Amasango amabili e-VPN alandelanayo: yikuphi okunqumayo ngempela
Izigaba ezimbili ze-VPN ezilandelanayo kufanele zisho izinqumo ezimbili ezihlukile zemvume. Shono ukuthi isango ngalinye lihlola ini, bese uhlola ukuthi isango langaphakathi lenqabayo.
Ukuxhumanisa ama-VPN amabili ngokulandelana kuvame ukudayiswa njengokubethela okwengeziwe, okuyinto engathandeki kakhulu ayenzayo. Umkhiqizo wangempela yisinqumo sesibili sokugunyaza, esithathwa umnikazi ohlukile mayelana neqoqo elihlukile lezinsiza. Uma izigaba zombili zamukela ubufakazi obufanayo futhi zifinyelela izindawo ezifanayo, isango langaphakathi liwumhlobiso onokubambezeleka okwengeziwe. Ukunquma ukuthi leso sinqumo sesibili sifanele izindleko zaso zokusebenza kuqala ngokusho ukuthi isango ngalinye liqinisekisa ini ngempela.
Umhubhe owodwa, bese kuba isinqumo sesibili
Isango langaphandle liphendula umbuzo obanzi: ingabe leli idivayisi yomsebenzi egunyaziwe, futhi ingakwazi yini ukufinyelela inethiwekhi yangaphakathi evamile. Isango langaphakathi liphendula umbuzo omncane: ingabe lobu buwena bunelungelo lokunakekela, futhi bungakwazi yini ukufinyelela lawo maphuzu okugcina okuphatha. Le mibuzo ihlukile enabanikazi abahlukile, futhi akukho okusho okunye. Ukuba khona kwendlela enqamula izigaba zombili akulona igunya lokusebenzisa lokho okungemuva kowesibili. Ukufinyelela umnyango okude kufakazela ukuthi indlela iyasebenza, futhi akukho okunye.
Isimiso sidala futhi sisazitshwa: indawo yenethiwekhi ayifakazeli lutho ngokwayo. Isifinyezo sokwakheka kokuthembela-ziro se-NIST sisho lokho ngokucacile, futhi senqaba ukuthembela okucashile okuvela lapho uxhumano luqhamuka khona noma ukuthi inethiwekhi ingeyabani. Kusetshenziswa lapha, ukufika emnyango wangaphakathi kuyisimo esidingekayo sezinsiza zaso, akusona isikhathi esisodwa imvume yokuzisebenzisa.
Bhala ukuthi isango ngalinye liqinisekisa ini
Esigabeni ngasinye, rekhoda ubuwena obuhlolayo, izindawo ezizivumelayo kanye nemibandela okungadlulwa ngayo. Isango langaphandle lingavumela ngokusemthethweni izinsiza zangaphakathi ezijwayelekile kanye nesilaleli sesango langaphakathi, futhi akukho okunye. Isango langaphakathi lingadinga isimangalo sendima futhi livumele kuphela amakheli okuphatha ashiwo kurekhodi loshintsho. Uhlelo lokusebenza ekugcineni okude lugcina izwi lokugcina mayelana nokuthi leyo ndima ingenza imisebenzi eni, ngakho uchungechunge lwengeza isango ngaphandle kokuthatha indawo yokugunyazwa kohlelo.
| Gate | Identity it checks | Destinations it permits | How it could be skipped | When it is removed |
|---|---|---|---|---|
| Outer gateway | Employee account plus a managed device posture | General internal services and the inner gateway's listener | Any alternate path to the same destinations, including a public listener | Ordinary work stops and the inner stage becomes unreachable |
| Inner gateway | A maintenance entitlement or role claim on that identity | The named management addresses in the change record | Direct routes from the outer domain to those addresses | Maintenance access ends while general access stays as it was |
Ukweqiwa okubili kwephula umklamo ngokuthula. Uma isizinda sangaphandle sesivele sifinyelela ngqo kuyo yonke indawo ebucayi, isango langaphakathi liyazikhethela hhayi isibopho. Uma isilaleli esidlangalaleni noma indlela yesibili eyimfihlo inikeza ukufinyelela okufanayo, indlela ehlosiwe ingenye yezinketho ezimbalwa. Yabela umnikazi kuwo wonke amaqoqo emithetho futhi inkontileka yabo isho izinsiza zendawo, ubuwena bomthombo obuvunyelwe, i-DNS eyimfihlo, ukuhumusha amakheli kanye nokuthi ubani ophendulayo lapho ukudluliselwa kwehluleka. Ikheli elithenjwayo kunethiwekhi yangaphandle akumele neze lithathe indawo yokugunyazwa kwesizinda sangaphakathi.
