I-VPN yabaqashi abaningi: isango elabiwe, ngomqashi noma ngomsingathi
Umhubhe awukona ukwehlukaniswa kwabaqashi. Qhathanisa isango elabiwe, amasango omqashi ngamunye kanye nokuxhumana komsingathi ngamunye mayelana nokumephwa kobunikazi, umzila kanye nokuhoxiswa.
Nquma ukuthi ubani owamukela iklayenti nokuthi yini evimbela lelo klayenti ukufinyelela izinsiza zomunye umqashi. Lezi yizinqumo ezimbili, futhi ukukhetha i-IPsec, i-WireGuard noma umkhiqizo we-mesh akuphenduli kuzo zombili. Umhubhe ovuka ngokuphelele usengashiya wonke umqashi ekwazi ukufinyelela kwabanye bonke, futhi ukubuyekezwa okuthatha kokubili njengento eyodwa kugunyaza umklamo ongafanele. Qala ngokubhala imephu yeklayenti-kuya-kwinsiza: abaphathi, ukufinyelela kosizo, izinsiza ezabiwe kanye nemikhondo okufanele ihlale inqatshiwe.
Qala ngemephu, hhayi ngomkhiqizo
Leyo mephu ingumbhalo wokuqala, futhi ukukhetha ngakunye ngezansi kuyisinqumo nje sokuthi umngcele oyiphumezayo uhlala kuphi. Yigcine ikwazi ukubuyekezwa: umugqa owodwa iklayenti ngalinye, umugqa owodwa insiza eyabiwe ngayinye kanye nemikhondo enqatshiwe ebhaliwe.
Imephu okungekho muntu ongayifunda iyimephu okungekho muntu ozoyiphumeza.
Iphoyinti elilodwa lokwamukela kanye nenkinga yalo yokumephu
Ukubekwa ngakunye kunqunywa umbuzo owodwa wokusebenza, futhi ithebula ingukuqhathanisa konke.
| Placement | The question it lives or dies on |
|---|---|
| One shared gateway | How does an admitted identity end up limited to its own resources and its own routing context? |
| A gateway per tenant | Who owns each gateway, its credentials, its policy, its updates and its eventual retirement? |
| A connection per hosted machine | How do enrollment, per-machine policy and replacement work at fleet scale? |
Isango elabiwe lihlanganisa ukwamukela futhi lihlanganisa ingozi endaweni eyodwa: ukuxhumana phakathi kobunikazi bomqashi kanye nenqubomgomo yakhe. Amaqembu noma amakheli omhubhe kufanele axazululwe abe izimvume zezinsiza ezifanele, futhi ilebula ehlukile iklayenti ngalinye ayivimbeli lutho ngokwayo. Izimo zomzila ezihlukene zingagcina iziqalo ezigqagqene lapho inkundla ikusekela futhi umklamo ugcwele. Ithebula elivamile lomzila elabiwe alikwazi ukuhlukanisa iziqalo ezimbili zendawo efanayo ngenxa nje yokuthi abantu abangemuva bazo banama-akhawunti ahlukene.
Lokhu ukuhlolwa kwemiklamo eminingi. Abaqashi ababili abanombolayo ngaphakathi nge-10.0.0.0/8 badinga isimo somzila esihlukene, hhayi umkhuba wamagama.
Isango lomqashi ngamunye lithenga imingcele nezinhlelo
Isango elilodwa iklayenti ngalinye lenza eminye imingcele yokuphatha kube lula ukuyichaza, ngoba ukwamukela nenqubomgomo yalelo klayenti kuhlangene. Iphinda iphindaphinde izinhlelo ezidinga ubufakazi, izichibiyelo, ukuqapha kanye nomnikazi. Futhi ayiphoqi ukuhleleka okukodwa okunqunyiwe kwamakheli omphakathi: ukwabiwa kwamaphoyinti okugcina, ukuhumusha kanye nokuhlukaniswa kwezivumelwano kuncike kulokho okusekelwa ukusebenza ngempela.
Bala izinhlelo nabantu ngaphambi kokubala inzuzo yezokuphepha. Umklamo onamasango amane ngaphezu kwalokho ithimbi elingakwazi ukukuchibiyela awuhlukanisekile kakhulu empeleni.
Uma inani labaqashi lishintsha nyanga zonke, lowo modeli udinga indaba yokuzenzakalela hhayi ithempuleti.
Ukuxhumana komsingathi ngamunye kuhambisa umsebenzi
Ukuxhumana kumsingathi ngamunye omsingathisiwe akususi umsebenzi wokusebenza, kuwuhambisela emjikelezweni wempilo yomshini. Ukubhalisa, inqubomgomo ngomshini ngamunye, ukujikeleziswa kokhiye kanye nokushintshwa kuba yingxenye yokunikezela, futhi kwehluleka esikhathini esifanayo nomshini uqobo. Kumsingathi ombalwa ophila isikhathi eside emanethiwekhi ahlukene lokho kuvame ukulungile, futhi eqenjini elivele lalahlekelwa ukulandelela kokuthi iyiphi isithombe egijima kuphi, akuvamile.
Qamba indima yokukhishwa kobunikazi, izibuyekezo, ukususwa kokufinyelela, ukuqapha kanye nokubuyiswa ngaphansi kwenketho ngayinye. Bese ubuza ukuthi kwenzekani ngosuku lapho iklayenti elilodwa lihamba.
Ukuhoxiswa kuyingxenye yokuqhathanisa
Ukuqhathanisa okuningi kweqa ukuhoxiswa. Ukususa umqashi kufanele kwenze ubufakazi bakhe bungasebenzi, kwehlise inqubomgomo yakhe, kukhulule amakheli akhe nesimo somzila futhi kushiye bonke abanye bengathintekile. Iziqondiso ze-NIST zokwakhiwa kokwethembana okuyiziro ziyisithenjwa esifanele lapha, ngoba zibeka ukuqinisekisa nokugunyaza ensizeni esikhundleni sokwethemba indawo yenethiwekhi, futhi lokho kusebenza ngisho ngaphakathi kwengxenye yeklayenti uqobo.
Kala ukuhamba okuvunyelwe nokunqatshiwe, ukuphathwa kwamakheli agqagqene kanye nenqubo yokuhoxiswa ngaphambi kokukala izilinganiso zezivumelwano. Bese ukhetha ukuthutha nendlela yokuqinisekisa ehambisana nomngcele owukhethile. Igama lomkhiqizo elidala, noma isimangalo sokuthi wonke amabhizinisi kufanele ajwayele uhlobo olulodwa lwesivumelwano, akunqumi lutho kulokho. Imephu oyibhale kuqala iyanquma.