Hambisa ithrafikhi phakathi kwamagatsha amabili ngesango le-VPN le-Azure
Ukuxhumana kwe-Site-to-Site okubili esangweni elilodwa le-VPN le-Azure kungadlulisa ithrafikhi yamagatsha, kodwa kuphela lapho zombili iziphetho zifunda iphreksithi futhi indlela yokubuyela ye-LAN ikhona.
Amagatsha amabili angashintshana ngezinto zokuhamba ngesango le-VPN le-Azure ngaphandle kwanoma yimuphi umhubhe oqondile phakathi kwawo. Igatsha ngalinye livula ukuxhumana kwe-Site-to-Site esangweni elifanayo, futhi isango lidlulisela iziphrefikisi ezifundiwe phakathi kokuxhumana okubili. Okukwenza lokhu kusebenze akusiwo umhubhe wesibili kodwa ukushintshana kwemizila: igatsha A kufanele lifunde iphreksithi yegatsha B, futhi B lifunde eyase-A. Landela izinhlolo ezilandelayo ngokulandelana futhi ume kowokuqala ohlulekayo, ngoba isinyathelo ngasinye esilandelayo sincike kuwo.
Izimo zokuqala, ngaphambi kokuthi uhlele noma yini
Izimo ezine zinquma ukuthi lo mklamo ungasebenza nhlobo yini. Isango kufanele lisekelwe emizileni futhi libe kwi-SKU esekela i-BGP, kokubili ukuxhumana kufanele kube ne-BGP evuliwe, izikhala zamakheli zamagatsha akufanele zidlulelane, futhi alukho uhlangothi olungathembela ku-NAT ukuze lufihle iphreksithi yalo yangempela.
Hlela ama-ASN ngamabomu. Inani elingu-65515 liwukungenasisekelo okuqoshiwe kwe-Azure, futhi irutha yegatsha ngalinye idinga i-ASN yayo yangasese engashayisani nesango noma nelinye igatsha. Ukusebenzisa kabusha inani elingenasisekelo ngaphandle kokuhlola ukuhlelwa kwesango okukhona yiyo indlela umzila we-AS wehla ngawo kamva.
Futhi qinisekisa ukuthi awulindeli ukuziphatha kwe-peering ye-VNet. Isango lishintshana ngemizila phakathi kokuxhumana okubili okukuhlelile; alikwenzi ukuxhumana okungahleliwe kudlule. Uma inethiwekhi yesithathu kufanele ifinyelele amagatsha womabili, idinga ukuxhumana kwayo noma umzila wayo, hhayi umcabango wokuthi isango lizosabalalisa ithrafikhi. Bhala lowo mngcele ngaphambi kwewindi lokuqala loshintsho, ngoba yisinqumo somklamo abantu ababuyela kuso lapho isayithi yengezwa kamuva.
Hlela ngokulandelana lokhu
Isinyathelo ngasinye sinomphumela obonakalayo, ngakho ungadluli kuze kube uvelile.
- Vula i-BGP esangweni lenethiwekhi ebonakalayo futhi ubhale i-ASN yalo nekheli le-peer.
- Dala isango lenethiwekhi yasendaweni egatsheni ngalinye ngesikhala samakheli sangempela salelo gatsha, i-ASN yalo nekheli le-BGP peer.
- Dala ukuxhumana kwe-Site-to-Site ngakunye futhi uvule i-BGP kukho uqobo.
- Hlela irutha yegatsha ukuthi ixhumane nekheli lesango elinikezwe yi-Azure, hhayi ngephoyinti lokugcina le-IKE lomphakathi lesango ngokucabanga.
Isinyathelo sesine yindawo lapho imizamo eminingi ima khona. Ikheli le-BGP peer elibikwa yi-Azure yilona irutha yegatsha okufanele ilisebenzise njengomakhelwane, futhi akulona njalo ikheli abantu abalilindele kumdwebo womhubhe.
