Ukushintsha i-PSK ye-AWS VPN: ikuphi umhubhe ohlulayo, futhi nini

Ukushintsha ukhiye owabiwe ngaphambili womhubhe we-AWS VPN kwenza lowo mhubhe wehle kuze kuvumelane iziphetho zombili. Qinisekisa indlela yesipele kuqala, bese ushintsha umhubhe owodwa ngesikhathi.

Umhubhe wehla ngesikhathi lapho iziphetho ezimbili zingavumelani ngokhiye owabiwe ngaphambili, futhi uhlala phansi kuze kube yilapho izinhlangothi zombili zithwala inani elisha. Leyo ngxenye ilindelekile: i-AWS ithatha ushintsho njengokuphazamiseka komhubhe okhethiwe, futhi umlingani ngeke aqedele i-IKE ngenkathi okhiye behlukile. Okumangaza abantu ingxenye yesibili. Omunye umhubhe awuthathi ithrafikhi ngokwawo ngaphandle uma uhlolile ukuthi ungayithwala. Shintsha ngalolu hlelo futhi ukuphazamiseka kuhlala ngaphakathi komhubhe owodwa.

Kwenzekani ngempela lapho ukhiye ushintsha

I-ModifyVpnTunnelOptions ibhala kabusha izinketho zomhubhe owodwa, okhonjwa ngekheli lakhe le-IP langaphandle. Umhubhe uyadilizwa futhi wakhiwe kabusha, ngakho i-IKE ne-IPsec zixoxa kusukela ekuqaleni ngokhiye omusha. I-AWS ithi ukuphazamiseka kungathatha imizuzu embalwa, okuyisikhathi esanele ukuthi iphrothokholi yomzila ikubone. Omunye umhubhe kuxhumano olufanayo awuthintwa yilolu cingo.

Kunomunye umphumela okufanele uwazi ngaphambi kokuthumela noma yini. Umsebenzi wokushintsha uthatha isethi ephelele yezinketho zomhubhe, ngakho inkambu oyishiyayo ibhalwa kabusha ngenani layo elizenzakalelayo. Uma uke walungisa ubude bokuphila besigaba 1 noma sesigaba 2, noma izilungiselelo zokuthola umlingani ofile, dlulisa amanani amanje esicelweni esifanayo noma hlela ukuwabuyisela kamuva.

Funda amanani amanje kuqala, bese ushintsha inkambu eyodwa. Leyo kulandelana iyonke inqubo yalo msebenzi.

Qala ngokuqhathanisa umhubhe we-AWS nomlingani ofanele

Ikhonsoli ilebula imihubhe ngokulandelana, futhi idivayisi yakho ayilisebenzisi lelo lebula. Khomba umhubhe ngekheli lakhe le-IP langaphandle bese uwuqhathanisa nengxenye yomlingani esangweni lamakhasimende. Umhubhe 1 ekulungiselelweni kwendawo akubona ubufakazi bokuthi uhlela umhubhe i-AWS ewubiza ngokuthi umhubhe 1.

Qala ngokuxhumano uqobo, oluklelisa imihubhe yomibili kanye nokhiye omunye nomunye anawo manje:

aws ec2 describe-vpn-connections --vpn-connection-ids vpn-0123456789abcdef0 \
  --query "VpnConnections[0].Options.TunnelOptions[].[OutsideIpAddress,PreSharedKey]"

Ukhiye obuyayo yiwo osetshenziswayo manje. Wuqhathanise nokulungiselelwa komlingani ngaphambi kokushintsha noma yini, ngoba ukungafani okukhona kakade kuchaza umhubhe ongakaze uzinze.

