Umnyango wesibili we-WAN VPN uyahluleka kuyilapho owokuqala usasebenza

Umhubhe wokuqala uhlala uvulekile, abasebenzisi baqhubeka nokusebenza, futhi isekethe yesibili ye-ISP ihlala ingasebenzi kungakhathaliseki ukuthi ushintsha ini. Ushicilele ikheli lesekethe yokugcina, wakhomba igama kulo, mhlawumbe wengeza umnyango wokugcina kukliyenti, futhi ikliyenti noma alikaze liwuzame noma liqinisekisa bese lifa. Ezimweni engizilandelele, isici sokushintshwa kwesikhashana besivame ukulunga; okwakungekho ngesinye sezinto ezinhlanu ezenza umnyango usebenziseke. Igama lingaxazululeka liye ekheli lokugcina kuyilapho kungelaleli lutho kuleyo interface, futhi isilaleli singamukela ukuxhumana kuyilapho impendulo iphuma ngowokuqala. Thatha i-WAN ngayinye njengomnyango ohlukile onenkontileka yawo, futhi ukuhluleka kuyeke ukubonakala njengephutha lekliyenti.

I-WAN ngayinye idinga inkontileka yayo yomnyango

Bhala izinkambu ezinhlanu kwi-WAN ngayinye: igama nekheli lomphakathi, ukuthutha kanye nechweba, i-interface noma umongo oyiqedayo, ubunikazi bozakwabo okufanele bubonise, nokuthi impendulo iphuma kuphi. Amasekhethi amabili asho amasethi amabili aphelele. Uma isethi yesibili ingenayo i-interface yokuqeda noma ingenayo indlela yokubuya, awunawo umnyango wokugcina; unerekhodi le-DNS elichaza inhloso.

Idivayisi kanye nenguqulo yalo kufanele futhi zisekele leli hlelo. Irekhodi le-DNS alikwazi ukuvula isevisi kwenye i-interface, futhi ezinkundleni eziningi isilaleli sicutshungulwa ngokwekheli hhayi ngokwedivayisi. I-IPsec esekelwe ku-interface ku-ASA ihlanganisa amamephu e-crypto namaqembu omhubhe ne-interface yangaphandle, ngakho umgudu wesibili udinga inqubomgomo lapho lawo maphakethe afika khona ngempela. Imiklamo esekelwe emizileni yenza ngendlela ehlukile: isilaleli singabopha kukho konke amakheli noma kwikheli elilodwa eliqanjiwe, futhi lokho kukhetha kunquma ukuthi i-ISP B ingaphendula nhlobo yini.

Qinisekisa ukuthi i-WAN yesibili iyaphendula ngempela

Hlola ngaphandle kwemisekhethi yomibili, hhayi kumshini ongemuva kwesango, futhi uhlole igama eliqondile elisetshenziswa iphrofayela lekliyenti. Kusilaleli se-TLS, ukuhlola okusheshayo openssl s_client -connect ADDRESS:443 -servername vpn.example.com -showcerts okwenziwa kusuka kusibungu esingaphandle kwenethiwekhi yakho. Ufuna ukuxhawula okuphelile okuchungechunge lwakho luhambisana negama elisephrofayeleni, hhayi nje ichweba le-TCP elamukela ukuxhumana.

RFC 9525 lichaza ukuthi ikliyenti lihlola ini: ubunikazi ebelihlose ukubufinyelela, uma buqhathaniswa nesitifiketi isevisi esisethulayo. Umnyango wesibili obuyisela isitifiketi somnyango wokuqala, noma isitifiketi esizenzakalelayo esingabali nelilodwa lamagama, uhluleka lokhu kuhlola nakuba ichweba livulekile futhi udonga lomlilo luvuma.

Amaphethini amabili achaza iningi lokuhluleka lapha. Ukuxhumana okulengayo ngokuvamile kusho ukuthi asikho isilaleli kuleyo interface, umthetho wokufinyelela ovumela kuphela amanethiwekhi amancane okuqala, noma idivayisi yenkampani yezokuxhumana engaphambi kwesekethe yesibili elahla ichweba. Ukuxhawula okuphela ngobunikazi obungalungile ngokuvamile kusho indawo yokwethemba ehlukile, isibungu esibonakalayo esizenzakalelayo, noma ukucushwa okukopishiwe kusuka kokokuqala ngaphandle kokulungisa ubunikazi.

Landela impendulo, hhayi isicelo kuphela

I-WAN yesibili ivamise ukwephuka endleleni yokubuya. Isicelo sifika ku-ISP B, idivayisi iyaphendula, futhi impendulo iphuma ngomzila ozenzakalelayo ku-ISP A nekheli lomthombo ikliyenti elingakaze likucele. Ukuhumusha okunesimo kwenza kube kubi nakakhulu: uma imephu yakhiwe nge-interface yokuqala, iphakethe elibuyayo ligeja ukuhumusha noma liphethe umthombo odongeni lomlilo lwekliyenti olahla. Abahlinzeki futhi balahla amakheli omthombo angewona awekhethwe oyinikeziwe, yingakho lokhu kubonakala njengomgodi omnyama ohlangothini olulodwa esikhundleni sephutha lephrothokholi elihlanzekile.

