Indlela yokuhlukanisa umjikelezo wokuhlelela imizila nomzila oshwibayo ezindaweni ze-VPN
Umjikelezo wokuhlelela imizila nomzila ongazinzi kubangela ukulahleka okuphindaphindayo okufanayo. Izivivinyo ezintathu kumageyithiweyi ziyabahlukanisa ngaphambi kokuthi ushintshe noma yini.
Izindawo ezimbili, umhubhe owodwa kanye nesandulela esikude esiphendula isikhashana bese sithula. Ukusabela kokuqala ukukubiza ngokuthi umjikelezo wokuhlelela imizila, futhi ngezinye izikhathi kunjalo impela. Kodwa umjikelezo nomzila oshwibayo kukhipha isikhalo esifanayo futhi kudinga ukulungiswa okuphambene: enye isinqumo sokudlulisa esingapheli, enye isandulela esihlala siphuma kuthebula. Ukubona okuthathu kuyabahlukanisa, futhi kungenzeka uqoqe kukho konke ukuthathu kusukela emgqeni womyalo wegeyithiweyi ngaphambi kokuthinta isihlungi noma ukuqala kabusha umhubhe.
Umjikelezo unqunywa igxathu ngegxathu. Isayithi A likhetha u-B njengegxathu elilandelayo lendawo ekuyiwa kuyo, u-B ukhetha u-A kuleyo ndawo, futhi iphakethe liphelelwa yisikhathi ku-TTL ngemuva kwemijikelezo emibili. Ukushwiba kona kunqunywa iphrothokholi yokuhlelela imizila: isandulela siyahoxiswa, sifakwa kabusha noma sithathelwa indawo yigxathu elilandelayo elihlukile, ngakho amanye amaphakethe awanawo nhlobo umzila kuyilapho amanye elandela umzila olungile ngokuphelele.
Izivivinyo ezintathu ezixazulula umbuzo
Awudingi ukubanjwa kwamaphakethe esinqumweni sokuqala. Udinga isimo sesandulela kuzo zombili iziphetho, igxathu elilandelayo elikhethwa wuhlangothi ngalunye, kanye nenani lamagxathu eliphindayo noma elingaphendiyo. Uma isandulela sihlala sifakiwe negxathu elifanayo elilandelayo ngesikhathi ithrafikhi yehluleka, umjikelezo uhlala emzileni wokudlulisa. Uma isandulela sinyamalala futhi sibuya, iphutha lingaphezu kokudlulisa futhi ukulungiswa kungokwephrothokholi yokuhlelela imizila, hhayi umzila oqinile.
| Observation | Routing loop | Route flapping |
|---|---|---|
| Prefix in the table | Installed, same next hop throughout | Withdrawn and reinstalled, or next hop alternates |
| Hop count | Reaches zero at the same two gateways | Expires only while the prefix is missing |
| Failure shape | Consistent loss for that prefix from every source | Bursts, often after a link or peer event |
| Where the fix belongs | The site that owns the prefix, plus filters on the transit path | Advertisement, hold timers, or the flapping link |
Isixwayiso esisodwa ngaphambi kokuqala. Uma ufunda lokhu ngomhubhe ojikelezayo, isikhathi sakho sokuxhumana sizofa ngaso leso sikhathi uma ushintsha umzila. Vula ikhonsoli noma indlela yokuphatha engancikile kwisandulela osilungisayo.
Isivivinyo sokuqala: isandulela sizinzile noma siyabilisa
Buza i-kernel ukuthi yifake ini, hhayi ukuthi ifayela lokucwangisa lithembisa ini. Kugeyithiweyi ye-Linux, ip route get 10.20.30.40 wenza uphenyo olufanayo nolwenziwa umzila wokudlulisa, kuhlanganise namathebula wenqubomgomo, kuyilapho ip route show 10.20.30.0/24 likhombisa okufakiwe ngokwako. ip monitor route lisakaza zonke izinguquko ngesikhathi zenzeka, futhi yilona ndlela eshesha kakhulu yokubona isandulela sifika futhi sihamba.
Kumrutha osebenzisa i-FRR noma i-BIRD, ithebula lokudlulisa akulona elithakazelisayo. show ip bgp 10.20.30.0/24 libuyisela umzila okhethiwe kanye nesikhathi sawo sokusebenza; isikhathi sokusebenza esihlehliswa kabusha njalo ngemizuzu embalwa siwukushwiba ongakubiza ngegama, hhayi umjikelezo. show ip bgp summary likhombisa isimo somakhelwane kanye nenani lezandulela, ngakho umlingani ohlala ewa ususa icala emzileni wokudlulisa.
Bhala impendulo phansi ngaphambi kokushintsha noma yini. Ukuzinza imizuzu eyishumi ngesikhathi ama-ping ehluleka, nokunyamalala izikhathi ezine emizuzwini eyishumi kuholela ezinyathelweni ezahlukene ezilandelayo. Okwesibili kwenza zonke izinkolelo zomzila oqinile zingabi lusizo.