Vumela omunye umhubhe ukuthi uthwale ithrafikhi kuqala

Imihubhe emibili kuxhumano olulodwa akufakazi ukuthi idivayisi yakho ilungiselele yomibili, ukuthi yomibili imemezela iziqalo ozidingayo, noma ukuthi ithrafikhi ihamba phakathi kwazo. Hlola ukuxoxa komhubhe wesipele, imizila yawo kanye nokugeleza kwensiza yangempela kuzo zombili izinhlangothi. Nge-BGP, ubumelwane obuphilayo bungubufakazi obusizo kodwa akufani nokuqinisekisa iziqalo. Ngomzila oqinile, qinisekisa ukuthi isango likhetha kanjani umzila nokuthi lenza ini lapho umzila okhethiwe unyamalala.

Uma okunye kungakwazi ukuthwala umthwalo womsebenzi, hlela ukuphazamiseka noma lungisa umhubhe wesipele ngaphambi kokuthinta ukhiye. Isibani sesimo ekhasini lekhonsoli akusona isethembiso sesevisi engaphazamiseki.

Shintsha umhubhe owodwa, bese uqinisekisa ngethrafikhi yangempela

Lapho indlela yesipele isiqinisekisiwe, ukulandelana kufushane. Bhala ikheli lomhubhe, umlingani wawo kanye nezilungiselelo ezingezona imfihlo, futhi gcina indlela yokuphatha eya esangweni engathembeli kumhubhe ozowuklebhula.

  1. Buyekeza umlingani wesango lamakhasimende lekheli langaphandle elikhethiwe, noma lungiselela ushintsho ukuze luqale ukusebenza ngemizuzwana ngemva kocingo lwe-API.
  2. Thumela ucingo lokushintsha ngokhiye omusha kanye nobude bokuphila namanani e-DPD amanje.
  3. Linde i-IKE ne-IPsec zibuye, bese uqinisekisa imizila neziqalo ezidingekayo.
  4. Dlulisa ukugeleza kwensiza okumelela kulo mhubhe futhi ubheke izinhlangothi zombili.

Umhubhe awusebenzeki ngenkathi iziphetho zingavumelani nangenkathi i-AWS isebenzisa ushintsho, ngakho ukubuyekezwa komlingani kufanele kulandele ngokushesha hhayi ngemva kwesidlo sasemini. Kuphela lapho umhubhe oshintshiwe uthwala ithrafikhi yangempela okufanele uphinde inqubo kwelinye.

Yima uma ukubuyisela noma umzila kungakaqiniseki ngemva komhubhe wokuqala. Imihubhe emibili esebenza kancane mibi kunowodwa owaziyo ukuthi uyasebenza.

Lapho ukubuyisela kukhasa, funda uhlangothi lwe-IKE

Umhubhe ohlala phansi ngemva kokuba iziphetho zombili zinesikhathi sokhiye omusha ngokuvamile ukungafani kwenqubomgomo okwadalulwa ukushintsha hhayi okwakhiwa. Iziphakamiso, ubunikazi obuthunyelwa umlingani kanye nezikhethi zethrafikhi kufanele kuvumelane nohlangothi lwe-AWS, futhi inani elasinda emhubheni osunguliwe lingasala lenqatshwa ngesikhathi sokuxoxa okusha. Funda isimo sokuxoxa kanye nomlayezo onanyathiselwe ngaphambi kokushintsha ukhiye okwesibili.

aws ec2 describe-vpn-connections --vpn-connection-ids vpn-0123456789abcdef0 \
  --query "VpnConnections[0].VgwTelemetry[].[OutsideIpAddress,Status,StatusMessage]"

Uma ushintsho kufanele uhlehliswe, ungabuyiseli ukhiye omdala ngenxa nje yokuthi wawusebenza ngaphambili. Thatha ukhiye ophuliwe njengophilwe futhi lungisa ukuxoxa esikhundleni salokho. Qeda ngokuqinisekisa imihubhe yomibili nokubuyekeza uhlu lwezimfihlo ukuze umlingani ngamunye abhale ukuthi unaniphi inani, futhi gcina imibhalo yezinketho zomhubhe we-AWS eduze kwe-runbook.

Izihloko ezihlobene