Ukunikezwa kwe-L3VPN: imizila yangasese, indlela ezenzakalelayo noma ithebula eligcwele?

Isifunda sakho sikhuphukile, i-VRF isilungisiwe, futhi umhlinzeki ubuza umbuzo omfushane onquma okusele kokuklama: okufanele ikuthole iphethelo leklayenti? Izimpendulo ezintathu zivamile futhi akukho nolunye oluvela eqinisweni lokuthi kukhona isitaki samalebula. Lezi izinqumo zesevisi mayelana nokuthi ukuhamba kushiya kuphi igatsha.

Ukuhamba ngokunikezwa ngokulandelana kuyindlela eshibhile yokwenza lokhu ngendlela efanele. Uqala ngokuthi kwenzekani ekuhambeni okungafani nanoma yini, bese ubhala amaprefikhi angasese nokuziphatha kwawo lapho kwehluleka, futhi ngemuva kwalokho kuphela ukhuluma ngokuthi i-feed engakanani ozimisele ukuyithwala.

Qala ngokuhamba okungaklanywanga muntu

Buza umbuzo owodwa ngaphambi kokuba noma yiluphi uhlu lwamaprefikhi luvele: lapho iphakethe lingafani nanoma yimuphi umzila wangasese, kufanele liye kuphi? Igatsha elinesifunda saso se-inthanethi ngokuvamile ligcina i-default yasendaweni, ngakho ukuhamba okuvamile kwewebhu kuphuma nge-firewall yasendaweni futhi akukaze kuthinte umhlinzeki. Kulelo klame i-VPN ithwala kuphela amasayithi angasese akude, futhi amaprefikhi athile kakhulu enza ukukhetha.

Igatsha elihloselwe ukusebenzisa umnyango ophuma maphakathi liyisimo esiphambene. Lapho i-default ikhomba ngaphakathi kwesevisi, futhi umhlinzeki noma isayithi eliphakathi lingumnikazi wokudlulisa, ukuhamba okubuyayo kanye nanoma yikuphi ukuhumusha. Ukuthi "i-default iye ku-VPN" ngaphandle kwalowo mnikazi kuveza igatsha elixazulula amagama kodwa elingafinyeleli lutho.

Lezi zakhiwo ezimbili ziyahluka endleleni ukwehluleka kokuhamba okubonakala ngayo, yingakho ukuqagela kuyabiza. Nge-default yasendaweni, umzila wangasese olahlekile uthumela lokho kuhamba ku-inthanethi, lapho i-firewall ilahla khona noma, okubi kakhulu, kukhona ongakuhlosanga kuphendula. Nge-default yaphakathi, ukulahleka okufanayo kususa ngokuphelele ukufinyelela kwe-inthanethi futhi ithikithi lifika ngokuthi "igatsha lonke liwile". Akukho kwehluleka okungalungile ngokwako, kodwa kunye kuphela okuhambisana nesevisi oyidayisile, futhi ukulungiselelwa kwe-BGP kukodwa ngeke kukutshele ukuthi wakha kuphi.

Bhala amaprefikhi angasese kanye nesimo sokwehluleka kwawo

Bhala uhlu lwamaprefikhi okufanele igatsha lifinyelele futhi uphawule ukuthi yimaphi ahlanganisiwe. Isihlanganisi esibanzi ngebhithi elilodwa sidonsa izindawo ezingaziwa ngaphakathi ku-VPN, futhi lokho kulungile kuphela uma uhlangothi olukude luyiphethe ngempela futhi luyidlulisa.

Bese uchaza ukuziphatha okuhloswe lapho isevisi yangasese yehluleka. Umzila wokulahla ogciniwe ugcina ukuhamba kude nomzila ongagunyaziwe futhi uveza ukuphazamiseka okuhlanzekile nokulindelekile. I-default entantayo ingagcina ukutholakala ngokuthuthela kumzila wokulondoloza, kodwa kuphela uma lowo mzila wokulondoloza ugunyaziwe ukuthwala lokho kuhamba.