Memezele iphreksithi yegatsha uqobo, isibonelo 10.10.0.0/16 kusuka ku-A kanye 10.20.0.0/16 kusuka ku-B. Ungamemezeli umzila ongenasisekelo noma iqoqo elibanzi ukumboza inethiwekhi ethile engekho; igebe liyabuya kamuva njengomgodi omnyama othule.
Qinisekisa ukushintshana kwemizila kuzo zombili iziphetho
Isimo sokuxhumana akusona isinhlolo. I-IPsec ingase isebenze kukho kokubili ukuxhumana kuyilapho kungekho phreksithi edlulayo phakathi kwabo. Funda ama-BGP peer esango nemizila efundiwe, bese uqinisekisa ukuthi umzila oya kwelinye igatsha uvela njengendlela esebenzisekayo.
| Check | Where | Stop if |
|---|---|---|
| BGP session established | Gateway BGP peers, branch router neighbour state | Session is Idle or Active on either side |
| Prefix learned | Gateway learned routes, branch BGP table | The other branch's prefix is absent |
| Prefix selected | Branch routing table, effective routes on the VNet | Prefix is known but a more specific route wins |
Iphreksithi ekhona kuthebula le-BGP ingase ilahlekelwe isinqumo sokudlulisa kumzila oqinile noma iphreksithi eqondile kakhulu. Hlola umzila okhethiwe, hhayi kuphela lowo owutholiwe.
Landela indlela yokubuyela ohlangothini lwe-LAN
Lena ingxenye ebonakala ilungile ku-Azure kodwa yehluleka endaweni. Umsingathi egatsheni A uthumela iphakethe lakhe kurutha ye-VPN yase-A kuphela uma leyorutha iyisango lakhe elingenasisekelo, noma uma umsingathi noma isango lakhe linomzila wephreksithi ye-B. Okufanayo kufanele kube yiqiniso nangakwelinye igatsha.
Uma iswishi yomgogodla ehlukile iyisango elingenasisekelo le-LAN, idinga umzila oya kwelinye igatsha okhomba kurutha ye-VPN. Ngaphandle kwawo isicelo siyafika futhi impendulo iphuma ngendlela ye-inthanethi, futhi umsebenzisi ubona ukuxhumana okuvulekayo bese kulenga.
Ungaphendukeli eqenjini lokuphepha kwenethiwekhi kusubneti yesango ukulungisa lokhu. Leyosubneti inezimfuno zayo, futhi i-NSG lapho ayiyona indawo yokushintsha esekelwe yenqubomgomo yohlangothi lwegatsha. Ukuhlunga kufanele kube ngezinqaba zomlilo zamagatsha nangemithwalo yomsebenzi uqobo, lapho imithetho ingabuyekezwa khona ngabanikazi bayo. Ukuhambisa leyo mithetho ku-NSG yesubneti kubafihla futhi eqenjini elizohlola iphutha elilandelayo.
Vumela umsebenzi, bese uwufakazela ngokuhlolwa okunqatshiwe
Umzila ofundiwe awusona isivumelwano. Vumela umthombo, indawo ekuyiwa kuyo kanye nensizakalo oyidingayo ngempela ngezinqaba zomlilo zamagatsha kanye nenqubomgomo yephoyinti lokugcina, futhi ushiye okunye kunqatshiwe.
Hlola kusuka kumthwalo womsebenzi ojwayelekile egatsheni A uya ensizakalweni yangempela egatsheni B, qinisekisa impendulo, bese uzama umsebenzi okufanele uhlale unqatshiwe. Ithrafikhi ekhiqizwa idivayisi ye-VPN uqobo ingase isebenzise ikheli lomthombo elihlukile futhi yeqe isigaba sokuhambisa se-LAN, ngakho i-ping ephumelelayo evela kurutha ifakazela okuncane kunalokho okubonakalayo.
Qeda ngokubhala amaqiniso amane: amaphreksithi ashintshiwe, ama-ASN asetshenziswayo, indlela yokubuyela ye-LAN ohlangothini ngalunye kanye nenqubomgomo evumela insizakalo. Uma kuphuthelwe elilodwa kulawo, ukusethwa kusebenza kuze kube ushintsho lokuqala, bese kungabikho muntu ongachaza ukuthi kungani.