Indlela yokumodela ukugeleza kwe-VPN nge-ASA packet-tracer

I-packet-tracer ku-ASA iphendula umbuzo omncane: ingabe le phakethe, engena lapha nale tuple, izovunyelwa, futhi iyobe iyaphi. Ayiphenduli ukuthi uhlangothi olukude luthola okuthile. Iphutha elivamile ukufaka i-tuple ye-IKE yangaphandle lapho into ofuna ukuyihlola iwuhlelo oluhamba ngaphakathi komhubhe. Lungisa i-tuple kuqala, funda izigaba, bese uthola ubufakazi bangempela bakho konke umlingisi ongeke akubone.

Ukuhamba ngezansi kucabanga ukuthi i-ACL, umthetho we-NAT kanye nomongo we-tunnel-group kukhona phambi kwakho. Ngaphandle kwazo, okukhiphayo kuchaza inqubomgomo ongeke uyihlole.

Isinyathelo 1: bhala ukugeleza kwangaphakathi ngamazwi alula

Chaza uhlelo ngaphambi kokuthayipha noma yini. Umsingathi ongaphakathi ovula i-SSH esiya kuseva engemuva kwesango elikude uwukugeleza okukodwa kwe-TCP kwangaphakathi okunombobo womthombo othile. Yikho lokho kugeleza okuhlolwa yi-ACL nesihlungi se-VPN, ngakho yikho lokho kugeleza okukubhalayo.

Kubhale njengomusho, bese ukuhumusha isigaba ngasinye:

packet-tracer input inside tcp 10.30.0.25 53000 10.40.0.50 22 detailed

Isinyathelo 2: khetha ingangatho yokungena nendawo

Ukwangena iyindawo lapho iphakethe lifika khona, hhayi leyo eliphuma ngayo. Kumsingathi we-LAN oqalayo, iyindawo ye-inside. Kwiphakethe lokubuya leseshini efanayo, iyindawo ye-outside, futhi i-tuple iyaphenduka. Ukubhala indawo njengomthombo kuyindlela yesibili evame kakhulu yokuthola i-ALLOW ekholisayo kodwa engahlobene.

Amachweba nawo anendawo. Ichweba lesevisi lisekhasini lendawo kusicelo esiqaliwe, futhi ichweba lesikhashana lomthengi lisekhasini lomthombo. Imodeli enendawo ye-TCP engu-500 ichaza uhlelo lwe-TCP olulalela ku-500; ayiphenduki ibe ukuhlolwa kwe-IKE ngenxa nje yokuthi inombolo ivela kumyalo.

Isinyathelo 3: funda izigaba ngokulandelana

Isigaba ngasinye kokukhiphayo yisinqumo esinomnini: ukusesha komzila, i-ACL, i-NAT, bese kuba ukukhetha kwe-VPN noma umhubhe. Zifunde ngokulandelana okushicilelwe futhi ume esigabeni sokuqala esingavumelani nomklamo.

I-NAT ibamba abantu. Uma umthombo ohumushiwe uwela ngaphandle kwe-crypto ACL ekhetha ithrafikhi yomhubhe, ukugeleza kungavunyelwa futhi kungagqanyiswa ni. Umkhondo ushicilela ikheli elihumushiwe, ngakho qhathanisa nethrafikhi yomhubhe ethakazelayo hhayi nekheli lokuqala.

Isinyathelo 4: hlola ukuthi yikuphi ukudlula okukhethile

Isimo se-detailed sithatha izinketho ezidlula izihlolo, futhi i-Cisco ibhala inketho ye-bypass-checks ehlanganisa i-ACL, isihlungi se-VPN, i-uRPF nezihlolo zokukhohlisa ze-IPsec. I-ALLOW etholakala ngazo zidluliwe ithi umzila ne-NAT kuzosebenza, hhayi ukuthi inqubomgomo izokwamukela iphakethe langempela. Bhala izinketho eceleni komphumela.

Uma udinga impendulo yenqubomgomo, yisebenzise ngaphandle kokudlula. Uma uhlukanisa umbuzo womzila, yisebenzise nazo bese ulebula umphumela njengempendulo yomzila.

Isinyathelo 5: vala igebe ngokushintshana kwangempela

Imvume elingisiwe ima ku-ASA. Ukuthi isango elikude likuqondile iphakethe, ukuthi iseva lamukele ukuxhumana, nokuthi impendulo ibuyile yimibono ehlukene. Sebenzisa izibali zamaphuzu okugcina noma ukuthwebula okuncane endleleni evunyelwe.

Ezinye izinketho ze-trace ne-replay zidlulisela amaphakethe noma zigcina isimo. Landela indlela yokuziphatha ebhaliwe yokukhishwa kwakho nenqubo yokuxilonga evunyelwe esikhundleni sokuthatha yonke inhlobo njengosesho lokufunda kuphela.

Into umkhondo ongakwazi ukuyitshela

Gcina izinto ezine encwadini eyodwa: i-tuple, umthetho we-NAT ohambisanayo, umhubhe noma inqubomgomo okufanele ithwale ukugeleza, kanye nokubona okuqondene nendawo. Ngaphandle kwazo, unjiniyela wakamuva akakwazi ukuhlukanisa isinqumo senqubomgomo sendawo kusuka endizeni yokulawula esunguliwe nakusevisi esebenzayo. Ukwehluleka kokuqala okulandelwa yimpumelelo nakho akubona ubufakazi bokuthi umhubhe kwakufanele ukhuphuke phakathi; bhala isigaba kanye noshintsho lwesimo.

Qala nge-tuple yangaphakathi, ma esigabeni sokuqala esiphikisana nomklamo, bese kuthi ngemva kwalokho ufune ubufakazi bamaphuzu okugcina. Umkhondo uyisibikezeli senqubomgomo, hhayi irisidi yokulethwa.