Ukufuduka kwe-VPN kusuka ku-IOS kuya ku-ASA: humusha isivumelwano, hhayi i-CLI
I-crypto map ayiyona i-tunnel-group ye-ASA. Iziphi izingxenye zesivumelwano ezidluliswayo, ziphi okufanele zakhiwe kabusha, kanye nokuhlola okufakazela ukuthi isevisi iyasebenza.
Ukulungiselelwa kwe-IOS okufika njengesireferensi yokufuduka kuya ku-ASA kuchaza isivumelwano esisongelwe ngolimi lweplathifomu eyodwa. Amakheli ombambisani, ubunikazi kanye namabanga avikelwe yisivumelwano. I-key ring, iphrofayili kanye ne-crypto map wuhlobo lapho i-IOS ibuveza ngayo, kanti i-ASA iveza umqondo ofanayo ngezinkomba ze-tunnel nezimfanelo zazo. Ukukopisha ingxenye yesibili akulokothi kusebenze, kanti ukukopisha eyokuqala kuphela kushiya umsebenzi usungxenye.
Landela izinyathelo ezinhlanu ngezansi ngokulandelana, futhi ma uyeke lapho amaplathifomu amabili echaza izinto ezahlukene hhayi amagama ahlukene kuphela.
Isinyathelo 1: hlukanisa isivumelwano kusuka kulimi
Bhala ukudluliselwa njengezimfuneko okuzwakala ngazo bobabili abalawuli. Imigqa emine ihlanganisa cishe konke: ukuthi umbambisani ukuphi nokuthi yiluphi uhlangothi oluqalayo, ukuthi uhlangothi ngalunye lufakazela kanjani ubunikazi balo, ukuthi yikuphi ukuvikeleka okwamukelekayo, nokuthi yiziphi izinhlelo okufanele zisinde kule tunnel. Akukho kule migqa okhuluma ngomyalo.
Gcina umbhalo wangempela njengobufakazi hhayi njengemiyalelo. Umugqa okhona kuplathifomu eyodwa kodwa ongekho kwelinye uhlala uyimehluko yolimi kuze kube yilapho uhlola ukuthi isidingo esifanayo singahlangatshezwa ngenye indlela yini.
| Requirement | What must be agreed |
|---|---|
| Peer delivery | Outer endpoint, address family, NAT view, initiating side |
| Authentication | IKE version, expected identities, credential method and delivery |
| Data protection | Permitted suites, protected ranges, intentional translation |
| Application | Routes, return routes, resources beyond the tunnel |
Isinyathelo 2: qamba izinto kuplathifomu ngayinye
Ku-IOS XE, i-key ring ye-IKEv2 yondla iphrofayili ye-IKEv2, futhi leyo phrofayili ixhunywa nge-crypto map noma nge-IPsec profile. Ku-ASA, i-tunnel group igcina i-connection profile kanye nezakhiwo zayo ze-IPsec, futhi i-crypto map ikhomba kuyo, njengoba incwadi ye-connection profile ichaza. Lezo zingqinamba zezinto ezahlukene ezinamafa ahlukene, yingakho ukumephu umugqa ngomugqa kuveza ukulungiselelwa okuhlaziyekayo kodwa okungaxhumekiyo.
Akha izinto eziqondiwe kusuka emigqeni yezidingo hhayi kusuka emigqeni yomthombo. Uma imigqa igcwele, ukulungiselelwa okuqondiwe kuyisinqumo somklamo kuphela. Uma kungenjalo, ukuhumusha imiyalo akukwazi ukunikeza umqondo ongekho.
Isinyathelo 3: thwala ubunikazi, hhayi amakheli kuphela
Ubunikazi yingxenye ephukayo ngokuthula. Umbambisani oqinisekisa ngamakheli unokuziphatha okuhlukile kwalowo oqinisekisa ngesihloko sesitifiketi noma nge-FQDN, futhi amaplathifomu amabili abhala lokho okulindelekile ezindaweni ezahlukene. Gcina ubunikazi obuhloswe kanye nochungechunge lokwethemba esikhundleni sokufaka i-shared secret ngoba kulula ukuyihlola.
Gcina i-preshared secret ngaphandle kwamanothi wokuqhathanisa namathikithi. Bhala ukuthi ngubani umnikazi wayo nokuthi ihamba kanjani ngesiteshi esigunyaziwe, futhi khumbula ukuthi isibikezelo esisuka esibonelweni sencwadi akuyona imininingwane yekhasimende.
Isinyathelo 4: vumelanani ngokuvikeleka ngaphambi kokushintsha
Ungadlulisi izilungiselelo zakudala zokubhalisa ngoba zivela embhalweni onikeziwe. Vumelanani ngokuhlangana kwama-suite womabili amabambisani asetshenziswayo akusekelayo, futhi kuqinisekise nalowo omunye umlawuli ngaphambi kwewindi loshintsho. Uma lokho kuhlangana kuhlukile kulokho umbambisani okhona akulindele, ukushintsha okuhlanganyelwe hhayi ukuhlela kwendawo.
Bhala phansi isethi evunyelweneyo. Abalawuli ababili abanemikhumbulo ehlukene ngocingo olulodwa yilapho ukushintsha kuveza ukungafani kwesigaba sesibili.
Isinyathelo 5: hlola isevisi, hhayi ulimi
Hlola izinto ezisebenzayo zomgogodla kuqala, bese kuba ukuhlangana okwamukelwe, bese kuba ukugeleza kohlelo lwangempela kanye nempendulo yako. Ukufaka umyalo ngaphandle kwephutha kufakazela ulimi kuphela, akukho okunye. I-tunnel ephumayo engathwali thrafikhi ngokuvamile isho ukuthi amabanga avikelwe noma umzila wokubuya awuvumelani nolunye uhlangothi, okuyinkinga yomugqa wesidingo hhayi yomyalo. Qhathanisa amabanga avikelwe ezinhlangothini zombili ngaphambi kokuthinta i-crypto map futhi.
Bhala lokho okuhlolile, ngamakheli aphi, kusuka kuluphi uhlangothi. Lowo mbhalo uguqula isimangalo esingacacile sokuthi i-VPN iphumile sibe yinto umlawuli omunye angayihlola ngokuzimela.
Okufanele kubuyiselwe
Thumela i-matrix yezidingo, isifinyezo sokulungiselelwa okuqondiwe kanye nemiphumela yokuhlola. Sithe ngokucacile ukuthi yiziphi izilungiselelo zomthombo ongazange uzidlulise nokuthi kungani. Lolo hlu luwusizo kunokulungiselelwa okuhunyushiwe, ngoba yilapho ukungavumelani okulandelayo kuzoqala khona.
Gcina nombhalo womthombo kanye nethikithi. Uchaza lokho okwakuceliwe, kanti i-matrix ichaza lokho okwavunyelwana ngakho.