Okufanele kuhambisane ngaphambi kokuba i-MX iqede i-IPsec
I-commit eyamukela ukulungiselelwa ifakazela i-parser, hhayi indlela. Izingxenye ezinhlanu ze-tuple yeplathifomu zinquma ukuthi isevisi iyasebenza ngempela yini.
Ukulungiselelwa ku-commit ngokuhlanzekile, ama-interface ayaphuma, kodwa i-tunnel isenqaba ukusungulwa. Akukho lutho ku-log oluthi iplathifomu ayikwazi ukukwenza lokhu; ayikwenzi nje. Ku-Junos, i-IPsec iyisevisi okungasekeli ukuyenza ngaphandle kwenhlanganisela ethile ye-chassis, ihadiwe yesevisi noma indlela yesofthiwe, kanye nokukhishwa, futhi ikhasi lesici lichaza amandla esofthiwe, hhayi idivayisi yakho. I-tuple kufanele ihlolwe ingxenye ngengxenye, ngoba umphumela we-commit ufakazela i-parser kuphela.
Iphi iphakethe eliya kuyo ngempela
Ithrafikhi ekhethelwe i-IPsec kufanele ifinyelele ingxenye eyoyifihla. Emaphlathifomu ane-module yesevisi, i-flow ekhethiwe iqondiswa kuleyo module bese ibuyela endleleni yokudlulisa. Uma i-module ingekho, incane kakhulu noma ingaboshelwe ku-interface, ukulungiselelwa kukhona futhi akukho phakethe elilodwa elicutshungulwayo. Akukho lutho kokuphuma kwe-commit okuhlukanisa leso simo nesimo esinempilo.
Izinto ezisebenza ngsofthiwe zigcina umsebenzi ku-routing engine noma ku-inline hardware, ngemikhawulo yezinsiza ehluke kakhulu. I-tunnel ebonakala ekulungiseleleni ayikutsheli ukuthi iyiphi yalezi zindlela eyithwalayo ngempela.
Izingxenye ezinhlanu ze-tuple
Bhala phansi inhlanganisela ngaphambi kokufunda noma isincomo, ngoba ingxenye eyodwa ingenza ezinye zingasebenzi. Inombolo yengxenye eyayisekela isevisi eminyakeni emithathu edlule ayisho lutho mayelana nekhadi nokukhishwa kule-chassis. Funda imigqa engezansi njengohlu lokuhlola, bese ugcwalisa amanani okulungiselelwa angeke ukubonise wona.
| Part | What to record | Where it fails quietly |
|---|---|---|
| Chassis and service hardware | Model plus the installed PIC, MPC or MIC | Card absent or not bound to the interface |
| Implementation | Services card, inline or software path | Configuration accepted, no processing |
| Release | Exact Junos version | The feature arrives in a later build |
| Address families and mode | Outer and inner family, tunnel mode, peer authentication | Half the traffic silently unprotected |
| Entitlement and capacity | Licence state and the workload profile | Ceiling reached only under load |
Imindeni yamakheli kanye nomthwalo womsebenzi yimigqa emibili abantu abayeqayo, futhi kokubili kushibhile ukuhlola futhi kuyabiza ukukuthola kamuva. Funda i-tuple kudivayisi hhayi ku-spreadsheet, ngoba ukulungiselelwa kubika lokho okukucelile, hhayi lokho okufakiwe. Imiyalo emibili ithwala iningi: show chassis hardware isho ikhadi elihleliwe ngempela, futhi show version inikeza ukukhishwa okuqondile. Akukho kukho kokubili okuncike ekutheni ukulungiselelwa kulungile, futhi yilokho okuyiphuzu.
show chassis hardware
show versionAmasango okukhishwa ayamasango angempela
Imininingwane yokukhishwa ayiyona into yefomu. Uhlolovo lwe-IPsec lwe-Juniper lubeka ukusekelwa kwe-AES-GCM kwamakhadi e-multiservice ku-Junos 17.3R1, ngemodi ye-FIPS eqala ku-17.4R1. Ngakho-ke isici esifanayo sinemikhawulo emibili kuye ngokuthi iplathifomu isetshenziswa kanjani, futhi imodi oyisebenzisayo inquma ukuthi yimuphi osebenza. Hlola imodi ngaphambi kokuhlola uhlu lwezici.
Funda amanothi okukhishwa enguqulo efakwe ngqo, hhayi eyakamuva ebhalwe phansi. Ikhono elafika ku-build yakamuva alikwazi ukucatshangwa ukuthi likhona kwelangaphambili, futhi isitatimende esibhalelwe ikhadi elilodwa asidluleli kwelinye. Kopisha umugqa wamanothi okukhishwa kurekhodi lokuklama ukuze isitatimende sithwale umthombo waso, ngoba isitatimende sokusekelwa esibhalelwe umndeni weplathifomu akusona isitatimende ngemodi oyisebenzisayo noma ngekhadi onalo.
Umthamo uwumthwalo womsebenzi, hhayi isihloko
Inombolo ye-throughput esesihlokweni ngaphandle kwezimo zayo zokulinganisa iyinombolo yokumaketha. Amaphakethe amancane abiza kakhulu ngebhithi kunamakhulu, ama-association akhona ngasikhathi sinye adla imemori, futhi enye insevisi eyabelana ngekhadi inciphisa okusele.
Linganisela kusukela kuthrafikhi oyilindele: usayizi wamaphakethe ojwayelekile nowesimo esibi kakhulu, inani lontanga, nokuthi lelo khadi liphinda liqede i-NAT noma enye insevisi. Bese ushiya isikhala sosuku lapho indlela eyodwa izothwala umthwalo omkhulu kunalokho obekucatshangelwe ukuklama. Uhlelo lomthamo olucabanga ihadiwe engasebenzi luwisifiso, hhayi uhlelo. Uma inombolo ibalulekile esimweni sebhizinisi, yilinganise kanye kudivayisi ngaphansi komthwalo omele, futhi ugcine leso silinganiso nokuklama.
Bhala irekhodi ngaphambi kokuklama
Kukho konke ikhono okudingwa ukuklama, gcina isethenjwa seplathifomu, imibhalo ehambisana nokukhishwa, nanoma yimuphi umkhawulo ongakaxazululwa endaweni eyodwa. Lapho umugqa we-tuple wehluleka khona, qhathanisa ne-gateway ehlukile esivele yamukelwe esikhundleni sokwakha kabusha ukuklama eduze kohlu lwezinto zokuthenga oluphelelwe yisikhathi. Irekhodi kufanele lisho ukuthi iyiphi isistimu eqondile eyenza umsebenzi nokuthi ngaphansi kwemikhawulo ini.
Yilapho-ke hlola untanga, ngoba ukuhambisana kweprotocol nendawo ekude umbuzo olandelayo futhi akukaze kube yisikhundla sokusekelwa kwasekhaya. Untanga ovumelana neziphakamiso awukwazi ukusiza i-chassis engayifihli neze iphakethe.