Hlola izimo zokwenqaba, hhayi indlela ejabulisayo
Uxhumano oluyimpumelelo ngamasango womabili lufakazela okuncane kakhulu, ngoba leso yisimo esahlolwa yiwo wonke umuntu ngesikhathi sokuqalisa. Izimo ezithakazelisayo yilezo lapho isigaba esisodwa sidlula kanti esinye senqaba. Ezintathu zazo zihlanganisa ingxenye enkulu yengozi, futhi ngasinye sinomphumela olindelekile ongahlolwa esikhundleni sokuphikiswana ngawo.
Lapho ukufinyelela okuvamile kugunyaziwe futhi indima ebucayi ingekho, umsebenzi ojwayelekile kufanele uqhubeke ngenkathi indawo ebucayi inqatshwa. Gunyaza izigaba zombili futhi iqoqo elifinyelelekayo kufanele libe amaphuzu okugcina okunakekela ashiwo kurekhodi loshintsho, hhayi okubanzi kunalokho. Uma ilungelo likhishwa phakathi nesikhathi seseshini, inqubomgomo yeseshini evunyelwe kufanele iqale ukusebenza ngaphandle kokuklebhula ukufinyelela okuvamile okungahlobene. Ukuthi lokho kukhishwa kuqeda iseshini ekhona ngokushesha noma ekugunyazweni kabusha okulandelayo kuyisinqumo senqubomgomo okufanele ukuba inkontileka isivele inaso. Umuntu obhale izimo zokwamukela akusiyena umuntu okufanele azihumushe ngesikhathi sehlakalo.
curl --fail --silent --max-time 5 https://maint.corp.internal/health || echo "denied as expected"Bala ukuthembela okuengeziwe
Isigaba ngasinye esengeziwe sengeza ingxenye engahluleka kanye nomzila okufanele uhlangane ngendlela efanele ngaphakathi komhubhe wangaphandle. Ngesikhathi sokuhluleka okuyingxenye umzila wangaphandle uhlala umile ngenkathi owangaphakathi ungafinyeleleki, ngakho umsebenzisi ubona isithonjana se-VPN esinempilo eceleni kwensiza engaphenduli neze.
Hlola imizila kanye nemithetho yokuvimba lapho kuhluleka, hhayi esimweni esijwayelekile kuphela. Umzila ozenzakalelayo ophushwa umhubhe wangaphandle ungabamba ikheli lesango langaphakathi uqobo, okuguqula isigaba sesibili sibe uxhumano olusungulwayo bese luwa. Rekhoda okufanele kuhlale kuvinjiwe ngenkathi umhubhe wangaphakathi ungekho, ngoba ukuhlehla kwengozi nxazonke kwaso kubi kunokuphazamiseka okumsulwa. Sebenzisa indlela efanayo yokuhlola kuwo womabili amagxathu, ukuze ngakunye kukalwe esikhundleni sokucatshangwa. Izinkomba ezimbili zesimo esixhunyiwe azisunguli hlangano noma ukwehlukaniswa.
Okungeke isango lesibili likuthengele khona
Buza ukuthi amasango amabili ayabelana ngobufakazi, isiphathimandla sesitifiketi noma indiza yokuphatha. Lapho abelana khona, abelana futhi ngezindlela zazo zokuhluleka ezibaluleke kakhulu, futhi isigaba sesibili sibiza ngaphezu kwenkululeko okubonakala sengeza yona. Amaseshini e-cryptographic ahlukene awakhi izilawuli zokuphatha ezihlukene.
Gcina isango langaphakathi ngenkathi liqinisekisa imfuneko ongayisho futhi uyihlole, njengendima isizinda sangaphandle esingayihloli neze. Lisuse lapho umsebenzi walo oyedwa kuwukugunyaza kabusha ubuyena obufanayo ezindaweni ezifanayo. Noma kungakanani, rekhoda imfuneko, umnikazi kanye nokuziphatha kokuhluleka ndawonye, ukuze ukubuyekezwa okulandelayo kuphikisane ngemfuneko hhayi ngomdwebo.