Ingabe izizinda ezimbili zidinga i-VLAN ID efanayo ye-VPN yesizinda?

Izinombolo ze-VLAN ezifanayo emahhovisi amabili zibonakala sengathi kufanele zisize umhubhe phakathi kwezizinda, futhi azikushintshi lutho kulokho umhubhe okuthwalayo. I-VLAN ID imaka isizinda sokusakaza se-Ethernet ngaphakathi kwesakhiwo esisodwa; umhubhe udlulisela amaphakethe e-IP phakathi kwamasango. Izizinda ezimbili zingasebenzisa ukubalwa kwe-VLAN okuhluke ngokuphelele futhi zisahambisa komunye nomunye, futhi izizinda ezimbili zingasebenzisa ukubalwa kwe-VLAN okufanayo futhi zingakwazi ukufinyelelana. Ukuguquguqukayo okunquma ukufinyeleleka uhlelo lwamakheli.

Inganekwane: i-VLAN ID efanayo emikhawulweni yomibili

Le nkolelo ivela endaweni enengqondo. Ngaphakathi kwesakhiwo esisodwa, amachweba amabili ku-VLAN efanayo angakhuluma, kanti amachweba amabili kuma-VLAN ahlukene awakwazi, ngakho inombolo ye-VLAN ibonakala iyinto enikeza ukuxhumana. Ngaphesheya komhubhe ohambiswayo awekho ingxenye ye-Ethernet eyabiwe umaka ongayichaza, futhi amasango awakaze ashintshisane ngezimpawu ze-VLAN.

Lokho umhubhe okudingayo iqembu lezindawo zamakheli ezingahlangani kanye nenqubomgomo evumela ukuhamba phakathi kwazo. Shintsha i-VLAN kunoma yiliphi ihhovisi futhi umhubhe uyaqhubeka usebenza, ngoba akukho lutho ekulungiselelweni komhubhe olwalubhekisela kuyo. Lona umhlahlandlela oxazulula ingxabano: bala kabusha i-VLAN, shiya amakheli njalo futhi ubheke ukuthi umhubhe uyahlala yini.

Ukuhlolwa okuphambene nakho kufundisa ngokufanayo. Nika amahhovisi womabili isixhumi esifanayo futhi akukho nani lezinombolo ze-VLAN ezifanayo elizokwenza ikheli licace.

Lokho umhubhe okuthwalayo ngempela

I-IPsec ivikela amaphakethe e-IP ngokwenqubomgomo ekhonjiswe ngamakheli, amaphrothokholi namachweba. Isakhiwo se-IPsec sichaza labo bakhethi esigabeni se-IP, esiphezulu ngezigaba ezimbalwa kunoma yini echazwa uphawu lweswishi. Lapho iphakethe lingena emhubheni, seliwushiyile i-VLAN; uphawu selusetshenziswe iswishi yendawo.

Amadizayini asekelwe kunqubomgomo nalawo asekelwe emizileni ahluka ngendlela akhetha ngayo umhubhe, hhayi ngalokho angakuthwala. Uzakwethu osekelwe kunqubomgomo uhlanekezela abakhethi bokuhamba futhi uthumela amaphakethe ahambisanayo emhubheni. Uzakwethu osekelwe emizileni uhambisa ukuhamba kusixhumanisi somhubhe futhi ushiya isinqumo etafuleni lokuhambisa. Womabili asakaxoxisana ngobubanzi bokuvikela, ngakho umzila okhomba emhubheni awukukhulisi lokho ozakwethu abavumelana ngakho ukuvikela.

Umehluko lowo uchaza ukwehluleka kwesigamu okuvamile: umzila ukhona, amaphakethe angena emhubheni, futhi uhlangothi olukude luwalahla ngoba abakhethi okwaxoxiswana ngabo abakaze bahlanganise leso siqalo. Ukufunda izinqubomgomo ezifakiwe kukhombisa ukuthi yibuphi ububanzi obaqala ukusebenza.

ip xfrm policy
ip route show
swanctl --list-sas

Ukugqagqana okuqeda ngempela

Amahhovisi amabili anezixhumi ezihlukene ahamba ngokuhlanzekile emhubheni, futhi izinombolo zawo ze-VLAN azibalulekile. Amahhovisi amabili anesixhumi esifanayo awahambi kanjalo, ngoba isicelo sekheli elithile sinencazelo ezimbili ezingaba khona futhi itafula lokuhambisa lingakhetha eyodwa kuphela. Ukubala kabusha isizinda esisodwa kuyisixazululo esihlanzekile, futhi ngokuvamile kushibhile kunezinye izindlela uma kubalwa izinguquko ze-DNS ne-firewall.

