Indlela yokulinganisa isikhala sekheli se-VPN phakathi kwezindawo
Amaphoyinti okugcina okuthutha, izixhumanisi zangaphakathi, ama-LAN avikelwe kanye nama-subnet egethi kuyizabelomali ezine ezihlukene. Linganisa ngakunye kusukela ku-topology, hhayi enanini lamadivayisi.
Buza ukuthi i-subnet ye-VPN kufanele ibe ngakanani futhi impendulo eqotho ukuthi kungase kube nama-subnet amane ahlukene ngaphakathi kumbuzo. I-VPN yendawo ingase ihlanganise amaphoyinti okugcina okuthutha, izixhumanisi zethuneli ezinezinombolo, izingqimba ze-LAN evikelwe kanye, kumageyithi aphethwe, i-subnet yengqalasizinda egcinwa umhlinzeki. Yinye noma ezimbili kuphela zazo ezikhona kumklamo othile. Ukuzilinganisa kusukela enanini lamadivayisi ehhovisi yindlela uhlelo olugcina ngayo nge-/24 engagculisi muntu.
Qamba izindima ezine ngaphambi kokwaba noma yini
Amaphoyinti okugcina okuthutha yikheli amageyithi amabili awasebenzisayo ukufinyelela elinye kwelinye nge-inthanethi noma isekethe yangasese, futhi inani lawo livela kumodeli yegethi nokuyedwa, hhayi ku-LAN. Izixhumanisi zethuneli zangaphakathi zikhona kuphela lapho umklamo unombola khona i-interface ye-point-to-point, okuyinto ukumiswa kwe-IPsec okusekelwe kunqubomgomo ngokuvamile okungakwenzi. Izingqimba ezivikelwe yizona zokwazi izinethi zekhhovisi noma ze-VPC okufanele zikwazi ukuhanjiswa, futhi i-subnet egcinwe umhlinzeki ingeyesevisi ephethwe.
Bhala uhlu lwalokho osekuvele kukhona ngaphambi kokwengeza noma yini, ngoba iphutha elibizayo lapha ukusebenzisa kabusha ingqimba esevele ihanjiswa kwenye indawo. Ithuneli elidala elivela kuphrojekthi yokuhlola lanele ukungcolisa uhlelo. Bhala uhlu nemihla, ngoba inkumbulo yesixhumanisi esiye sanqanyulwa iphila isikhathi eside kunesixhumanisi ngokwaso.
ip -br addr show ip route show | head -40
Lemiyalo emibili inikeza umbono wasekhaya wezinethi ezixhunyiwe kanye nemizila efinyelela konke ngaphandle kwazo. Phinda uhlu endaweni ngayinye, ngoba uhlelo olwakhiwe kokuphuma kwendawo eyodwa luzoshayisana nokomlando olandelayo. Qoqa okuphumayo ngaphambi kokwaba ibhlokhi elilodwa.
Bala izixhumanisi ne-topology, hhayi amadivayisi
Umklamo onezindawo eziyisishiyagalombili ze-point-to-point usebenzisa amabhlokhi ayisishiyagalombili, hhayi elilodwa. Ku-/30 ibhlokhi ngayinye ichitha amakheli amane ukuxhuma izingqapheli ezimbili, ngakho uhlelo luthwala amakheli angamashumi amathathu nambili amaphoyinti okugcina alitshumi nesithupha asebenzisekayo, futhi iyilona nani isabelomali okufanele limelane nalo. Ipulatifomu esekela izixhumanisi ze-/31 ichitha ingxenye, kodwa kuphela lapho zombili iziphetho kanye nesevisi zivumelana ngalelo modeli. Hlukanisa isabelomali phezulu hhayi phansi, ngoba ukunciphisa ibhlokhi kamuva kusho ukunombola kabusha izixhumanisi ezisebenzayo.
Imikhawulo yomhlinzeki inqoba umkhuba ojwayelekile. Ibanga lethuneli langaphakathi elibhaliwe lingadinga i-/30 ngisho lapho i-/31 isebenza kubarutha bakho, futhi igethi eliphethiwe lingafuna imaski ethile ye-subnet yalo siqu. Funda imfuneko yesevisi ngaphambi kokusebenzisa umthetho osuselwe emkhubeni oqhamuka kwelinye ipulatifomu.
Isembozo samaphoyinti amaningi sishintsha futhi izibalo: ikheli elilodwa ngegethi ngalinye, kanti isembozo sibhekana nokufinyeleleka phakathi kwazo. Nquma ukuthi iyiphi i-topology esetshenziswa ngempela ukuqaliswa ngaphambi kokuphindaphinda izindawo ngosayizi webhlokhi.
Ukukhula kufanele kube nomugqa waso ohlelweni. Ukugcina ibanga lengqalasizinda elihambisanayo kuyafaneleka, kanjalo nokubhala ukuthi yikuphi ukwabiwa okuncane okungaphakathi kwalo, ukuze unjiniyela olandelayo angafundi ukugcinwa njengesizinda esisodwa sokusakaza.
Gcina i-subnet yegethi ngaphandle kwephuli ye-LAN
Ingqalasizinda yegethi ephethiwe ayilona iphuli lamaklayenti. Amakheli akwi-subnet yegethi egciniwe abamba izingxenye zesevisi ngokwaso, futhi abasebenzi bakude abalokothi bathele kuzo. Ukulinganisa leyo subnet kusukela enanini labasebenzisi kuyiphutha lesigaba elidla ibanga elikhulu noma elilambisa igethi.
Kuyafana ngamabanga ethuneli kuxhumano lwe-VPN yamafu, lapho umhlinzeki wabela ibanga langaphakathi elincane ngetuneli ngalinye ukuze alisebenzise yena. Lelo banga akuyona indawo okuhlala kuyo amaseva egatsha lakho, futhi akulona elakho ukulaba.
aws ec2 describe-vpn-connections --query "VpnConnections[].{Id:VpnConnectionId,Tunnels:Tunnels[].OutsideIpAddress}" --output table
Ukubala amakheli angaphandle kuqinisekisa lokho okwabiwe umhlinzeki nokuthi iyiphi ithuneli eyisipele esebenzayo njengamanje. Kuyashesha kunokufunda idokhumenti yomklamo eyabhalwa ngaphambi kokuba uxhumano lube khona.
Bhala indima, umnikazi nokukhula kuyo yonke ingqimba
Uhlelo olumelana nokuxhumana nokusebenza luchaza, engqimbeni ngayinye, ukuthi idlala yiphi indima, ubani owaba isiphetho esikude nokuthi singakanani isikhala esisele. Ngaphandle kwenkambu yomnikazi, amaqembu amabili aba i-/24 efanayo ngekota efanayo, futhi ukungqubuzana kubonakala kuphela lapho ithuneli liphakama.
Gcina lamabanga kude nezingqimba zasekhaya nezegatsha ezifika ngamanye amathuneli, ngoba isikhala esidlulanayo yisizathu esivamile sokuthi uxhumano phakathi kwezindawo luxoxisane ngempumelelo bese lungadlulisi thrafikhi.
Ukwaba amakheli ezixhumanisi zangaphakathi akukumenyezeli ama-LAN angemuva kwazo. Imizila noma izikhethi zethrafikhi, izindlela zokubuya nemithetho yokufinyelela kuyizinto zomsebenzi ezihlukene, futhi uhlelo kufanele lusho lokho esikhundleni sokuphakamisa ukuthi i-interface enenombolo yenza umzila wakho.