Ingabe kufanele unike amandla amalogi ethumbu le-AWS VPN ethumbini elisebenzayo?

Ukuvula amalogi omsebenzi wethumbu we-VPN ye-Site-to-Site ukushintshwa okuncane okungawisa ithumbu elililinganisayo. I-AWS ixwayisa ukuthi ukunika amandla ukulogi ethumbini elikhona kungaphazamisa ithumbu imizuzu embalwa, ngakho umbuzo othakazelisayo akukhona ukuthi usuguqula kanjani ifulegi kodwa ukuthi usuguqula kuluphi ithumbu futhi nini. Izimo ezintathu zinquma ukulandelana: ukuthi elinye ithumbu liyayithwala ngempela imizila, ukuthi udinga izehlakalo zesevisi noma izehlakalo ze-BGP, nokuthi ushintsho ludlula kukhonsoli noma ku-API yezinketho zethumbu. Uma wephutha lezi, uzogcina ngokuphazamiseka noma ngeqembu lamalogi eligcwele lutho.

Izimo ezintathu zinquma ukulandelana

Qala ngobunikazi balokho okushintshayo. Udinga i-ID yoxhumo lwe-VPN, isifunda kanye nekheli le-IP langaphandle lethumbu elithile, ngoba zonke izilungiselelo zamalogi kulesi sici zisekelwe ethumbini hhayi kuxhumo. Ushintsho olusetshenziswe ekhelini langaphandle elingalungile wushintsho ethumbini okungekho muntu owayelixazulula.

Indawo okufunekayo iqembu lamalogi le-CloudWatch esifundeni esifanayo, ngokugcinwa nangomgomo wokufinyelela oyifunayo ngempela. I-AWS incoma isiqalo /aws/vendedlogs/ kula maqembu ngoba sigwema imikhawulo yosayizi womgomo wezinsiza okungenzeka amagama ajwayelekile ahlangane nayo. Igama elifana ne-/aws/vendedlogs/vpn/branch-a-activity liyisibonelo kuphela; okubalulekile ukuthi iqembu likhona, ukuthi indima yokuletha ingabhala kulo, nokuthi kokubili kuphethwe umnikazi wokuhlelwa kwe-VPN. Igama aliniki izimvume, futhi iqembu elidalwe ngaphandle komgomo wokuletha likhiqiza ukuthula esikhundleni sephutha.

Isimo sokuqala: ithumbu eliyisipele elithwala ngempela ithrafikhi

Lesi yisimo amaqembu ayigxuma. Amathumbu amabili alungiselelwe akabona ubufakazi bokuthi uhlelo lunendlela ehlukile esebenzisekayo.

Ngaphambi kokuthinta ithumbu elilodwa, qinisekisa ukuthi elinye lithwala imizila ebalulekile: hlola ithebula lokuhambisa ohlangothini lwesango lekhasimende futhi qinisekisa ukuthi uhlelo lungakwazi ngempela ukushintsha. Iwindi lokuphazamiseka le-AWS lingamaminithi, hhayi amasekhondi, futhi ithumbu elikhona ephepheni kuphela liguqula ushintsho lokuxilonga lube ukuphazamiseka. Uma indlela eyisipele ingakafakazelwa, hlela ushintsho ngokunakekela okufanayo nanoma yiluphi olunye ushintsho lokuhambisa esikhundleni sokuthatha ukulogi njengento engasebenzi. Linganisa ithumbu ozama ukuchaza indlela eliziphatha ngayo, hhayi elitholakala kalula.

Isimo sesibili: ilogi yomsebenzi noma ilogi ye-BGP

Lena inquma ukuthi uzokwazi ukufunda ini ngempela. Amarekhodi omsebenzi ahlanganisa izehlakalo zesevisi ezifana nokushintsha kwesimo se-IKE ne-IPsec kanye nemilayezo ye-DPD, okuyikho okudingayo lapho ithumbu lingavuki noma lihlala lishintsha okhiye. Amarekhodi e-BGP awumfula ohlukile onezilawuli zawo, futhi aphendula umbuzo ohlukile: ukuthi imizila yashintshwa futhi yahoxiswa ngendlela obekulindelekile yini.

