I-VPN ye-IPsec yama-WAN amabili ku-Junos: ukuhlanganisa indlela yomthombo negetiwe elifanele

Izixhumanisi ezimbili ze-WAN esizeni ngasinye zibonakala njengokuyisisekelo esengeziwe kuze kube yilapho uzama ukufakazela ukuthi yiluphi ipheya lamakheli umfudlana othile owusebenzisile ngempela. Ku-SRX, igetiwe elilodwa le-IKE lithwala i-interface eyodwa yangaphandle nekheli elilodwa lendawo; uhlu lwabangeneleli abakude aludali umthombo wesibili wendawo. Yingakho lo mhlahlandlela uqala nge-matrix yamapheya hhayi nge-configuration, ngoba i-Junos i-commit kalula umklamo ohlanganisa ingxenye kuphela yezinhlanganisela obuzihlosile. Ngihlangabezane nalokhu kuma-SRX345s amabili: ithunu yokulondoloza yakhuphuka kahle futhi yawa iseshini ngesikhathi sokubuyela.

Landela izinyathelo ngokulandelana: bhala uhlu lwamapheya okufanele uwasekele, yakha igetiwe elilodwa ngomthombo ngamunye wendawo, qinisekisa ukuthi yikuphi ukuxhumana okwathwala ithrafikhi, bese uthatha isinqumo ngemva kwalokho ukuthi uhlobo ngalunye lokuhluleka lungashintsha ini.

Dweba imephu yamapheya ngaphambi kokuthinta i-CLI

Uma isayithi A ingakwazi ukuphuma ku-A1 noma ku-A2 futhi isayithi B ingakwazi ukwamukela ku-B1 noma ku-B2, unamapheya amane amakheli angaphandle. Imiklamo eminingi idinga amabili kuwo njalo futhi ithatha amanye amabili njengokuzikhethela. Bhala i-matrix futhi umake umugqa ngamunye, ngoba umugqa ngamunye oyithembisa uzokubiza igetiwe, i-interface yethunu kanye nesinqumo somzila kamuva.

Ipheya ngalinye elidingekayo lidinga izinto ezintathu ngasikhathi sinye: i-underlay efinyelelekayo phakathi kwalawo makheli, ukwamukelana kobunikazi bozakwethu nekheli lomthombo kuzo zombili iziphetho, kanye nomzila wokubuyela ovikelwe. Ipheya elisebenza ohlangothini olulodwa kuphela lizokhombisa ithunu nokho, futhi ukuhluleka kuzovela kamuva njengethrafikhi yohlelo lohlangothi olulodwa.

Igetiwe elilodwa ngomthombo ngamunye wendawo, hhayi ngesayithi ngayinye ekude

Uhlu lwamakheli akude lungelinye igetiwe, kanjalo nomthombo wendawo. ireferensi yamagetiyu e-IKE igcina amakheli akude, i-interface yangaphandle, ikheli lendawo kanye nokuthola umlingani ofile njengezilungiselelo ezihlukene, futhi yilokho kanye iphuzu: imithombo emibili yendawo isho amagetiwe amabili kumayunithi amabili e-st0. Ukwabelana ngepholisi ye-IKE phakathi kwawo kulungile; ukugcina igetiwe elilodwa nokuthemba ukuthi lizokhetha umthombo omunye ngokwalo akulungile.

set security ike policy IKE-P1 mode main
set security ike gateway GW-A1 ike-policy IKE-P1
set security ike gateway GW-A1 address 198.51.100.20
set security ike gateway GW-A1 address 198.51.100.21
set security ike gateway GW-A1 external-interface ge-0/0/0
set security ike gateway GW-A1 local-address 203.0.113.10
set security ike gateway GW-A1 version v2-only
set security ike gateway GW-A2 ike-policy IKE-P1
set security ike gateway GW-A2 address 198.51.100.20
set security ike gateway GW-A2 external-interface ge-0/0/3
set security ike gateway GW-A2 local-address 192.0.2.10
set security ike gateway GW-A2 version v2-only

Bese uxhuma amathunu futhi unikeze iphrephiksi ekude ama-next hop amabili, elilodwa ithunu ngalinye:

set interfaces st0 unit 1 family inet
set interfaces st0 unit 2 family inet
set security ipsec policy IPSEC-P1 perfect-forward-secrecy keys group14
set security ipsec vpn VPN-A1 bind-interface st0.1
set security ipsec vpn VPN-A1 ike gateway GW-A1 ipsec-policy IPSEC-P1
set security ipsec vpn VPN-A2 bind-interface st0.2
set security ipsec vpn VPN-A2 ike gateway GW-A2 ipsec-policy IPSEC-P1
set routing-options static route 10.20.0.0/16 qualified-next-hop st0.1 preference 10
set routing-options static route 10.20.0.0/16 qualified-next-hop st0.2 preference 20

Ukuthi igetiwe elilodwa lingagcina izitatimende ezimbili zohlobo address kuncike ekukhishweni nasekutheni iyiphi inqubo ye-IKE esetshenziswa idivayisi. I-Junos endala esekelwe ku-kmd yamukela ikheli elilodwa elikude ngegetiwe ngalinye; izinguqulo ezintsha ziphatha abangeneleli abaningi kodwa zengeza imikhawulo yazo, futhi amaqembu okutholakala okuphezulu ayindawo evamile lapho lolo sizoxolo sincipha khona. Hlola amanothi okukhishwa kwenguqulo yakho eqondile ngaphambi kokukopisha lokhu kusuka ku-chassis endala.