Gcina ukutholakala kanye nokubuyela emuva okuvunyelwe njengezimfuno ezimbili ezihlukene embhalweni wokunikezwa. Amaqembu azihlanganisayo agcina ephikisana ngokuthi igatsha bekufanele liwe yini, esikhundleni sokuhlola ukuthi inqubomgomo ekuvunyelwene ngayo yasetshenziswa yini.

Hlola ukuthi i-CE yafaka ini ngempela

Inhloso yokulungiselela kanye nesimo sokudlulisa kuyahlukana ngokwanele ukuthi ukuqinisekisa kube ingxenye yokunikezwa, hhayi yokubuyekezwa kwesigameko. Emaphethelweni eklayenti e-IOS-XE, imiyalo emithathu engezansi iphendula imibuzo emithathu ehlukene: yini eyanikezwa, yini eyamukelwa nokuthi yini esetshenziswayo ngempela.

show ip bgp vpnv4 vrf BRANCH neighbors 192.0.2.1 received-routes
show ip bgp vpnv4 vrf BRANCH
show ip route vrf BRANCH 0.0.0.0

Gijima yomithathu ngosuku lokunikezwa hhayi ngemuva kwenyanga, ngesikhathi omunye esakhumbula okuvunyelwene ngakho. Umphumela wokuqala uncike ku-soft-reconfiguration inbound noma ku-route refresh egciniwe; ngaphandle kokukodwa kwalokho, i-CE ayikwazi ukukukhombisa ukuthi yanqaba ini. Eyesibili ikhombisa imizila eyamukelwe nengcono kakhulu ngemuva kwenqubomgomo. Eyesithathu itshela ukuthi i-default iya kuphi ngempela, futhi lowo umugqa oyisisekelo owusizo kakhulu kukho konke ukunikezwa.

Gijima izivivinyo ezifanayo ku-CE yesibili uma isayithi linamakhonkco amabili. Ukwamukelwa okungalingani phakathi kwamaphethelo amabili kuyimbangela evamile yokuthi "kusebenza kusuka kuseva eyodwa hhayi kwenye", futhi akubonakali kumehluko wokulungiselela obukeka ulingana.

Hlola i-feed enkulu esikhundleni sokuyicabangela

Kwesinye isikhathi iklayenti lidinga ngempela ulwazi lwemizila ye-inthanethi ngaphakathi kwe-VRF, kokuhamba kwenqubomgomo noma komnyango ophakathi oqondisa ngeprefikhi. Leso yisidingo okufanele sishiwo, sibekwe umkhawulo futhi sinikezwe intengo, hhayi i-default efihliwe. Kuhamba nayo imemori ye-RIB ne-FIB, i-CPU yokubuyekeza, ukunakekelwa kwezihlungi kanye nomnikazi wethebula elivelayo.

Izimpikiswano zomthamo ziyaphutha kuzo zombili izinhlangothi. Ithebula eligcwele alivimbelwe ngaphakathi kwe-VRF, futhi alitholakali mahhala. Ngokufanayo, awukwazi ukucabangela izindleko zanamuhla ngenani elidala lemizila, futhi ukwabiwa kwamalebula amancane akususi izindleko zokugcina imizila.

Isicaciso se-BGP/MPLS IP VPN sixoxa ngezinhlelo ezimbalwa zokufinyelela i-inthanethi eceleni kwesevisi ye-VPN uqobo futhi asimemezeli ithebula eligcwele noma i-default njengeyisibopho kukho wonke iklayenti, futhi yileso sigaba okufanele sikhunjuzwe lapho kuvela isimangalo "ngomkhuba ojwayelekile": RFC 4364.

Vala ukunikezwa ngokurekhoda isethi ekhangisiwe, isethi etholiwe kanye nesethi ekhethiwe eceleni kwenqubomgomo yokuphuma okuvunyelwene ngayo, nangokuhlola indawo eyodwa yangasese, indawo eyodwa yomphakathi ehlosiwe kanye nesimo esisodwa sokulahleka komzila. Irekhodi elisayiniwe lalezo zivivinyo ezintathu lixazulula izingxabano eziningi kunanoma yisiphi isitatimende mayelana nokuthi iningi lamanethi lenza ini.