Ukuvula ifulegi lomsebenzi akusona isicelo sawo wonke umfula osevisi engawukhipha. Uma ukusola kukuhambisa, vula kokubili; uma ukusola kusezingxoxweni zesigaba 1 noma sesigaba 2, umfula womsebenzi yiwo ozokubonisa.

Awukho umfula okungukuthwebula kwamaphakethe, futhi umehluko lowo uxazulula amathikithi amaningi kunalokho obekufanele. Amarekhodi omsebenzi ne-BGP akutshela okwenziwe yisevisi ngethumbu nangesikhathi, hhayi okuthunyelwe wuhlelo lwakho ngalo. Ukufinyelela amalogi ethumbu ukuxazulula ukuphela kwesikhathi kohlelo kuyiphutha lesigaba, futhi ngokuvamile kubiza iwindi elilodwa lokuphazamiseka ngaphambi kokuba othile abone. Khetha umbuzo kuqala, bese kuba umfula ongawuphendula.

Isimo sesithathu: ushintsho lwekhonsoli noma i-API yezinketho zethumbu

Uma umuntu enza ushintsho lwesikhathi esisodwa, indlela yekhonsoli ilungile: VPC console, Site-to-Site VPN connections, khetha uxhumo, Actions, Modify VPN tunnel options, khetha i-IP yangaphandle, vula i-Tunnel activity log, khetha iqembu nefomethi yokuphuma, gcina ngaphakathi kwewindi. Uma i-VPN iphethwe njengekhodi, ukuchofoza okufanayo ukwehluka ozokulungisa kamuva.

Okwenzelwe ukuzenzakalela, ingxenye yelogi yomsebenzi yezinketho zethumbu inesimo esingaguquki: i-LogOptions iqukethe i-CloudWatchLogOptions kanye ne-LogEnabled, i-LogGroupArn ne-LogOutputFormat. Leyo ngxenye iyingxenye, hhayi isicelo; i-modify-vpn-tunnel-options isadinga i-ID yoxhumo ne-IP yangaphandle yethumbu, futhi izinyathelo zethumbu ezisele kufanele zilondolozwe umnikazi wesifanekiso. Ukulogi kwe-BGP kusebenzisa okhiye bakho i-BgpLogEnabled, i-BgpLogGroupArn ne-BgpLogOutputFormat esakhiweni esifanayo. Funda ushintsho emuva nge-describe-vpn-connections esikhundleni sokukholwa ukuthi ucingo lusetshenzisiwe.

Okungakutshelwa amarekhodi nokungakutshelwa wona

Lapho ithumbu lokuqala seliqediwe futhi indlela ehlosiwe ikhona, phinda ukulandelana okulawulwayo okufanayo ethumbini lesibili uma nawe udinga amalogi alo. Ithumbu elilodwa ngesikhathi yiyo yonke ingqikithi.

Amarekhodi afika emifuleni ekhonjwa uxhumo nekheli langaphandle lethumbu, ngakho hlobanisa nalobo bunikazi esikhundleni sokulindela ukuthi umlando uvele emuva. Akukho lutho ngaphambi koshintsho, futhi akukho ukulinda okugcwalisa isikhala. Uma udinga umugqa wesisekelo, rekhoda isimo samanje sethumbu nethebula lokuhambisa ngaphambi koshintsho ukuze kube nokuthile okuqhathaniswa nakho.

Gcina iqembu lamalogi, ukugcinwa kwalo, izimvume zokuletha kanye nengxenye yezinketho zethumbu kuhlu olufanayo ne-VPN ngokwayo, ngoba kuwukuhlelwa okukodwa okusabalele ezindaweni ezine. Inqubo ye-AWS yokuvula amalogi ibhala indlela yokusebenza yethumbu ngalinye nesixwayiso salo sokuphazamiseka, futhi kufanele ifundwe ngaphambi koshintsho hhayi ngemuva. Bese uqinisekisa ngokulandelana: ithumbu libuyile, amarekhodi ayavela emfuleni olindelekile, futhi amarekhodi ayaphendula umbuzo owavula ngawo ithikithi. Uma owesithathu ehluleka, inkinga kwakuwukukhetha komfula hhayi ukulogi.