Lapho ukubala kabusha kungenakwenzeka, idizayini yokuhumusha eyenziwe ngamabomu ingethula imibono ehlukene yamakheli ohlangothini ngalunye. Lokho kusho ukumephuza okukodwa-kuya-kokunye, abakhethi abahambisanayo, amarekhodi e-DNS akhombisa umbono ohunyushiwe kanye nokuhambisa kwangemuva okusinda ekubhalweni kabusha. Kuyidizayini esekelwayo enezindleko zokusebenza zangempela, futhi akusikho lokho okwenziwa ukushintsha i-VLAN ID.

Izinombolo ze-VLAN ezifanayo emikhawulweni yomibili ngezinye izikhathi ziyingozi yethempulethi eyabiwe, futhi ukuthatha leyo ngozi njengesizathu somhubhe osebenzayo kuholela ekuguqulweni okungalungile lapho okuthile kuphuka kamuva.

Umsebenzi owodwa ngesigaba, ubhaliwe

Iswishi yendawo inquma ukuthi yimaphi amachweba abelana isizinda sokusakaza, futhi ukubalwa kwayo kwe-VLAN ukugcinwa kwamarekhodi kwendawo okungekho esinye isizinda okudingeka sikwazi. Isango liqinisekisa uzakwethu futhi liphoqelela ububanzi bokuvikela okuvunyelwene ngabo. Itafula lokuhambisa linquma ukuthi iphakethe elisusiwe ukubethelwa liya kuphi ngokulandelayo, futhi inqubomgomo yokufinyelela inquma ukuthi lelo phakethe kwakufanele ngempela livunyelwe yini.

Ukuhlukanisa leyo misebenzi yikho okwenza izinguquko ziphephe. Ukubala kabusha i-VLAN ehhovisi elilodwa kuthinta iswishi yendawo, ububanzi be-DHCP futhi mhlawumbe indawo ye-firewall, futhi akuthinti umhubhe. Ukushintsha isiqalo kuthinta abakhethi bomhubhe, imizila yezinhlangothi zombili kanye nenqubomgomo yokufinyelela, futhi akuthinti izimpawu zeswishi.

Imizila yokubuya, i-DNS yangasese kanye nezidingo zobunikazi bohlelo lokusebenza kungeminye imisebenzi ehlukene, futhi akukho kuyo okufika ngokukopisha inombolo ye-VLAN evela kwesinye isizinda. Umbhalo wedizayini obala iziqalo ezifinyelelekayo kanye nezinsizakalo ezivunyelwe uyasinda ekushintshweni kweswishi; lowo obala izinombolo ze-VLAN awusindi.

Qinisekisa isithombe sendawo ngamathuluzi ebhuloho ngaphambi kokucabanga ukuthi uphawu lufinyelela emhubheni.

bridge vlan show
ip -br addr
ip route get 10.62.0.20

Lapho ukunwetshwa kwe-layer-2 kuyisidingo sangempela

Amanye amadizayini adinga ngempela ukuziphatha kwe-Ethernet phakathi kwezizinda: uhlelo lokusebenza oludala oluncike ekutholeni ngokusakaza, ukufuduka okufanele kugcine ikheli ngenkathi umshini unyakaza, noma iphrothokholi efaka izicabango ze-layer-2. Lezo zimo zidinga i-overlay noma insizakalo yebhuloho ethwala amafreyimu, futhi lapho ukuba yilungu le-VLAN, ukuvimbela imijikelezo kanye nokuphatha ukwehluleka kuba yizindaba zokusuka ekugcineni kuze kube sekugcineni.

Leyo iyisizinda sokwehluleka esikhulu kakhulu, futhi kufanele kube ukukhetha okwenziwe ngamabomu hhayi umphumela wengozi womzamo wokwenza ukwabelana ngamafayela kusebenze. Iseva yamafayela evamile, isizindalwazi noma uhlelo lwewebhu ludinga umzila we-IP ogunyaziwe, futhi luzojabula kakhulu ngaphandle kwesizinda sokusakaza eseluliwe ngaphansi kwalo.

Bhala isivumelwano se-VPN njengeziqalo ezifinyelelekayo kanye nezinsizakalo ezivunyelwe, futhi rekhoda uphawu lwe-VLAN kuphela lapho imisebenzi yendawo iludinga khona. Khona-ke ihhovisi ngalinye lingabala kabusha ukushintshwa kwalo ngaphandle kokuguqula zonke izinguquko zibe ukuklanywa kabusha komhubhe.