I-NetExtender iyangena kodwa akukho kufinyelela: i-SonicWall yasendaweni + i-LDAP
I-NetExtender iyaxhuma kodwa akukho okuphendulayo: hlukanisa ukuqinisekiswa kwe-SonicWall, ubulungu besivisi be-SSL VPN kanye nezimvume zokufinyelela kwe-VPN zabasebenzisi basendaweni nabakwa-LDAP.
Ukungena kuphumelela, ithuneli iyaphakama, futhi akukho lutho ngemuva kwe-firewall oluphendulayo. Lelo phatheni ku-SonicWall SSL VPN ngokuvamile lisho ukuthi i-akhawunti idlulile ukuqinisekiswa futhi yama kwelinye lamalungelo amabili alandelayo: ukwamukelwa kusevisi ye-SSL VPN, noma imvume yokufinyelela isisetshenziswa. Ama-akhawunti asendaweni nawe-LDAP ahlangene enza kubi kakhulu, ngoba izitolo ezimbili zifinyelela lawo malungelo ngezindlela ezahlukene. Isibonakaliso siyafana kusukela kuklayenti, yingakho izingqimba kufanele zihlukaniswe ngamabomu.
Isibonakaliso kanye namalungelo amathathu angemuva
Izinqumo ezintathu ezizimele zimi phakathi kwegama lomsebenzisi neseva efinyelelekayo. Indlela yokuqinisekisa inquma ukuthi imininingwane yokungena iyamukelwa yini nokuthi iyiphi indawo yokugcina eyamukelayo. Ubulungu besevisi ye-SSL VPN bunquma ukuthi lowo muntu angayisebenzisa noma cha i-SSL VPN. Uhlu lokufinyelela lwe-VPN lunquma ukuthi yiziphi izindawo zangasese isikhathi esingazifinyelela. Ukudlula okukodwa akusho lutho ngezimbili ezilandelayo.
Umsebenzisi oqinisekisayo kodwa ongekho eqenjini lesevisi ye-SSL VPN ubona uxhumano olusungulwayo bese lungathwali lutho, futhi ilogi ye-firewall ibonisa ukungena okwamukelwe esikhundleni sokwehluleka. Leli yicala okufanele laziwe ngokushesha, ngoba isisombululo ubulungu beqembu hhayi ukusetha kabusha iphasiwedi.
Umsebenzisi owamukelwayo kodwa ongenazinsiza ubona isikhathi esixhumayo futhi esingaqondisi ndawo ewusizo. Kokubili kubukeka njengethuneli eliphukile kusukela kudeski losizo, futhi kokubili kuwukulungiselelwa hhayi ukuxhumana.
Ibhomu lesizinda akulona uhlu lwamakheli
I-NetExtender icela isizinda, futhi leyo nkambu ayisona isisekelo sokusesha se-Active Directory. Ekuhlelweni okuzenzakalelayo inkambu kufanele ilingane nesizinda somsebenzisi we-SSL VPN esilungiselelwe i-firewall, futhi inani elizenzakalelayo elibhaliwe lilo LocalDomain. Ukuqhathanisa kwehlukanisa izinhlamvu ezinkulu nezincane, ngakho inani elithayiphwe ngezinhlamvu ezinkulu ezihlukile lihluleka ngisho i-akhawunti ilungile.
Uma ukuhlukaniswa kokuqinisekisa kulungiselelwe, amagama ezigaba akhetha umongo wokuqinisekisa wangaphandle, futhi inani elizenzakalelayo elilungiselelwe ligcina indima yalo. Kuzo zombili izinhlelo, ilebula lesizinda lohlangothi lweklayenti alidluliselwa ku-LDAP noma ku-RADIUS njengengxenye yegama lomsebenzisi, ngakho alikwazi ukuqondisa ukusesha kohlu lwamakheli.
Gcina izintambo ezintathu zihlukene kumanothi akho: isijobelelo se-DNS senkampani, isisekelo sokusesha se-LDAP kanye nelebula lesizinda le-NetExtender. Zibukeka zifana futhi akukho eyodwa ethatha indawo yomunye. Kopisha inani lomqhubi walesi sifakelo hhayi inani elivela kuthunyelwe lwenkundla mayelana nokunye ukukhishwa kwe-firmware.
