I-SSH eya ku-ASA ekude nge-VPN yesayithi: igxathu negxathu

Uqondisa iklayenti le-SSH ekhelini langaphakathi le-ASA ekude futhi isikhathi sokusebenza siyafa lapho kuxhunyanwa. I-firewall iphendula isuka kusayithi yayo, umhubhe uyabonakala, kodwa akukho okulalelayo embobeni 22. Kwiningi lalezi zimo iphakethe alifiki neze ekwamukelweni kokuphatha, ngoba indlela ehlolwayo ayizange yakhelwe njengendlela yokuphatha. Landela ukugeleza ngezansi ngokulandelana futhi ukwehluleka kuyoyeka ukuhambahamba.

Khetha ikheli oliphethe ngempela

Imiklamo emithathu ibukeka ifana futhi iziphatha ngendlela ehlukile: ukufinyelela ikheli lomphakathi le-ASA elibheke ku-VPN, ukufinyelela isixhumanisi sangaphakathi nge-IPsec, nokufinyelela isixhumanisi sokuphatha esikhethekile. Bhala ikheli lomthombo lomlawuli, ikheli eliqondile lendawo kanye ne-TCP 22 ngaphambi kokuthinta noma iyiphi imvume. Konke okulandelayo kuncike kulelo bhangqa.

Umhubhe othwala ama-VLAN amabili aseva awukwazi ukuthwala neze ikheli lesixhumanisi se-firewall noma inethiwekhi engaphansi yokuphatha yomlawuli. Hlola uhlu lwethrafikhi enentshisekelo yomgomo wesayithi-kuya-sayithi futhi uqinisekise ukuthi ikheli le-ASA ngokwalo livela njengendawo, hhayi kuphela izinethiwekhi ezingaphansi ezidlula kulo.

Njengoba indawo iyi-firewall ngokwayo, ukwamukelwa kokuphatha kwehlukile emikhubeni yethrafikhi edluliswayo. I-ACL evumela amaklayenti ukuthi afinyelele amaseva angemuva kwe-ASA ayikuvuli ngokwayo ukuphathwa kwe-SSH kwedivayisi, futhi ukulungisa umkhuba wokudlulisa ngeke kususe lokhu kwehluleka.

management-access ikhethekile kwisixhumanisi

Umyalo we-management-access utshela i-ASA ukuthi yamukele ukuxhumana kokuphatha okuya kwisixhumanisi esishiwo lapho kufika nge-VPN. Awudali indlela, awunezi imvume ye-SSH, futhi awusebenzi kuzo zonke izixhumanisi ngasikhathi sinye. Uma isixhumanisi sendawo kungesona leso esishiwo, ukuxhumana kuyalahlwa ngaphambi kokuqinisekisa.

Lapha ukukhishwa okubili kuyaluma. Izixhumanisi zokuphatha kuphela zingaphandle kwale ndlela yokusebenza, futhi umhlahlandlela wokuphatha we-ASA 9.20 uphawula ukuthi isitaki esizenzakalelayo se-CiscoSSH asisekeli i-SSH phakathi kwezixhumanisi nge-VPN kuyilapho isitaki se-ASA SSH sisekela. Qinisekisa isitaki esisebenzayo kunguqulo esetshenzisiwe ngaphambi kokuchitha isikhathi emizileni.

Amasango amane ngaphambi kwesicelo sokungena

Phakathi kweklayenti nesicelo segama lomsebenzisi kumi amasango amane azimele: ukufana kwendlela nomhubhe kwebhangqa lokuphatha, i-ACL yesixhumanisi evumela i-TCP 22 iye ekhelini le-ASA, imvume ye-ssh ehlanganisa umthombo womlawuli, nokuqinisekisa kwe-AAA kwalowo msebenzisi. Ngayinye ingawisa iphakethe ngaphandle kokutshela iklayenti ukuthi yiliphi isango elivaliwe.

Sebenzisa i-packet-tracer ukubona ukuthi iliphi isango lehlulayo ngaphambi kokushintsha noma yini: packet-tracer input inside tcp 10.10.5.20 50000 10.20.1.1 22 detailed. Umkhondo usho i-ACL, isigaba se-NAT kanye nesinqumo se-to-the-box, okuvamise ukwanele ukwehlukanisa inkinga yomzila nenkinga yokwamukela.

Bhala imvume encane, hhayi enkulu

Khakhela imvume kunethiwekhi engaphansi yokuphatha evunyelwe nakwisixhumanisi esamukela ithrafikhi yomhubhe: ssh 10.10.5.0 255.255.255.0 inside. Yihlanganise nendlela yokuqinisekisa efana ne-aaa authentication ssh console LOCAL kanye ne-akhawunti yasendaweni enegama, esikhundleni sokuvula wonke umthombo kusixhumanisi sangaphandle.

Gcina i-ACL yesixhumanisi nemvume ye-ssh zihambisana. Imvume yenethiwekhi engaphansi evinjwa yi-ACL isehluleka, futhi i-ACL evumela inethiwekhi engaphansi ngaphandle kokufakwa kwe-ssh okuhambisanayo yehluleka esangweni elilandelayo. Zombili izitatimende zichaza indlela eyodwa kusuka ezingqimbeni ezahlukene, ngakho zihlole ndawonye kukhathalogi esebenzayo.

Qinisekisa kusuka kusibungu esishiwo, bese unciphisa futhi

Vula isikhathi sokusebenza esisha kusuka kusibungu sokuphatha esishiwo hhayi etafuleni lakho, futhi uqinisekise ku-ASA ukuthi ukuxhumana kusebenzise liphi ikheli lomthombo nesiphi isixhumanisi. Hlola izikhathi zokusebenza ezisebenzayo kanye nesigaba se-SSH sokhathalogi osebenzayo ngesikhathi isikhathi sokusebenza sivuliwe, bese usivala futhi ususa noma iyiphi imvume yesikhashana oyifake ukuze uhlole. Uma isikhathi sokusebenza sibonakala kodwa siwa ngokushesha ngemva kokungena, inkinga esele ukugunyazwa hhayi ukufinyeleleka. Bhala isixhumanisi nomthombo kurekhodi lwezinguquko ukuze umuntu olandelayo angaphindi ukuxilongwa.

Gcina ikhonsoli noma enye indlela yokubuyisela evunyelwe ngokuzimela itholakala phakathi nayo yonke inguquko. Lapho indlela yangasese isisebenza, qinisekisa ukuthi imithombo yomphakathi nabasebenzisi be-VPN abangahlobene abatholanga ukufinyelela okufanayo, ngoba indlela yokuphatha esebenza kubo bonke iyingxaki ehlukile kunalelo oqale ngalo.