Izimemezelo ze-BGP ze-VGW ngokumelene nethebula yemizila ye-VPC: yini eshintsha ini

Isiqalo esingekho kuthebula lemizila yesubnet ye-VPC nesiqalo esingekho kurouter yeklayenti yizinkinga ezimbili ezihlukene, futhi eyodwa kuphela yazo elungiswa ngaphakathi kwamathebula emizila e-AWS. I-virtual private gateway imemezela amabhlogo e-CIDR ahlobene ne-VPC yayo; ithebula lemizila yesubnet linquma ukuthi umthwalo womsebenzi uthumela impendulo kuphi. Ukuthatha okwesibili njengendlela yokushintsha okokuqala iyiphutha elivame kakhulu kulokhu kuhlola. Gijimisa izivivinyo ezingezansi ngokulandelana futhi uhlukanise izinhlangothi ezimbili.

Qamba okunamathiselwe ngaphambi kokufunda noma iyiphi ithebula

I-VPN yendawo eya endaweni iphela ku-virtual private gateway noma ku-transit gateway, futhi ama-ID ezinsiza anquma ukuthi yimuphi ummodeli womzila osebenza. Zifunde kuqala: aws ec2 describe-vpn-connections --vpn-connection-ids vpn-0123456789abcdef0 --query 'VpnConnections[].{Tunnels:VgwTelemetry,Gateway:GatewayId,Transit:TransitGatewayId}'. Impendulo ikutshela ukuthi ithebula elilandelayo okufanele lihlolwe ithebula lemizila le-VPC noma ithebula lemizila le-transit gateway.

Uma i-VPN ixhunywe ku-transit gateway, yeka ukuthatha ithebula lemizila le-VPC njengezinga lokulawula. Lapho ithebula le-VPC likhomba ekunamathiselweni kwe-transit gateway, futhi ukuxhumana nokusabalalisa kwenzeka kuthebula lemizila le-transit gateway. Ukuhlanganisa imibono emibili kukhiqiza iziphetho eziqinile ngento engalungile.

Uhlangothi olusuka ku-AWS luye ehhovisi isimemezelo

Kokunamathiselwe kwe-VGW, i-transit gateway imemezela amabhlogo e-CIDR ahlobene ne-VPC yayo ku-transit gateway yeklayenti nge-BGP. Ukwengeza umzila wesubnet owodwa, noma ukuqondisa umzila kwi-VPC ehambisana noma kudivayisi, akwengezi enye i-CIDR ehlobene futhi akubonakali kuleso simemezelo. Uma ihhovisi lantula isiqalo, qhathanisa uhlu lwemizila etholakele nokuxhumana kwe-VPC ngaphambi kokuhlela noma iyiphi ithebula lemizila.

Umthetho olula unezihloko ezingaphandle, ngakho uwugcine emkhakheni wawo. Ukuhlelwa kwe-VPN CloudHub kungamemezela kabusha iziqalo zesayithi phakathi kwama-transit gateway eklayenti, futhi i-transit gateway ilandela imithetho yayo yokusabalalisa. Isitatimende sokuthi i-VGW imemezela kuphela i-VPC yayo iyi-default ewusizo, hhayi umthetho ohlanganisa yonke i-topology ozohlangana nayo.

Uhlangothi olusuka ehhovisi luye ku-AWS ukusabalalisa kanye nokukhetha

Ohlangothini oluphambene i-VGW ifunda isiqalo sehhovisi, kodwa lokho kuphela akuhambisi umthwalo womsebenzi. Ithebula lemizila yesubnet kufanele libe nokusabalalisa okuvuliwe kokunamathiselwe noma liphethe umzila oqinile oya endaweni efanayo. Uma kokubili kukhona kwisiqalo esisodwa, umzila oqinile uyawina, futhi ukufana kwesiqalo eside kakhulu kusebenza ngaphambi kwakho kokubili.

Funda umsuka esikhundleni sokuwucabangela: aws ec2 describe-route-tables --route-table-ids rtb-0123456789abcdef0 --query 'RouteTables[].Routes'. Umhlahlandlela onomsuka we-EnableVgwRoutePropagation wavela ku-BGP; umhlahlandlela onomsuka we-CreateRoute wabhalwa ngumuntu futhi uzolokhu uwina kuze kube umuntu uwususa.

Incwadi yokusebenza egcina izinhlangothi ezimbili zihlukene

Bhala amaqiniso amane ohlangothini lwe-AWS ngaphambi kokushintsha noma yini: uhlobo lokunamathiselwe, ama-CIDR ahlobene e-VPC, umsuka womzila wesubnet wesiqalo okukhulunywa ngaso, kanye nesimo se-tunnel ne-BGP. Ukushaya i-describe okufanayo kubuyisela i-VgwTelemetry nenani lemizila eyamukelwe nge-tunnel ngayinye, okukutshela ukuthi i-AWS yamukele noma yimiphi imizila. Bese uqhathanisa lokho nalokho okufakwe idivayisi yeklayenti ngempela. Isiqalo esikhona ku-BGP kodwa singekho kuthebula lokudlulisa inkinga yokungeniswa kwasekhaya noma yomzila ongcono, hhayi inkinga yethebula lemizila le-AWS.

Uma ithebula lesubnet lingenayo nhlobo isiqalo, vula ukusabalalisa noma wengeze umzila oqinile, bese ufunda futhi umbuzo ofanayo ngemva kwesikhawu sokusabalalisa esikhundleni sokucabanga ukuthi ushintsho lwaba khona ngokushesha. Uma isiqalo sikhona futhi ithrafikhi isahluleka, yeka izinga lokulawula bese udlulela emzileni wedatha.

Yini ongayishintshi ngesikhathi ukhona lapho

Ungavuli noma uvali ukusabalalisa kumathebula emizila angahlobene ukuze ulungise isiqalo esisodwa esingekho, futhi ungengezi umzila ozenzakalelayo ukuze ufihle i-CIDR eyodwa engekho. Zomibili izinguquko zandisa ububanzi bomthelela futhi zenza ukuhlola okulandelayo kube nzima. Khawulela ukuhlela kuthebula elikhonza isubnet yomthwalo womsebenzi okukhulunywa ngayo kuphela.

Umzila wedatha uhlukile kukho konke lokhu. Amaqembu okuphepha anesimo, ama-ACL enethiwekhi awanawo, futhi i-firewall ye-host noma umzila wokubuya ongalingani kungalahla ithrafikhi umzila oyilethe ngendlela efanele. I-aggregate emenyezelwe nayo ayigunyazi yonke insiza engaphakathi kwayo, ngakho nciphisa ukufinyelela emngceleni wenqubomgomo esikhundleni sokuthembela ekutheni ikheli livela ngephutha kusimemezelo se-BGP.

Gcina isimo sangaphambi nangemva kwayo yonke imibuzo yethebula lemizila kurekhodi yezinguquko. Uma ushintsho lwenza izinto zibe zimbi, buyisela imizila yangaphambili bese uqinisekisa ngombuzo ofanayo, ngoba ukubuyisela emuva ongakwazi ukukuqinisekisa kungukucabanga nje.