Ingabe i-VPN subnet ithola izinga lokuphepha le-interface ye-ASA?

I-VPN subnet ekhululiwe ayilitholi neze izinga lokuphepha le-interface. Hlola ngokwehlukana i-sysopt connection permit-vpn, isihlungi seqembu kanye nokufinyelela kokuphatha.

Othile uyabuza ukuthi i-VPN subnet yegatsha inezinga lokuphepha «0 noma 100» ku-ASA, futhi umbuzo usuvele unephutha. Izinga lokuphepha yisici se-interface yasendaweni, futhi linikezwa kusukela ku-0 kuya ku-100 ekucushweni kwe-interface. I-subnet ekude efika ngomhubhe ayitholi lutho, noma i-crypto map ibhalwe kanjani. Yingakho umbuzo awunampendulo yezinombolo.

Umbuzo olandelayo onengqondo ungcono: iyiphi inqubomgomo evumela igatsha ukuya kuseva, futhi iyiphi eligcina kude nomthombo womlilo uqobo. Lezo yizimpendulo ezimbili, futhi inqubo engezansi iyazihlukanisa.

Amazinga okuphepha angawama-interface

Gijima show running-config interface futhi uzobona security-level ngaphansi kwayo yonke i-interface yomzimba noma i-interface ye-VLAN, hhayi ngaphansi kweqembu lomhubhe noma i-crypto map. Imvume ezenzakalelayo isuka phezulu iye phansi ihlolwa phakathi kwalezo zindawo, yingakho inombolo ishintsha ukuziphatha kokuhlola kanye ne-ACL engabonakali emzileni eyincike kuwo.

Kumgelezo we-VPN okhululiwe, indawo yokungena iseyi-interface yangaphandle lapho umhubhe uphelela khona, futhi indawo yokuphuma iyi-interface yangaphakathi ebheke kuseva. Bhala zombili ngaphambi kokuthinta noma yini. Leso sinyathelo esisodwa sisusa iningi lokudideka, ngoba siguqula umbuzo wokuthembela ongabonakali ube yimbhangqwana yama-interface.

Ukweqa i-ACL kunomngcele onegama

sysopt connection permit-vpn yisilungiselelo abantu abasikhumbula ngengxenye lapho bethi ukuthutha kwe-VPN kuyayishaya indiva i-ACL. Ngempela kweqa i-ACL ye-interface kukuthutha okufanele njengokuthutha kwe-VPN, futhi umhlahlandlela wamapharamitha we-9.x uwukhawulela nge-interface nangendlela esikhundleni sokumemezela ukukhululwa komhlaba wonke.

Hlola okulungisiwe ngaphambi kokucabanga ngokukhumbula:

  • show running-config all sysopt ukubona inani elisebenzayo, hhayi imigqa engeyona eyenzakalelayo kuphela.
  • show running-config access-group ukubona ukuthi iyiphi i-ACL esetshenziswa kuyiphi i-interface nangayiphi indlela.
  • show vpn-sessiondb detail l2l ukuqinisekisa ukuthi isikhathi sisebenzisa iqembu lomhubhe nesihlungi esiphi ngempela.

Ukucisha leso silungiselelo ukuze kuqiniswe ukufinyelela kwe-VPN wushintsho olunomthelela obanzi. Ibhekisela kabusha yonke imigudu ye-VPN efanele ku-ACL yangaphandle, okuvame ukwephula imihubhe esebenzayo ngezindlela ezingahlobene negatsha okubuzwe ngalo.

Funda isihlungi esixhunywe esikhathini

Ukulawula kwangempela komhubhe ngamunye isihlungi se-VPN: i-ACL okubhekiswa kuyo inqubomgomo yeqembu noma igama lomsebenzisi, esetshenziswa ngemuva kokukhipha ukubhala nangaphambi kokubhala. Isihlungi sezinga lomsebenzisi sidlula inani leqembu, ngakho abantu ababili eqenjini lomhubhe elifanayo bangaba nokufinyelela okusebenzayo okwehlukile.

Qinisekisa ukuthi yikuphi okubalulekile esikhundleni sokucabanga. show running-config group-policy <name> ikhombisa inani leqembu, kanti show running-config username <name> ikhombisa ukuthi likhona yini inani lomsebenzisi ngamunye. Uma zombili zikhona, inani lomsebenzisi liyawina. Bese uqhakathanisa okufakiwe kuleyo ACL nomgelezo okhathazekile ngawo, endleleni isihlungi esihlola ngayo.

Isihlungi esivumela iseva yohlelo asisho lutho ngokuphatha. Leyo imithetho ehlukile emzileni ohlukile.

Qinisekisa imvume eyodwa nokwenqatshwa okukodwa

I-Packet-tracer iyindlela eshesha ukubona isinqumo ngaphandle kokulinda umsebenzisi ukuthi abike. Yinike umgelezo wohlangothi olukhululiwe futhi iyeke ibale izigaba ze-ACL, NAT nokuhlola edlula kuzo.

  1. packet-tracer input outside tcp 10.20.30.10 49152 10.0.5.20 443 detailed
  2. Funda umugqa womphumela: ubalula i-ACL evumele noma elahle iphakethe.
  3. Phinda nendawo yokuphatha ku-interface yangaphakathi bese uqinisekisa ukwenqatshwa.
  4. Phinda futhi kanye ngemuva kwanoma yiluphi ushintsho, ukuze kurekhodwe kokubili isimo sangaphambi nesangemuva.

Bese uqinisekisa ngokuthutha kwangempela: isicelo sohlelo esisodwa esiphumelelayo esivela egatsheni kanye nomzamo we-SSH owodwa ohlulekile oya ku-ASA. I-Packet-tracer ifanekisela umzila; umgelezo ophilayo ufakazela ukuthi imodeli yayihambisana.

Buyisa ushintsho olwenze ukuthi lusebenze

Uma ukulungiswa kwakuwukucisha ukweqa i-ACL noma ukunweba isihlungi, gcina ukucushwa kwangaphambili. Isifinyezo se-show run sezinto ezithintekile, esigcinwe ngaphambi koshintsho, sanele ukuzibuyisela; ukucushwa kwe-ASA kugxile emigqeni, ngakho ukubuyisa kusho ukufaka kabusha imigqa endala, hhayi ukubuyisela ifayela.

Rekhoda imbhangqwana yama-interface, isihlungi esisebenzayo, igama le-ACL elivela ku-packet-tracer kanye nemiyalo eqondile oyishintshile. Lokho kurekhoda kuguqula ukubuyekezwa okulandelayo kube ukuhlola kwemizuzu emihlanu esikhundleni senye ingxoxo ngamazinga okuthembela.

Izihloko ezihlobene