VGW noma TGW? Lapho kuphela khona umhubhe we-IPsec we-AWS Site-to-Site

Abantu bayabuza ukuthi i-AWS Site-to-Site VPN iyeka kuphi ukuvikela iphakethe futhi balindele impendulo eyodwa: esangweni. Ingxenye ewusizo yaleya mpendulo isho ukuthi yisiphi isango, ngoba isango elizimele elibonakalayo kanye nesango lokudlula kuyizinhlelo ezihlukene ezinizinto zokuxhuma ezihlukene, futhi umhloli ocabanga okungalungile wakha okunye ukuhlola kumdwebo ongekho. Yenza izivivinyo ezintathu ezingezansi ngokulandelana. Ngayinye iqinisekisa umngcele noma ikutshela ukuthi impendulo yangaphambilini yayimayelana nomunye umthombo.

Shono amaphuzu amathathu okugcina ngaphambi kokuhlola noma yini

Ukubuyekezwa kokubethela kwale ndlela kudinga izinto ezintathu eziqanjiwe: isango leklayenti, umgomo we-AWS VPN oqeda i-IPsec, kanye nephuzu lokugcina lohlelo olwamukela iphakethe langaphakathi. Zibhale phansi kanye nezihlonzi zazo zomthombo ngaphambi kokuvula ikhasi elilodwa lekhonsoli, ngoba konke okulandela leli phuzu kuyisitatimende esikhuluma ngomunye walabo abathathu.

Isango leklayenti ngeyakho futhi ukuhlelwa kwayo kuyabonakala kuwe. Umgomo we-AWS uwumthombo ophethwe, futhi iphutha ukuwucabanga: ukuxhumana kwe-VPN kungaxhunywa esangweni elizimele elibonakalayo noma ngqo esangweni lokudlula, futhi akukho okusho okunye. Iphuzu lesithathu lokugcina yilona abantu abalidlulayo, futhi yilona kuphela eliphendula umbuzo wangempela mayelana nedatha yohlelo.

Isivivinyo 1: isiphi isango esiqeda umhubhe ngempela

Zombili izinhlelo ziyasekelwa futhi umhlahlandlela wokwakheka kwe-Site-to-Site VPN uzichaza zihambisana, ngakho buza i-API esikhundleni somdwebo ovame ukuba unyaka ubudala. Umbuzo wokufunda kuphela kukuxhumana okukodwa ubuyisela izinkambu zomgomo we-VPN:

aws ec2 describe-vpn-connections --region eu-west-1   --vpn-connection-ids vpn-0123456789abcdef0   --query 'VpnConnections[0].{VGW:VpnGatewayId,TGW:TransitGatewayId,CGW:CustomerGatewayId,Category:Category}'

Isihlukanisi ngu-TransitGatewayId, hhayi VpnGatewayId. Ukuxhumana okunokuthi TransitGatewayId kungenalutho kuphela esangweni elizimele elibonakalayo, kanti ukuxhumana okunale nkambu isethiwe kuphela esixhumini se-VPN sesango lokudlula, futhi VpnGatewayId kungase kusagcwaliswe kuleso simo ngoba kungase kusho isango elisekela isixhumi. Qala ngokufunda inkambu ye-TGW, bese uqinisekisa uhlobo lwesixhumi ohlwini lwezixhumi hhayi egameni lenkambu, ngoba isixhumi se-VPC kulelo sango lokudlula akusona isixhumi se-VPN. Ukuthola i-instance yomgomo ku-VPC exhunyiwe akusho lutho mayelana nokuthi yisiphi isixhumi se-VPN esathwala iphakethe.

Ngesikhathi ulapho, hlola nemihubhe. Ukuxhumana kuthwala imihubhe emibili ye-IPsec ukuze kube nokungafani, futhi ukuxhumana umhubhe waso wesibili ongakaze unyuke kuwukutholakala kwangempela mayelana nokutholakala nakuba kungashintshi lutho emngceleni wokubethela:

aws ec2 describe-vpn-tunnels --region eu-west-1   --filters Name=vpn-connection-id,Values=vpn-0123456789abcdef0   --query 'VpnTunnels[].{Outside:OutsideIpAddress,State:State,Status:Status}'

Isivivinyo 2: yini iphakethe langaphakathi lisayithwala

Lapho i-IPsec iphela, i-AWS idlulisela iphakethe eliqaqunuliwe ngomzila owawuhambisana nalo. Kusukela kulelo phuzu ukuhamba kuwukuhamba kwe-VPC okuvamile, futhi ukuvikelwa kwe-VPN sekuphelile. Lokhu akusona isikhala ensizakalweni; lona umqondo womngcele, futhi into ohlwini lokuhlola iwukusho ngokucacile esikhundleni sokuvumela ukuthi "i-VPN ibethelwe" kume esikhundleni sokuthi "idatha ibethelwe kusukela ekuqaleni kuze kube sekupheleni".