Ukwamukelwa nokufinyelela kwensiza kungamalungelo ahlukene
Ama-akhawunti asendaweni adinga ubulungu eqenjini lesevisi ye-SSL VPN ngaphambi kokuba isevisi iwamukele. Ama-akhawunti ohlwini lwamakheli afinyelela iqembu elifanayo ngokusebenzisa uhlelo olusekelwayo lokumaka amaqembu, okusho ukuthi ubudlelwano beqembu le-LDAP kufanele bulungiselelwe bese buqinisekiswa njengobulungu obusebenzayo esikhundleni sokucatshangwa kusukela ohlangothini lohlu lwamakheli.
Ukufinyelela kwensiza kuza ngemuva kwalokho, ngaphansi kokufinyelela kwe-VPN kumsebenzisi noma eqenjini. Nikeza ama-subnet namasevisi athile adingwa yindima, futhi umelane nendlela emfushane yokunikeza i-LAN yonke ngoba kudingeka uhlelo lokusebenza olulodwa. Imizila yesikhathi, imithetho yokufinyelela kanye nezimvume zesevisi yendawo ekuyiwa kuyo kufanele konke kuhambisane nalo mkhakha.
| Layer | What it decides | Where it is set |
|---|---|---|
| Authentication | Whether the credential is accepted, and by which store | Authentication method and directory configuration |
| Admission | Whether the identity may use the SSL VPN | SSL VPN service group membership |
| Resource | Which destinations the session may reach | VPN Access on the user or group |
Umzila kuklayenti wenza indawo ikwazi ukukhethwa futhi awuyinikezi imvume. Ubulungu beqembu le-SSL VPN futhi abenzi i-akhawunti ibe umlawuli we-firewall, futhi akufanele kuthathwe njengokunikezwa kwamalungelo jikelele.
Izinombolo ezimbili, ukuhlola okune ngakunye
Hlola nge-akhawunti eyodwa yasendaweni ne-akhawunti eyodwa yohlu lwamakheli, zombili zigunyazwe ngokuncane futhi zombili zibhalwe njengama-akhawunti okuhlola. Kwelinye nelinye, rekhoda umthombo wokuqinisekisa owamukele ukungena, amaqembu asebenzayo, ukufinyelela kwensiza okwabiwe kanye nokwenziwa kohlelo olulodwa okuvunyelwe. Ukuhlola okune, izitolo ezimbili kanye nomphumela obhaliwe kukho konke ukuhlanganiswa.
Bese uhlola izimo ezingezinhle: insiza okungafanele i-akhawunti iyifinyelele, ne-akhawunti okufanele yenqatshwe ngokushesha. Idizayini ekhombisa kuphela indlela enhle ivamise ukushiya umnyango wesibili uvulekile, ikakhulukazi lapho igama lomsebenzisi elifushane lifana likhona kuzo zombili izitolo. Khubaza i-akhawunti yohlu lwamakheli bese uqinisekisa ukuthi eyasendaweni ayiqhubeki isebenza ngokuthula.
Buyekeza amagama aphindwe kabili njengengxenye yokwethulwa hhayi ngemuva kwesigameko. Umuntu ofanayo ezitolo ezimbili uyikho kokubili ukunethezeka kosizo kanye nenkinga yokucwaninga, futhi i-firewall izoqinisekisa ngokuzithokozela lowo oyilungiselele.
Gcina indlela yokubuyisela incane
Gcina inqubomgomo ye-MFA kukho konke ukuhlanganiswa kwama-akhawunti esikhundleni sokukhulula ama-akhawunti asendaweni kuyo. Uma ama-akhawunti asendaweni enikeza indlela yokubuyisela evunyelwe yokuphazamiseka kohlu lwamakheli, khawulela leyo ndlela kubalawuli abashiwo futhi uyisebenzise ngamabomu, ngoba i-akhawunti yezimo eziphuthumayo yasendaweni yomsebenzi ngamunye iwuhlelo lwesibili lokuqinisekisa olunokuqashwa okubuthakathaka.
Bhala isizinda seklayenti, umthombo wokuqinisekisa kanye nokufinyelela okusebenzayo kurekhodi elilodwa. Umlawuli olandelayo angakwazi ukukhiqiza kabusha idizayini yama-akhawunti ahlangene esebenzayo esikhundleni sokuzama izintambo zesizinda kuze kuphumelele ukungena.