lomlingani elalisebenza ngesikhathi ithuneli igcina ukuphakama. Ukubuyekezwa kwe-firmware kungashintsha okuzenzakalelayo futhi, futhi ukwehluleka okulandelayo kuzobukeka njengokungafani kokhiye. Uma ubunikazi bugcinwe eceleni kokhiye nekheli lomlingani, umuntu olandelayo uqala ngezivivinyo ezishibhile.
Lolo mbhalo futhi uyindlela eyodwa yokwazi ukuthi isixazululo sisadingeka yini ngemuva kokuthuthukiswa okulandelayo.