Manje hlola ukuthi yini eyay ingaphakathi. Uma iphakethe langaphakathi liwumthetho wohlelo wombhalo ocacile, akukho okungeza imfihlo ngezansi kuze kube yilapho okunye ukubethela. Uma iphakethe langaphakathi selivele lithwala isikhathi se-TLS, ukususwa kwe-IPsec yangaphandle akushintshi lutho kuleso sikhathi: sihlala sivikelwe kuze kufike ephuzwini laso lokugcina, noma ngabe lelo phuzu likuphi.

Ukulungisa ngokweqile okuvamile ukuphothula ngokuthi konke okungemuva kwesango kusobala. Akunjalo. Ukuthuthwa kwensizakalo, ukubethelwa kwesitoreji kanye ne-TLS yohlelo kuyizindlela ezihlukene ezinemibandela ehlukene, futhi ngayinye kufanele ihlolwe ngemibandela yayo hhayi ukucatshangwa kusukela esimweni se-VPN. Umugqa wokungena kwi-flow log okhombisa i-ACCEPT ufakazela ukuthi umzila wawusebenza futhi awusho lutho ngemfihlo, futhi yilowo mphutha ohlwini lokuhlola olukhona ukuwuvimbela.

Isivivinyo 3: yini eqeda i-TLS ngemuva kwesango

Landela isilaleli, hhayi ikheli. Uma isilinganisi somthwalo noma i-proxy iqeda i-TLS, ukuxhumana okuphethwe yiklayenti lakho kuphela lapho, futhi i-proxy ivula ukuxhumana kwesibili okuya kwengemuva okungaba umbhalo ocacile noma i-TLS enomunyane wokuthembela ohlukile. Ikheli le-IP eliyimfihlo kanye nomzila ohambisanayo akusona ubufakazi mayelana nalokho kuxhumana kwesibili.

Hlola iphuzu lokugcina okukhathaza ngempela kuwe lisuka ngaphakathi kwe-VPC, ngalebizo elisetshenziswa uhlelo hhayi nge-IP oyixazulule kanye:

openssl s_client -connect internal.example:443 -servername internal.example -verify_return_error

Phinda lokho kukho konke ukugxuma okudlulwa isicelo. Uma impendulo ihluka phakathi kwegama elibheke kuklayenti negama langemuva, uthole khona kanye ingxenye engakaze imbozwe yi-VPN, futhi yilokho okutholakele okufanele kubhalwe phansi.

Rekhoda umphumela njengezingxenye, hhayi njengesinqumo

Umphumela walolu hlu lokuhlola ithebula elincane elinomugqa owodwa ngesigaba ngasinye: isango leklayenti kuya kumgomo we-AWS VPN, isango kuya kumthwalo womsebenzi, umthwalo womsebenzi kuya kwisitoreji sedatha, kanye nanoma yikuphi ukugxuma kwe-proxy phakathi. Umugqa ngamunye usho ukuthi yini eyivikelayo nokuthi lokho kuvikelwa kuncike kuni. "Kubethelwe" ngaphandle kwendlela nangaphandle kwephuzu lokugcina akusona umugqa.

Bese uphendula isidingo sokuqala ngamagama afanayo nalawa okwabuzwa ngawo. Uma isidingo siwukuthi idatha ihlale iyimfihlo kuze kube yilapho umthwalo womsebenzi uyithola, i-VPN ihlangabezana nesigaba sokuqala kuphela, futhi imigqa esele idinga ukuthuthwa kohlelo, i-TLS yensizakalo noma ukubethelwa kwesitoreji okuhlelwe futhi kwaqinisekiswa ngokwehlukile.

Gcina izihlonzi zokuxhumana, izimo zemihubhe kanye nezihloko zesitifiketi emlandweni. Uma othile ebuyela emuva kumklamo ngemuva kwezinyanga eziyisithupha, lezo zinto ezintathu ziphendula umbuzo womngcele ngemizuzu embalwa esikhundleni sokuqala ingxabano kabusha kusukela kumdwebo.