Google HA VPN iya ku-router yakwa-Cisco: hlela umthombo womlingani kuqala
Qamba zombili izixhumanisi ze-Google, umthombo womlingani, isivumelwano se-IKEv2 kanye neseshini ngayinye ye-BGP ngaphambi kokumisa i-router yakwa-Cisco, bese ukhetha umlingani oyedwa noma ababili.
Isinqumo sokuqala ku-HA VPN esuka ku-Cisco siya ku-Google akusiyo ukuthi iyiphi iphrofayili yokubethela okufanele isetshenziswe, kodwa ukuthi idivayisi eyodwa yasendaweni noma ezimbili zizoqeda imigudu. Isango le-HA VPN lakwa-Google linezixhumanisi ezimbili, futhi ngayinye ilindele umgudu womlingani ohambisanayo. Lokho kukunikeza imigudu emibili noma ngabe unawo ama-router amabili noma cha, futhi umehluko ukuthi umthombo owodwa wamandla noma ukuthuthukiswa kwesoftware kungawisa lonke idizayini.
Isinqumo ukuthi idivayisi yomlingani eyodwa noma ezimbili
Khetha isakhiwo ngezimo ezintathu: ukuthi ungayamukela yini indawo yokwehluleka yasendaweni, ukuthi zombili izixhumanisi zefu kufanele zisetshenziswe yini, nokuthi imithwalo yakho yomsebenzi ibekezelela kangakanani ukuhlangana kabusha. Uma noma yisiphi kulezi zintathu siyimfuneko eqinile, ama-divayisi amabili omlingani yimpendulo eqotho.
Sinise lokho ngaphambi kokuvula ikhonsoli, ngoba impendulo ishintsha ukuthi mingaki imigudu namaseshini e-BGP okufanele ishidi lokusebenza likuchaze.
Bhala ishidi lokusebenza ngaphambi kwanoma yimuphi umyalo
Ishidi lokusebenza linemigqa emihlanu, futhi umugqa ngamunye udinga umnikazi:
| Row | What it records |
|---|---|
| Google side | Project, VPC, region, HA VPN gateway, and the external address of each interface |
| Peer side | The Cisco external addresses, plus the external peer VPN gateway resource that represents them |
| Tunnel pairs | Which peer interface maps to each Google interface, with IKE version, secret and crypto parameters |
| Routing | Cloud Router, local and remote AS numbers, and one inside BGP pair per tunnel |
| Workloads | Approved on-premises and VPC prefixes, and what firewall policy should permit between them |
Umthombo womlingani wangaphandle uchaza izixhumanisi zakho ngaphakathi kwe-Google Cloud, futhi ukuwudala akumisi i-router yakwa-Cisco. Lokhu kungalingani kuyamangaza labo abalindele ukuthi ikhonsoli yefu ibe umthombo weqiniso kuzo zombili iziphetho. Kuyisimemezelo salokho okufanele i-Google ikulindele, futhi i-router kusamele ihambisane nakho. Umhlahlandlela wesango lomlingani wakwa-Google uhlobanisa leso simemezelo nomsebenzi womgudu, we-BGP, we-firewall ne-we-IKE osekukweletayo.
Uma umugqa ungenaye umnikazi, uzogcwaliswa yilowo osesivikini ngesikhathi sokushintsha.
Gcina izindima ezintathu zamakheli zihlukene
Amakheli omlingani omphakathi athwala ukushintshana kwe-IPsec kwangaphandle. Ipheya ye-BGP yangaphakathi ingeyoxhumano lwengqondo oluvikelwe oluhamba phezu kwayo. Ama-prefix e-LAN ne-VPC amemezelwe achaza imithwalo yomsebenzi engemuva kwalolo xhumano. Ukukopisha ikheli langaphakathi le-VM endaweni yomlingani wangaphandle kuhlanganisa izindima ezimbili zokuqala, futhi ukwehluleka kubonakala njengenkinga yezingxoxo hhayi njengephutha lokufaka idatha.
Hlela imigudu emibili yomlingani ehambisanayo, eyodwa yesixhumanisi ngasinye se-HA VPN. Ukusebenzisa zombili izixhumanisi zefu akukususi ngokwako indawo yokwehluleka yasendaweni, ngoba yomibili imigudu isengawela ku-chassis eyodwa.
Bhala indima yekheli eceleni kwenani ngalinye eshidini lokusebenza. Lowo mkhuba owodwa uvimbela iningi lokuhlanganisa.
Humusha ishidi lokusebenza ku-release yakwa-Cisco
Qala emibhalweni yomlingani esekelwayo noma kuthempulethi yokumisa yakwa-Google ehambisana neplatform yakho, bese uhlobanisa isigcwalisi ngasinye neshidi lokusebenza. Hlola ngokukanye ukuqinisekiswa kwe-IKEv2, iziphakamiso ze-ESP, i-PFS kanye nemodeli yomgudu nokuhambisa, ngoba ukungafani komunye wazo kuvame ukubonakala njengokungafani komunye. Sebenzisa ipulatifomu yangempela kanye ne-release yesoftware ukukhetha okusekelwayo, ngoba iresiphi ye-Classic VPN iyindawo ehlukile yokuqala.
Gcina imfihlo eyabiwe kude nezithombe zesikrini, okunamathiselwe emathikithi kanye namanothi okusekela. Ukhiye owabiwe ngaphambili ofakwe kumazwana ecala ukuvezwa kwezimpawu zokungena, hhayi into yokuxazulula inkinga.
Uma ithempulethi neshidi lokusebenza kungavumelani, yima futhi ukuxazulule ephepheni. Idivayisi ngeke ikwahlulele.
Yamukela umgudu ngamunye ngobufakazi bawo
I-HA VPN idinga amaseshini e-BGP, futhi izingxoxo ze-IKE eziphumelelayo zisungula isigaba sokuqala kuphela. Iseshini yangaphakathi kufanele ivele, ama-prefix ahlosiwe kufanele amemezelwe futhi amukelwe, futhi imizila ewusizo kanye nezimvume ze-firewall kufanele zibe khona ngaphambi kokuba i-traffic yomthwalo womsebenzi ihamba. Ukurekhoda konke lokho njengokukhanya okuluhlaza okukodwa kufihla ukuthi yisiphi isigaba esihlulekile ngempela.
Rekhoda ubufakazi bokwamukela kumgudu ngamunye: izinhlangano zokuphepha ezixoxiwe, isimo somakhelwane we-BGP, ama-prefix afundiwe alindelekile kanye nomzila womthwalo womsebenzi ohlosiwe. Bese wenza ukuhlolwa kokwehluleka nokululama okulawulwayo, ngoba umgudu ongakaze wehluleke umgudu ongakahlolwa indlela yawo yokululama.
Leyo rekhodi ingasetshenziswa futhi lapho idizayini ishintsha ngokuzayo, futhi lowo umehluko phakathi kokusebenzisana nesiqephu somyalo okulahleka imicabango yaso.