I-IPsec phezu kwe-WAN yangasese: imingcele yomgomo we-SRX okufanele ihlolwe

I-WAN yangasese ingathwala amaphakethe angaphandle ethubhu le-IPsec, ngakho amakheli ozakwabo akudingeki abe amakheli omphakathi e-inthanethi. Okushintshayo yindlela amaphakethe angaphandle ahamba ngayo kanye nezimvume kusixhumi esibonakalayo esiwamukelayo. Ku-SRX, indlela yokulawula yangaphandle, ukuxhumeka kwesixhumi sethubhu kanye nomgomo wethrafikhi edluliswayo kuyizinto ezintathu ezihlukene. Ukulungisa okukodwa ngenkathi ezinye ezimbili zingalungile yisizathu esivamile sokuthi ithubhu lihlale liphansi.

Qala ngokubhala indlela yangaphandle ye-IKE

Bhala amanani amane ngaphambi kokuthinta umgomo: ikheli lozakwabo, isixhumi sasendaweni esamukela i-IKE, umongo womzila ofinyelela kuzakwabo kanye nomzila okhetha leso sixhumi. Amaphakethe e-IKE aqondiswa ku-SRX uqobo, ngakho adinga imvume ye-host-inbound endaweni yokwamukela, hhayi umgomo wethrafikhi edluliswayo. Ikheli le-WAN yangasese aliyisusi leyo mfuneko, ngoba iphakethe lisaphelela kudivayisi.

Hlunga isimo esifakiwe nge show security ike sa kanye nokumiswa nge show configuration security ike. Eyokuqala isho ukuthi isigaba 1 sikhona yini; eyesibili isho ukuthi idivayisi icabanga ukuthi kufanele yenze ini.

Xhuma isixhumi sethubhu kumgomo ofanele

I-VPN esekelwe kumzila ixhuma isixhumi sethubhu entweni ye-VPN, futhi iziqalo ezivikelwe ziqondiswa kuleso sixhumi. Bhala ukuthi yisiphi isixhumi, umuphi umzila kanye nawuphi umgomo ovumela izinhlelo phakathi kwezindawo ezihlobene. Indawo ebizwa nge-trust iyisiqu somgomo, futhi igama alifakazeli ukuthi amaphakethe okulawula noma edatha adingekayo avunyelwe.

Funda ukuxhumeka kwangempela esikhundleni somdwebo wakudala: show configuration security ipsec vpn kusilungiselelo sokuxhuma kusixhumi kanye show configuration security policies nemithetho ebhekisa endaweni yethubhu.

Uma umzila ovikelwe ukhomba kwenye indawo, ithubhu lingaba phezulu ngenkathi ithrafikhi ingalokothi ingene kuwo. Lena inkinga yomzila egqoke izingubo ze-IPsec.

Gcina umzila wozakwabo ku-underlay

Umzila oya kuzakwabo wangaphandle kufanele uxazululwe nge-underlay, hhayi ngokuphindaphinda ngethubhu eliwusungulayo. Uma umzila wozakwabo ukhomba kusixhumi sethubhu, amaphakethe e-IKE ajaha ithubhu lawo futhi isigaba 1 asiqedi. Indlela yokuphendula yethrafikhi evikelwe idinga umzila nomgomo wayo ofanele, futhi ngokuvamile leyo iyingxenye engekho lapho uhlangothi olulodwa lusebenza. Funda umfakiwo wetafula lomzila wekheli lozakwabo bese uqinisekisa ukuthi isixhumi esiphumayo yisixhumi se-WAN.

Hlunga lokhu nge show route 198.51.100.10, ufake ikheli langempela lozakwabo, futhi uqinisekise ukuthi igxathu elilandelayo akusona isixhumi sethubhu.

Qinisekisa ukulawula nesevisi ngokulandelana

Sebenza uye phezulu: isimo sesigaba 1, isimo sesigaba 2, bese kuba ukugeleza kohlelo kwangempela. show security ipsec sa ibala izinhlangano zokuphepha, futhi show security flow session destination-prefix 10.60.0.0/16 ikhombisa ukuthi izikhathi ezidluliswayo ziyakhiwa yini zenethiwekhi evikelwe.

Ubudlelwano bokulawula obunempilo nomzila wedatha osebenzayo kuyimiphumela emibili ehlukene, futhi ukudlula kwesigaba 2 akusho lutho mayelana nokuthi umgomo uyavumela uhlelo yini. Hlola ukugeleza okukodwa okuvunyelwe nokunye umgomo okufanele ukwenqabe, ukuze umehluko ubonakale.

Bhala ndawonye umzila wozakwabo, imvume ye-host-inbound, ukuxhumeka kwethubhu, umzila wangaphakathi nomgomo wohlelo. Lawa marekhodi amahlanu akhombisa ukuthi yiluphi ungqimba oluzoba nomthwalo wokwehluleka kwesikhathi esizayo ngaphandle kokuthembela ilebula lesikhumulo.