Ingabe i-WAN interface eyodwa ingasekela i-VPN phakathi kwezindawo kanye ne-VPN yokufinyelela kude?

Ikheli elilodwa lomphakathi lingasekela ngesikhathi esisodwa umhubhe wegatsha nechibi labasebenzisi abazulazulayo. Kodwa alikwazi ukusekela umthetho owodwa wokwamukela owabiwe. Untanga wegatsha nomsebenzisi ozulazulayo bayehluka ekuqhakambiseni ukuthi bangobani, ekuhlolweni kwalobo bufakazi, kumakheli abawatholayo nasekutheni imigqa yokuqala engabaphendula. Uma usubheka ikheli langaphandle njengemininingwane yokuthutha hhayi njengobunikazi, umklamo uba lula kakhulu.

Isivivinyo esisheshayo somqondo: zama ukubhala womabili amarekhodi okwamukela ngaphambi kokuthinta i-router. Uma isimo esisodwa sokufanisa kufanele sihlanganise kokubili, inqubomgomo isivele ingacaci, futhi uphawu lokuqala luzobonakala njengokwehluleka kwe-routing noma kwe-firewall kuyilapho empeleni kuwukwehluleka kobunikazi.

Amarekhodi amabili ngaphambi kwanoma yikuphi ukucushwa

Irekhodi legatsha lifushane futhi lizinze. Lihlanganisa ikheli likantanga noma igama lesitifiketi, ukhiye owabiwe ngaphambili noma indawo yokwethemba yesitifiketi, ama-subnet avikelwe ezinhlangothini zombili, i-interface yomhubhe kanye nomzila oqinile othumela ithrafikhi eqondile egatsheni kulo mhubhe. Inkambu ngayinye iphathelene nontanga oyedwa owaziwayo kanye neqoqo eliqinile lemigqa yokuqala.

Irekhodi lokuzulazula libanzi futhi liyimfihlo ngokwengeziwe. Lihlanganisa iphrothokholi nechweba leklayenti, indlela umsebenzisi noma idivayisi eqinisekisa ngayo, ichibi lamakheli elinikezwa lapho ixhuma, izinsiza ichibi elingafinyelela kuzo, imigqa yokuqala yomhubhe ohlukanisiwe, amaseva e-DNS aphushwayo aya kuklayenti kanye nanoma iyiphi into yesibili. Inkambu ngayinye iphendula umbuzo mayelana nenani elingaziwa labasebenzisi hhayi ngegedi elilodwa.

Yilo mehluko wemininingwane oyisizathu sonke sokwehlukana kwezindima ezimbili. Iphrofayela yegatsha ingathemba ngokuphephile ukhiye owodwa ngoba ukhiye ungowomshini owodwa endaweni eyodwa. Iphrofayela yokuzulazula ethemba ukhiye weqembu owodwa kubo bonke ibhidliza ukuziphendulela komunsebenzisi ngamunye, futhi lokho kuvame ukutholakala kamuva, ekubuyekezweni kwesigameko hhayi ngesikhathi sokusatshalaliswa.

Lapho kuhlukana khona ukufaniswa kontanga nokuqinisekisa ubunikazi

Ku-IOS XE iphrofayela ye-IKEv2 ithwala amapharamitha angakwazi ukuxoxiswana ngawo kanye nemibandela esetshenziselwa ukukhetha untanga. Lokho kusho ukuthi uhlangothi lwegatsha nohlangothi lokuzulazula ludinga iphrofayela yalo ngayinye, ngisho noma luphelela ku-interface efanayo futhi ngisho noma lwabelana nge-PKI eyodwa ye-crypto. I-Cisco ibhala imisebenzi yephrofayela, ukuqinisekisa ubunikazi nokufaniswa kuyi- ncwadi yayo yokucushwa kwe-IKEv2 ye-IOS XE 17.

Iphrofayela yegatsha ivamise ukufanisa ubunikazi obuncane: ikheli elikude, i-FQDN noma isihloko sesitifiketi. Into efana ne-match identity remote address 198.51.100.10 255.255.255.255 ibopha untanga oyedwa, futhi i-authentication remote pre-share enokhiye ogcinwa endaweni ngayinye yanele. Gcina ukufaniswa kucacile ngangokunokwenzeka ngokuvumela kwayo uhlu lwabalingani, ngoba i-wildcard edlulanayo ephezulu ekulandeleni kokukhetha ingadonsela ithrafikhi yegatsha kuphrofayela engalungile.

