I-VPN phakathi kwezindawo iyasebenza, kodwa amalogi e-ASA awafiki: hlola ikheli lomthombo

Amahost angaphakathi afinyelela umqoqi okude futhi imigqa yawo ye-syslog iyavela. Imilayezo ye-ASA uqobo mayelana nalo mihlangano ayifiki neze. Akukho okungalungile kumqoqi noma kuthumbu, futhi yilokho okuyisiphithiphithi. I-firewall ithumela amalogi ayo kusuka emthonjeni okungakaze kwakhiwe ithumbu ukuyivikela.

Yini efikayo nengafiki

Qala ngokwehlukanisa imifudlana emibili ebukeka ifana kudashibhodi. Ithrafikhi edlulisiwe idlula ku-ASA: ihost ye-LAN ithumela kumqoqi, i-ASA iyifanisa nenqubomgomo yethumbu, iyibethela ngemfihlo, futhi umqoqi ubona ikheli lehost. Ithrafikhi ekhiqiziwe iqala ku-ASA uqobo: idivayisi yakha iphakethe le-syslog, ikhetha isixhumanisi sokuphuma nomthombo, bese sibe yilapho kuphela icela ukuthi ingabe ikhona inqubomgomo yethumbu efanayo. Umfudlana wokuqala ufakazela ukuthi ithumbu liyasebenza, futhi awusho lutho ngowesibili.

Umshicileli ogcinwe kubhafa kudivayisi nawo awubona ubufakazi bokulethwa kude, ngoba ilogi ingaba khona endaweni futhi ingakaze ithunyelwe. Hlola izibali zokwamukela zomqoqi ngaphambi kokusola ithumbu, ngoba isibali esingenalutho sihluke kuleso esikhulayo.

Umlayezo okhiqiziwe awuwona umfudlana odlulisiwe

Lapho i-ASA yakha iphakethe ngokwayo, ayisebenzi njengomxhasi wehost ye-LAN. Umthombo uvela kusixhumanisi sokuphuma noma kusilungiselelo somthombo esicacile, futhi iphakethe lingena ekufuneni komzila nasekuhloleni inqubomgomo okufanayo nakho konke okunye okuthunyelwa idivayisi. Lokho kusho ukuthi isikhethi se-VPN kufanele sifake ikheli i-ASA elisebenzisa ngempela, futhi lokho ngokuvamile isixhumanisi sayo sangaphandle hhayi inethiwekhi encane yangaphakathi.

Uma inqubomgomo ivikela i-10.20.0.0/24 futhi i-ASA isebenzisa ikheli layo langaphandle njengomthombo, iphakethe lelogi lingaphuma ngombhalo ocacile liya kumqoqi elingakwazi ukulufinyelela, noma lilahliwe. Yomibili imiphumela ibukeka ifana ohlangothini lomqoqi. Umqondo ofanayo usebenza kuthrafikhi yokuphatha, yingakho i-management-access iyisinqumo esihlukile somklamo.

Yimuphi umthombo i-ASA ewubeka kunethiwekhi

Thola umthombo ngokwesipiliyoni hhayi ngokucabanga. Ukubamba kusixhumanisi sokuphuma ngesikhathi somlayezo wokuhlola kubonisa umthombo nendawo okuyiwa kuyo kwangempela, futhi kuthatha isikhathi esingaphansi kokufunda izigaba ezintathu zokuhlela. Qhathanisa lelo kheli nesikhethi sendawo sethumbu.

Amanye amasudi avumela ukuba umthombo wokuloga uboshelwe kusixhumanisi, futhi incwadi yemiyalelo yenguqulo yakho iyigunya lokuthi lolo khetho lukhona futhi kushintsha ini. Umyalelo we-source-interface ovela kwenye inkundla ye-Cisco awusebenzi ngokuzenzakalela ku-ASA.

Uma ushintsha umthombo, kwenze ngamabomu futhi ukubhale phansi, ngoba ama-ACL omqoqi nanoma yikuphi ukuhlobana okwakhiwe ku-syslog kuncike kuwo.

Fanisa isikhethi nomfudlana welogi

Uma umthombo waziwa, hlola izinto ezintathu ngokulandelana: i-ACL yokubethela noma isikhethi esisekelwe kunqubomgomo esinquma ukuthi yimuphi umfudlana othakazelayo, umzila onquma ukuthi iphakethe liya kuphi, nanoma yimuphi umthetho we-NAT ongase ubhale kabusha umthombo ngaphambi kokubethela. Iphakethe elihambisana nomzila kodwa hhayi isikhethi alifakwa ethumbini, futhi iphakethe elibhalwe kabusha yi-NAT lingase lingahambisani nakukodwa kwalokho.

Uhlangothi lomqoqi lunezidingo zalo: i-ACL evumela umthombo we-ASA, umzila wokubuya kanye nensizakalo elalela embobeni oyihlelile. Ukuthutha kubalulekile nalapha, ngoba ukuloga kwe-TCP ne-TLS kuziphatha ngendlela ehlukile kune-UDP emzileni ovinjwe ingxenye. Shintsha into eyodwa ngesikhathi, uma kungenjalo ukubamba okulandelayo ngeke kukutshele ukuthi yikuphi ukushintsha okwakubalulekile.

Qinisekisa kumqoqi, bese ubhala phansi umthombo

Qinisekisa ukuthi umlayezo uyafika, bese ubhala phansi ikheli lomthombo elasetshenziswa yi-ASA, isikhethi esawuthwala kanye nobukhulu obuhloliwe.

Lokho kubhala kuguqula ukushintsha kwe-ACL okulandelayo komqoqi noma ukuhlela isikhethi kube ukuhlola kwemizuzu emibili esikhundleni sokuthola kabusha. Kubhala futhi ukuthi yimuphi kulemifudlana emibili owaqinisekiswa, futhi yiyo leyo ingxenye evame ukushiywa izincwadi zokuqondisa. Uma umlayezo ungakafiki, yehlisa okwesikhashana umkhawulo wobukhulu bese uhlola endaweni eyodwa.

Imibuzo evamile mayelana nokuloga kwe-ASA yakwa-Cisco ibhala icala elinomthombo wangaphandle elidinga incazelo efanele yethrafikhi evikelwe, futhi isibonelo sabo somthombo wangaphakathi sihlanganisa ihost yokuloga ngaphakathi kanye ne-management-access ngaphakathi. Phatha inhlanganisela ebhaliwe kanye nomongo wesofthiwe ndawonye, esikhundleni sokucabanga ukuthi umugqa owodwa okopishiwe ulingana nayo yonke imihlelo.

Ithumbu elithwala ithrafikhi ye-LAN akulona ithumbu elithwala izwi le-firewall uqobo.