Isivivinyo sesibili: igxathu elilandelayo likhomba emuva kumhubhe wokungena
Umjikelezo udinga amageyithiweyi amabili avumelane. Esikhungweni esamukela iphakethe, bheka umzila iphakethe elizowusebenzisa ukuphuma: ip route get 10.20.30.40 from 10.10.5.20 nekheli lomthombo langempela, ngoba umthetho wenqubomgomo ungaphendula ngendlela ehlukile kunethebula eliyinhloko. Bese uphinda uphenyo esikhungweni esilithumele. Uma uhlangothi ngalunye lukhetha olunye njengegxathu elilandelayo lesandulela esifanayo, umjikelezo usufakazekile futhi akukho kubanjwa okungeza okuthile.
Imbangela cishe njalo isimemezelo okwakungafanele sidlule umhubhe. Umzila ozenzakalelayo ohlukaniselwa kabusha kumhubhe, ingqikithi ehlanganisa inethiwekhi engaphansi yesikhungo esikude uqobo, noma umzila oqinile okhomba kumlingani ukuze kuqinisekiswe — konke kwenza igxathu elifanayo elilandelayo lomabili. Umhubhe ungase ususungulwe ngokuphelele futhi usahambisa ithrafikhi embuthanweni; amanothi okudlulisa e-strongSwan achaza uhlangothi lokuhlelela imizila kwaleyo mfuneko.
I-WireGuard ifanelwe inothi layo, ngoba akukho simemezelo sokukhonjwa. wg show libala ama-AllowedIPs womlingani ngamunye, futhi i-kernel yamukela indawo ekuyiwa kuyo yomlingani kuphela uma ingena kulelo banga. Umjikelezo lapho ingubanga lama-AllowedIPs elihlangana noma umzila oqinile okhomba emuva ngaphesheya kwesixhumi, ngakho ukulungiswa kuhlala kulezo zindawo ezimbili futhi hhayi kwenye indawo.
Isivivinyo sesithathu: funda inani lamagxathu, hhayi izinkanyezi
traceroute -n -I 10.20.30.40 ne-mtr -n -r -c 20 10.20.30.40 kokubili kukhombisa umzila, futhi imodi ye-ICMP ivamise ukusinda ekuhlungweni okudla ama-probe e-UDP. Umjikelezo ubonakala njengokulandelana okufushane okuphindayo kwamakheli amabili ageyithiweyi afanayo kuyilapho i-TTL ikhuphuka njalo. Ukuwa kubonakala njengezinkanyezi ngemuva kwegeyithiweyi lokugcina eliphendulile, futhi igxathu elilodwa elithule akusona ubufakazi bakho konke.
Uma umzila ungacacile, funda i-TTL ocingweni. tcpdump -ni any -vv icmp kuwo womabili amageyithiweyi likhombisa i-TTL yephakethe ngalinye nekheli lomthombo lwayo yonke impendulo yesikhathi eseqile. Uma iphakethe lifinyelela esikhungweni esikude nge-TTL ephansi kunenani lamagxathu umzila ongawathwala, kukhona okungeza amagxathu i-traceroute engakukhombisi, futhi lokho kwenzeka uma isihlangu somlilo sesikhungo esisodwa siphendula ama-probe egameni lesinye.
Lungisa umnikazi wesandulela, bese uqinisekisa izinhlangothi zombili
Nquma ukuthi yisiphi isikhungo esidala indawo ekuyiwa kuyo nokuthi yimiphi imizila yokudlula evunyelwe, bese ushintsha isimemezelo noma umzila oqinile kulo mnikazi. Ukulungisa isikhungo esamukelayo kuyalinga futhi ngokuvamile akulungile: kufihla umjikelezo wesandulela esisodwa futhi kushiye isimemezelo esibi endaweni yaso kwesilandelayo. Amathegi omzila, uhlu lokusabalalisa kanye nemithetho ye-split-horizon zikhona ukuze kuvinjwe lokhu emthonjeni, futhi zibiza kancane kunesihlungi esihambisana nesandulela esisodwa.
Ngemuva koshintsho, qinisekisa ukuhamba nokubuya ngokuhlukana, ngoba umjikelezo ungathathelwa indawo umgodi omnyama ngaphandle kokuthuthuka okubonakalayo kwesibonakaliso. Sebenzisa ip route get kuzo zombili iziphetho, thumela ithrafikhi kusuka kusibungu okungewona ugeyithiweyi, futhi vumela ip monitor route ukuthi lisebenze okungenani isibali sikhathi esisodwa sokubamba ukuze ukushwiba kungathathwa njengokulungiswa.
Ngaphambi kokushintsha noma yini, qinisekisa lawa maphuzu amahlanu: isandulela sizinzile noma siyabilisa, igxathu elilandelayo kuzo zombili iziphetho likhomba emhubheni, inani lamagxathu liyaphinda noma cha, isikhungo esisodwa siphethe isandulela, futhi unendlela yokuphatha ebekezelela ushintsho. Uma okukodwa kwalokhu kuhlanu kungaziwa, ezinye ezine ziwukuqagela.