Ukushicilela isevisi yangaphakathi nge-VPN ye-ASA yendawo-kuya-endaweni

Izivivinyo ezinhlanu ezihleliwe zokuveza isevisi yangaphakathi nge-VPN ye-ASA yendawo-kuya-endaweni: ibanga elivikelwe, imodeli yomthombo, ukuhumusha, ububanzi bembobo, indlela yokuphendula.

Ukushicilela isevisi ehlala ngemuva kwe-VPN yendawo-kuya-endaweni kuwumsebenzi owodwa onezindawo ezinhlanu zokwehluleka, futhi zihluleka ngendlela eqondile. Umhubhe uyaphakama, ukuhumusha kuyavumelana, igatsha liyaphendula, futhi impendulo ibuya ngayo leyo ndlela. Uma noma yikuphi kwalokhu kungalungile, isiphequluli sikhombisa into efanayo: ukuxhumana okulengayo noma okusethwa kabusha. Sebenza uhlu kusuka phezulu kuye phansi futhi ume esivivinyweni sokuqala esihlulekayo.

Isivivinyo 1: umhubhe uvikela ikheli lomthombo

Qala ngomhubhe osewudlulisa ithrafikhi, bese uqinisekisa ukuthi ikheli ohlela ukulishicilela lingaphakathi kwebanga elivikelwe. Ku-ASA lelo banga livela ku-ACL yokubethela noma emizileni ye-VTI, futhi kufanele ihlanganise ikheli langempela lomthombo, hhayi isethi engaphansi esetshenziswa igatsha ukuze ilawulwe. Isikhethi esigeja umthombo sikunikeza umhubhe omile kanye nokugeleza okungangeni kuwo neze.

Qinisekisa lokhu ngezibali zomhubhe kanye nethebula yemizila ngaphambi kokuthinta ukuhumusha. Uma umthombo ungafinyeleleki kusuka esikhungweni ngomhubhe, akukho okunye kamuva kulolu hlu okungakulungisa.

Yima lapha uma ibanga elivikelwe nekheli lomthombo kungavumelani.

Isivivinyo 2: nquma ukuthi igatsha lizobona muphi umthombo

Igatsha libona ikheli langempela leklayenti noma elihunyushiwe, futhi lokho kukhetha kunquma indlela yokubuya. Ukugcina ikheli leklayenti kufundeka kahle kumarekhodi omthombo, kodwa lapho igatsha kufanele libuyisele izimpendulo zamaklayenti omphakathi ngomhubhe; umzila ojwayelekile we-inthanethi ubangisa kwenye inhlangothi futhi ukuxhumana kufa ngendlela eyodwa. Ukuhumusha umthombo ekhlelini igatsha eselivele liluhambisa ngomhubhe kususa leyo mfuneko.

Ukuhumusha kubuye kushintshe okungabhalwa umthombo kumarekhodi kanye nokuhambisana kwayo imithetho esekelwe kumthombo. Uma uhlelo ludinga ukwazi umuntu ongemuva kwesicelo, indawo yalokho ise-proksi ehlanekezelwe eqinisekisiwe, hhayi isinqumo se-NAT.

Isivivinyo 3: bhala ukuhumusha ngokuhambisana nezindawo zangempela zokuxhumana

I-ASA ihlola imithetho yokuhumusha ngokulandelana futhi ibika ukuthi iyiphi evumelanayo, ngakho-ke ipheya lezindawo zokuxhumana ngaphakathi komthetho akusona isihlobiso. Umthetho obhalelwe indlela evela ngaphandle uya ngaphakathi ngeke uvumelane nokugeleza okokungena nokuphuma kwayo kuhlukile kulokho obekucabanga.

Indlela oyakhayo inezingxenye ezine, futhi zozine kufanele zivumelane:

LegSourceDestination
Request from the internet198.51.100.25203.0.113.20:443
After destination translation198.51.100.2510.60.20.10:443
After source translation toward the tunnel10.10.250.1010.60.20.10:443
Branch reply10.60.20.1010.10.250.10
Restored reply to the client203.0.113.20198.51.100.25

Thatha amabanga kulelo thebula njengezindawo zokubamba. Okubalulekile ukuthi i-tuple ngemuva kokuhumusha iyikheli igatsha elilamukelayo ngomhubhe, nokuthi ukumephu okuhlanekezelwe kukhona esimweni se-NAT ukuze impendulo ibuyiselwe ekukhishweni.

Isivivinyo 4: khawulela umthetho wokufinyelela embotsheni eshicilelwe

Shicilela imbobo, hhayi umhambi. Umthetho ovumela umthombo kuyo yonke isevisi uguqula uhlelo olulodwa olushicilelwe lube indlela eya kukho konke okusetshenziswa umthombo, kuhlanganise nendawo yokuxhumana yokuphatha oyigcine ngamabomu ngaphandle kwe-inthanethi. Vumela imbobo eshicilelwe kusuka emthonjeni ohunyushiwe uya emthonjeni, futhi ushiye izevisi zokuphatha emzileni wazo we-VPN kuphela.

Hlola ukulandelana kwemithetho ngasikhathi sinye. Imvume ebanzi ehlala ngaphezu komthetho wakho oqondile yenza umthetho oqondile ungabonakali.

Isivivinyo 5: landelela isicelo esisodwa kanye nempendulo yaso

Ungaqali ngesiphequluli, ngoba isiphequluli sifihla ukuthi iyiphi ingxenye ehlulekile. Landelela ukugeleza esikhungweni bese ufunda umphumela ngaphambi kokushintsha noma yini.

packet-tracer input outside tcp 198.51.100.25 50000 203.0.113.20 443 detailed
show nat detail
show xlate
show vpn-sessiondb l2l

Ukulandelela kubiza ukuhumusha okuvumelanayo, umthetho wokufinyelela ovumele noma owenqabe ukugeleza, nokuthi iphakethe lahanjiswa yini lungene emhubheni. Uma kukhombisa ukuthi ukugeleza kuphuma endaweni yokuxhumana obekungalindelanga, ipheya lezindawo zokuxhumana kumthetho we-NAT alilungile. Uma kukhombisa ukwenqaba, ukulandelana kwemithetho akulungile. Uma kufinyelela emhubheni kodwa umthombo awuphenduli neze, inkinga iyindlela yokubuya yegatsha.

Bese uthumela isicelo sangempela esisodwa sivela ngaphandle futhi uqinisekise ukuthi impendulo ibuya ngomhubhe ofanayo. Bhala phansi ingeno eshicilelwe, ukuhumusha, ipheya lamakheli avikelwe kanye nomzila wokubuya njengerekhodi lokushicilela.

Izihloko ezihlobene