Hlola isinqumo somzila wethrafikhi enomsuka kumnyango wesibili. Impendulo kufanele iphume nge-interface isicelo esafika ngayo, noma okungenani iphathe ikheli uhlangothi olukude olwamukelayo njengolwalolo mzila. Ezinkundleni zomzila wenqubomgomo, lokho kusho umthetho oboshwe ku-interface engenayo noma kumthombo ohunyushiwe, kanye nesitatimende sokuhumusha esiboshwe ku-interface ngayinye yangaphandle. Thwebula kuzo zombili izindawo ngasikhathi sinye ngenkathi ikliyenti lixhuma; i-SYN engena ku-ISP B ne-SYN-ACK ephuma ku-ISP A zixazulula umbuzo ngomzamo owodwa.

Nika ikliyenti indlela yokwazi ngomnyango wesibili

Ukushintshwa kwesikhashana yisinqumo sohlangothi lwekliyenti, futhi umndeni ngamunye wekliyenti ufunda ngezinye izindlela ngendlela ehlukile. Ku-ASA, uhlu lwamaseva okugcina luhanjiswa ngezici ze-webvpn zenqubomgomo yeqembu, kuyilapho amanye amakliyenti elindele uhlu ngaphakathi kwephrofayela noma iphrofayela yesibili yamanuwali umsebenzisi ayikhethayo. Umhlahlandlela wenqubomgomo yokuxhumana we-Cisco uchaza kokubili ulwazi lokugcina olucushwe kukliyenti nolunikezwa isango, futhi lezo zimininingwane eziqondene nephrothokholi akufanele zisetshenziswe kuyo yonke ikliyenti noma imodi yomhubhe. Qinisekisa ukuthi iyiphi indlela ikliyenti elisetshenzisiwe eliyisebenzisayo ngaphambi kokwakha umnyango wesibili eduze kwaleyo engalungile.

Kungakhathaliseki indlela, ikliyenti kufanele likwazi ukuxazulula igama elihlukile ngaphambi kokulahlekelwa umzila wokuqala. Lokho kuncika kulokho abantu abakugejayo: uma igama lokugcina liphendulwa isixazululi esifinyeleleka kuphela ngomhubhe osanda kuhluleka, ukubuyela emuva akukwazi ngisho ukuqala. Shicilela igama lesibili kusixazululi esiphendula endaweni noma nge-inthanethi. Lindela ukuqinisekiswa okusha nesikhathi esisha sohlelo lokusebenza ngemuva kokuthutha, ngoba ukushintshwa kwesikhashana kwekliyenti akukona ukushintshwa okunesimo futhi izikhathi ezinde azidluli.

Ikheli elilodwa kubablinzeki ababili kuwumkhiqizo ohlukile

Ukugcina ikheli elilodwa lomphakathi lifinyeleleka ngemisekhethi yomibili kuwumsebenzi womzila, hhayi ibhokisi lokumaka ku-VPN. Kudinga isikhala sekheli abablinzeki bobabili abazimisele ukusithwala, simenyezelwe ngendlela amanethiwekhi abo ayamukelayo, futhi yilokho okunikezwa i-multihoming enesikhala esizimele kumblinzeki kanye ne-BGP. Ukwabela ikheli le-ISP A ku-interface ye-ISP B akukuyisi lapho; iphakethe lifika kunethiwekhi engakaze simemezele leso siqalo futhi liyalahlwa phezulu.

Awudingi lutho kulokhu ukuze ushicilele iminyango emibili. Uma ikliyenti lingagcina amagama amabili futhi lishintshe phakathi kwawo, iminyango emibili ezimele yanele, futhi ugwema inombolo ye-AS, isivumelwano se-peering kanye nesiqalo okufanele samukelwe yonke indawo. Cabanga ngokukhetha ikheli elithwalekayo kuphela lapho udinga ngempela indawo eyodwa yokungena ezinzile amakliyenti angeke akwazi ukuyishintsha ngokucushwa kabusha, noma lapho ukushintshwa kwesikhashana okusekelwe ku-DNS nokubambezeleka kwe-TTL kwayo kukhulu kakhulu ekuphazamisekeni okuklama ngakho.

Yini okufanele ihlolwe ngokulandelayo

Sebenza uphume ngaphandle usuka kumnyango ohlulekayo ngalokhu kulandelana: ingabe ikheli lesibili liyaphendula ngaphandle, ingabe lethula ubunikazi ikliyenti elikulindele, ingabe impendulo iphuma ngendlela isicelo esafika ngayo, futhi ingabe ikliyenti lingafunda igama ngaphambi kokuba likudinga. Lapho impendulo ingu-cha, lungisa leso sigaba bese uhlola futhi ngephrofayela esetshenzisiwe hhayi ngesibungu sokuhlola, ngoba ukuxhawula okuvela elebhu kufakazela okuncane kunokuxhumana okuphelele okuvela kukliyenti langempela.

Gcina irekhodi elifushane nge-WAN ngayinye, elinekheli, ichweba, i-interface yokuqeda, igama lesitifiketi, indlela yokubuya kanye nomthetho wokuhumusha, futhi ulihlole futhi njalo lapho kushintsha isekethe, idivayisi ye-NAT noma inguqulo yekliyenti. Izindlela zokugcina ezingasetshenziswanga zibola buthule: akukho okuxwayisa ngomnyango ongasasetshenziswa muntu kuze kube usuku lapho wonke umuntu uncike kuwo.