Hlanganisa ukufinyelela kwehhovisi nobunikazi, hhayi imbobo ye-switch
Ukuhlukanisa, ukwamukela kanye nokugunyaza isevisi kuyimisebenzi ehlukene. Izimo ezintathu zinquma ukuthi ukufinyelela okusekelwe kubunikazi kuyadlula yini i-VLAN ngeke ngayinye.
Kunemiklamo emibili etafuleni. Eyodwa igcina abasebenzi kuma-VLAN asekelwe ezindimeni futhi ihlela izimbobo ze-switch lapho abantu befuduka. Enye iqinisekisa isikhathi futhi ivumela inqubomgomo ukuthi inqume ukuthi ingafinyelela ini. Ukukhetha akumayelana nesimanje; kumayelana nokuthi izimo ezintathu ziyasebenza yini esakhiweni sakho. Uma eyodwa yazo yehluleka, umklamo osekelwe ezimbotsheni awuwona ubuthuntu, yiwo ongawusebenzisa ngempela.
Izimo ezintathu ukuqinisekiswa kokusebenza, izinga lobunikazi kanye nokuziphatha lapho kwehluleka.
Isimo 1: ingabe amadivayisi okufinyelela angakuqinisekisa inqubomgomo ebuyisiwe
I-802.1X iwubudlelwano phakathi komceli endaweni yokugcina, umqinisekisi ku-switch noma endaweni yokufinyelela kanye neseva yokuqinisekisa efinyelelwa nge-RADIUS. Iseva ingabuyisela i-VLAN noma omunye umphumela wenqubomgomo, futhi i-RFC 3580 ichaza lokho kusayina. I-switch kusafanele isebenzise umphumela othembele kuwo.
Cela ikhono, hhayi iphrothokholi: ukwabiwa kwe-VLAN okuguqukayo, ama-ACL angalandwa, noma ukudluliselwa kabusha kuphothali yokubhalisa.
Isimo 2: ingabe umthombo wobunikazi unegunya futhi uyashintsha ngokushesha
Ubulungu beqembu kuhlu lwamakheli busiza kuphela uma kuyinkambu ibhizinisi elivele liyihlela lapho indima ishintsha. Uma ukwabiwa kwezindima kuhlala kusipredishithi elikhophishwa emaqenjini njalo ngenyanga, ukufinyelela okusekelwe kubunikazi kumane kwenza okokufaka okudlule isikhathi kube okuzenzakalelayo. Hlola nokubambezeleka, ngoba isisebenzi esisha esingakwazi ukusebenza usuku lonke siwumphumela omubi kunokushintsha imbobo ngesandla. Ukuqinisekisa idivayisi, ukuqinisekisa umsebenzisi kanye nakho kokubili kuyizinketho ezihlukene, futhi amaphrinta adinga imodeli ecacile esikhundleni sokweqa okungachazwanga.
Bhala ukumapa: yiliphi iqembu elinikeza iyiphi inqubomgomo, futhi ubani ongayishintsha.
Isimo 3: nquma ukuziphatha lapho kwehluleka ngaphambi kokuhlolwa
Konke ukusetshenziswa kunesimo esingaqinisekisiwe nesimo lapho iseva ingatholakali, futhi inqubomgomo yakho kokubili isinqumo sokuphepha. Ukuwa buthule ungene engxenyeni ethenjwayo kubhubhisa umklamo; ukwehluleka okuqinile kuvimba umsebenzi ngesikhathi sokuphazamiseka. Indlela ephakathi evamile ingxenye ekhawulelwe enokufinyelela kwi-inthanethi kuphela kanye nomzila ocacile wokuya kudeski losizo. Hlola ukuwa ku-switch yangempela noma endaweni engenantambo, ngoba izindinganiso eziyisisekelo zabathengisi ziyahluka.
Uma kungekho noyedwa ongachaza ukuwa ngomusho owodwa, umklamo awukapheli.
I-VPN ingena kuphi
I-VPN iqinisekisa ukufinyelela emzileni ongathenjwa, futhi ukuyidinga naku-LAN yehhovisi kungaba isinqumo sokuthemba esenziwe ngamabomu. Akususi isidingo sokumapa amaqembu noma sokugunyaza kweseva yamafayela uqobo. Futhi yengeza umthamo wesango, isofthiwe yeklayenti kanye nokuphathwa kwezikhathi kumthwalo wokusebenza.
I-VPN ethengwe ukugwema ukuhlela ama-VLAN ixazulule inkinga engalungile futhi yengeza ezimbili ezintsha.
Ithebula, kanye nento eyodwa okufanele igcinwe
| Condition | Holds? | Design |
|---|---|---|
| Devices enforce returned policy | Yes | 802.1X with dynamic policy, stable segments |
| Devices cannot enforce it | No | Keep segments, add an application gateway |
| Identity source lags role changes | No | Fix provisioning before admission |
| No acceptable unauthenticated state | No | Restricted segment with a portal |
| Departures must lose access quickly | Yes | Dynamic disconnect plus credential revocation |
Gcina izigaba zabaseva, izivakashi, amadivayisi kanye nobuchwepheshe bokusebenza. Leyo mikhawulo imayelana nokuhamba hhayi izikhundla zomsebenzi, futhi iyaphila noma yikuphi ukuhlelwa kabusha. Beka amalungelo ezisebenzi kunqubomgomo yobunikazi, lapho ukushintsha kwendima kuwukuhlela okukodwa, futhi usebenzise indlela yokunqamula esekelwayo lapho ukususwa kufanele kusheshe.
Ukuhlolwa komklamo ukuthuthwa kwetafula: kufanele kuthuthe umuntu kanye nemishini yakhe, hhayi ukwakha kabusha izimvume zakhe eduze kwejeki elinye.