Qinisekisa ukuthi yikuphi ukuxhumana okwathwala iphakethe

Ama-SA amabili namathunu amabili awasho ukuthi yikuphi okwedlulise iseshini. Buza idivayisi ngqo futhi uqhathanise izinkambu nepheya obuzihlosile:

show security ike sa detail
show security ipsec sa detail
show security flow session destination-prefix 10.20.1.0/24
show interfaces st0.1 | match packets

I-output enemininingwane isho igetiwe lendawo nelikude ngokuxhumana ngakunye, okuyiyona ndlela esheshayo yokubona ithunu elaxoxiswana ngayo kusuka kumthombo obungawulindele. Bese ubheka izibali zamaphakethe ngeyunithi ngayinye ku-st0.1 naku-st0.2 ngesikhathi udlulisa ithrafikhi; ithunu engathwali lutho igcina i-SA yayo futhi ibukeka iphilile kusifinyezo.

Nikeza uhlobo ngalunye lokuhluleka umtholi walo

Ukuphila komlingani, ukulahleka kwesixhumanisi esiphezulu sendawo, ukuhoxiswa komzila ovikelwe kanye nokwephuka kohlelo izehlakalo ezine ezihlukene. I-DPD iphendula eyokuqala kuphela, ngakho-ke yilungiselele ngesikhathi nangesilinganiso ongazivikela ngazo esikhundleni sokushiya okuzenzakalelayo futhi ucabange ukuthi kuhlanganisa konke okunye:

set security ike gateway GW-A1 dead-peer-detection interval 10
set security ike gateway GW-A1 dead-peer-detection threshold 3
set security ipsec vpn VPN-A1 vpn-monitor source-interface st0.1
set security ipsec vpn VPN-A1 vpn-monitor destination-ip 10.20.0.1

Ukuqapha ithunu okuhlola indawo ngaphakathi kwe-subnet ekude kuhlanganisa isimo i-DPD engasiboni: i-IKE iyaphila, igetiwe liyaphendula, futhi iphrephiksi evikelwe ayifinyeleleki nokho. Khetha ukuthi yikuphi kokubili okufanele kudonse ukuncamelayo, ngoba uma kokubili kucaca ngasikhathi sinye kuvela isiphepho sezinguquko esikhundleni sokushintsha okuhlanzekile.

Ungakhohlwa isiphetho esikude. Umzila okhethiwe ohlala ufakwe esayithini ekude uqhubeka ukhomba ethunwini osuke wayishiya, futhi asikho isikhathi sendawo esilungisa lokho. Shicilela indlela efanayo yokuncamelayo kubo bobabili ozakwethu, futhi ubhale phansi ukuthi isixhumanisi esibuyisiwe singathatha ithrafikhi ngokwaso noma kufanele sishintshwe ngesandla.

Nikeza ikheli elisha isixhumanisi esisodwa ngaphandle kokuthinta esinye

Uma i-ISP ikunikeza ibhlokhi elisha, shintsha ubudlelwano obubodwa ngesikhathi. Buyekeza i-address noma i-local-address kubo bobabili ozakwethu kulelo pheya, yenza i-commit, futhi ususe kuphela ukuxhumana okuthintekile ngenkomba esikhundleni sokususa wonke ama-SA kudivayisi. Ukususa konke kuthatha nethunu ephilile futhi kuguqula iwindi lokulungisa libe ukuphazamiseka.

Gcina umfudlana owodwa ohlulekile nemininingwane yayo yesehini njengobufakazi ngaphambi kokuhlanza noma yini, bese uphinda uqhube izivivinyo ezingenhla kupheya elisha lamakheli. Ukubuyisela isixhumanisi kuyisinqumo somzila, ngakho-ke thinta ukubuya njengenyathelo elihloliwe elihlukile esikhundleni sokucabanga ukuthi ukuthanda kwakudala kuzobuya ngokwako.

Vala ushintsho ngohlu olufushane lokuhlola

Umklamo wethunu ye-WAN emibili uqedwa lapho ungasho ipheya elingemuva kweseshini ngayinye, hhayi lapho ama-SA womabili esephezulu. Dweba uhlu olungezansi kudivayisi oyishintshe ngempela:

• Ipheya ngalinye elithenjisiwe linegetiwe, iyunithi ye-st0 kanye nokufakwa komzila.
• Ithunu ngalinye libonakale lithwala amaphakethe, hhayi nje ukubamba i-SA.
• Iziphetho zombili ziyavumelana ngokutholwa nangokuthi yiluphi uhlangothi olubuyisela ukuncamelayo.
• Umzila wokubuyela wepheya ngalinye ubhalwe eceleni komzila walo wokuya.

Uma umugqa uthile wehluleka, lungisa lelo pheya ngaphambi kokwengeza elilandelayo; ukugcwalisa amathunu amabili asebenza ngesigamu kwenza izibali zingabi nasizathu futhi indlela ye-failover ingabikezeleki.