Iphrofayela yokuzulazula ayikwazi ukubopha ikheli, ngakho ifanisa iqembu, i-key-id noma inkambu yesitifiketi, bese iyekela ukuhlolwa kwangempela komsebenzisi ku-AAA noma kunqubomgomo yokugunyaza enamathiselwe kuphrofayela. Lokho kwehlukana kubalulekile: ukuqinisekisa kontanga kuphendula ukuthi iklayenti livunyelwe yini ukwakha umhubhe, futhi ukugunyazwa komunsebenzisi ngamunye kuphendula ukuthi ithola liphi ichibi neziphi izinsiza. Ukusebenzisa ukhiye wegatsha njengokungena kwabo bonke kulahla impendulo yesibili.

Ukudlulisela nokuhumusha nakho kudinga ukwehlukana okufanayo

Ukwamukela nokufinyeleleka kuyizinkinga ezihlukene. Ukushintshana kwe-IKE ne-IPsec okuphumelelayo kufakazela ukuthi izinhlangothi ziyavumelana ngokhiye; akudali umzila oya echibini iklayenti elilitholile. Ngakho amachibi okufinyelela kude adinga indlela yokubuya: kungaba umzila oqinile okhomba ku-interface yomhubhe noma iphrothokholi yokuhambisa imizila efaka isifinyezo sechibi. Imigqa yokuqala yegatsha ivamise ukuza ngale nqubo yokuhambisa imizila esebenzela ingxenye esele yesiza.

Ukuhumusha yikhona lapho izindima ezimbili zivame ukushayisana khona. Ithrafikhi phakathi kwezindawo okufanele igcine amakheli ayo ayimfihlo idinga ukukhululwa ku-NAT okulinganiselwe kuleyo migqa yokuqala emibili, kuzo zombili izinhlangothi. Amaklayenti azulazulayo nawo avamise ukudinga ukukhululwa kwethrafikhi yawo engaphakathi komhubhe, kodwa ithrafikhi yawo eya ku-inthanethi ingaba idlula umhubhe ngomhubhe ohlukanisiwe noma iphume esikhungweni ngemva kwe-NAT. Ukukhulula konke okuza kumhubhe kuyiphutha elivamile, ngoba kususa nokuhumusha ethrafikhini eyidinga ngempela.

Gcina imithetho yokukhululwa incane njengemithetho yokwamukela. Uma isifinyezo sechibi nomugqa wokuqala wegatsha kudlulana, indlela yokubuya iba ngacaci kudala ngaphambi kokuba noma iyiphi iphakethe ilahlwe, futhi uphawu lubonakala njengesiza esilahlekelwa i-subnet ngezikhathi ezithile hhayi njengokwehluleka okumsulwa komhubhe.

Amacala okwamukela aveza inqubomgomo edlulanayo

Akha amacala amane bese uwasebenzisa ngokulandelana. Umsingathi egatsheni ufinyelela insiza yegatsha kuphela. Iklayenti elizulazulayo lifinyelela leyo nsiza ngokukhombisa ikheli lechibi lalo. Iklayenti elizulazulayo lizama umugqa wokuqala wegatsha okungafanele liwuthinte. Untanga wegatsha uzama ukuthola ikheli echibini lokufinyelela kude. Amabili okugcina yiwo abamba iphrofayela eyabiwe, ngoba ehluleka buthule ekuqaphelisweni okujwayelekile.

Bese uqinisekisa indiza yedatha hhayi ukucushwa. I-show crypto ikev2 sa ne-show crypto ipsec sa zisho ukuthi iyiphi iphrofayela nokuthi iziphi izikhethi ezathwala ukuhamba ngakunye, kuyilapho i-show ip nat translations nezibaloli zomhubhe zikhombisa ukuthi indlela yokubuya nokukhululwa kwahambelana ngempela yini. I-tracer noma ukubamba amaphakethe ku-interface yomhubhe kuvala umjikelezo.

Bhala ubunikazi obugqamile, ikheli lechibi kanye nenqubomgomo ekhethiwe eceleni komphumela ngamunye. Ukugijima kuphela lapho icala ngalinye lihambisana nerekhodi elilodwa ngqo, futhi kungekho cala elidinga ukukhululwa kwesikhashana ukuze liphumelele.