Iyiphi imodi ye-Sophos RED efanele inethiwekhi yegatsha lakho?
I-RED iyindima yesayithi ekude, akuyona iphrothokholi. Khetha i-Standard/Unified, i-Standard/Split noma i-Transparent/Split ngokuya ngokuthi ubani ongesikhulu segesi yegatsha kanye ne-DHCP.
I-Sophos RED iyindima yesayithi ekude hhayi iphrothokholi ye-VPN, yingakho ukuyiqhathanisa ne-IPsec noma i-OpenVPN kuphendula umbuzo ongafanele. Idivayisi inweba ukulawula kwe-firewall emaphakathi iye egatsheni, futhi imodi oyikhethayo inquma ukuthi ubani ohlinzeka ngegesi yegatsha, ubani osabalalisa amakheli nokuthi yikuphi ukuhamba okudlula emhubheni. Lezi zimpendulo ezintathu zibaluleke ukudlula amagama emodi. Ukuzibhala kuqala kuguqula ukukhethwa komkhiqizo kube yisinqumo somklamo.
I-RED iyindima, akuyona iphrothokholi
Idivayisi ye-RED ixhuma igatsha ne-Sophos Firewall emaphakathi, futhi ukulungiselelwa kwe-firewall kunquma ukuthi igatsha liba yini. Umhubhe uyingcaca yokuqalisa yalokho kuxhumana, akuyona indawo yokugcina ye-VPN ejwayelekile ongayiqondisa kunoma yimuphi umlingani.
Leso sakhiwo sibalulekile ngoba i-RED ayikwazi ukushintshwa nomlingani we-IPsec ongenasizathu. Ilindele ukuthi i-firewall emaphakathi iyilawule, futhi amamodi asekelwayo achaza ukuthi ingakanani yegatsha eyithathayo. Ukuyithatha njengendawo ejwayelekile yokugcina yomhubhe kudala okulindelwe umkhiqizo ongakaze ukuthembise. Ukuyithatha njengendima kuveza imibuzo enquma umklamo ngempela.
Imibandela emithathu engezansi ishintsha impendulo, futhi yonke imayelana nobunikazi hhayi ukubethela.
Imibandela emithathu ekhetha imodi
Buza ukuthi ubani ongesi yegatsha, ubani oqhuba i-DHCP ne-DNS kubakhasimende egatsha, nokuthi ingabe ukuphuma kwe-inthanethi kwendawo kufanele kusinde ukuphuka komhubhe.
I-Standard/Unified iphendula kumathathu ngendlela efanayo: i-firewall emaphakathi ingumnikazi we-LAN yegatsha, kuhlanganise nemisebenzi yegesi ne-DHCP, futhi ukuhamba kudlula emhubheni. I-Standard/Split igcina ukuphathwa okuphakathi futhi ithumela emhubheni kuphela amanethiwekhi alungisiwe. I-Transparent/Split ivumela inethiwekhi yegatsha ekhona ukuthi inakekele igesi namakheli ayo, futhi iqondisa emhubheni kuphela ukuhamba okukhethiwe. Amamodi amathathu, abanikazi abathathu abehlukene.
| Mode | Branch gateway and DHCP | Traffic through the tunnel |
|---|---|---|
| Standard/Unified | Central firewall owns both | All branch traffic |
| Standard/Split | Central firewall owns both | Only the configured networks |
| Transparent/Split | The existing branch router keeps both | Only the selected flows |
Funda ikholomu ephakathi kuqala, ngoba iyona enquma ukuthi ingakanani yegatsha esasebenza lapho umhubhe ungekho.
Ubani ongesi yegatsha ne-DHCP
Ekuhlelweni okuhlanganisiwe igatsha alinagesi elizimele, okwenza ukulungiselelwa kube lula futhi kuqoqele ukwehluleka endaweni eyodwa. Lokho kuqoqela kufanelekile lapho igatsha lincane futhi i-firewall emaphakathi inokutholakala okuphezulu.
Ekufakweni okusobala igatsha ligcina irawutha yalo futhi i-RED ihlala emgqeni ukuze iqondise ukuhamba okukhethiwe. Lokho kugcina ukuphathwa kwendawo futhi kunezela idivayisi okubalulekile ukuma kwayo emgqeni kukho konke ukugeleza okuqondisiwe. Bhala phansi ukuthi ihlala kuphi, ngoba ushintsho lwakamuva kurawutha yegatsha lungayeqa ngokuthula. Akukho kuhlelwa okunqobayo ngokujwayelekile; bahlukanisa umthwalo ngendlela ehlukile.
Ubunikazi bamakheli yingxenye okufanele ibhalwe phansi, ngoba amaseva amabili e-DHCP esigabeni esisodwa adala iziphambeko ezingezikhathi ezibikwa njengezinkinga ze-VPN.
Kwenzekani lapho umhubhe uwela
Ukusebenza kwe-Split kuvame ukufundwa njengesithembiso sokuthi i-inthanethi yendawo iyaqhubeka nokusebenza ngesikhathi sokwehluleka komhubhe, futhi lokho kufunda akuphephile. Ukuziphatha okuqondile kuncike kumodi ekhethiwe, i-firmware kanye nedivayisi, ngakho kungaphansi kwemibandela yokwamukela, hhayi komcabango.
Nquma ukuthi igatsha kusamele lenze ini ngaphandle komhubhe: lifinyelele amaphrinta endawo, lixazulule amagama, lamukele ukukhokha noma lutho. Bese uhlola leso simo ngamabomu ngokuvimba umhubhe nokubuka igatsha. Igatsha elilahlekelwa i-DNS ngokuthula libi kunalelo elihluleka ngomsindo, ngoba ucingo lwedawo losizo lufika emahoreni kamuva. Bhala umphumela obonakele kurekhodi lomklamo.
Ukuncika komaphakathi kuyefana kuwo wonke amamodi: othile kufanele abe ngumnikazi wendlela yokubuyisela yedivayisi uqobo.
Bhala isivumelwano segatsha ngaphambi kokufaka
Isivumelwano segatsha singena ekhasini elilodwa: abanikazi, imithombo yamakheli, ama-prefix adlula emhubheni, inqubomgomo yokuphuma kanye nokuziphatha kokwehluleka okuvumile.
Bese uqinisekisa umphumela ofakiwe hhayi owawuhloswe. Hlola ikheli lekhastoma legatsha, igesi yalo ezenzakalelayo, ukuthi yimaphi ama-prefix axazululwa ngomhubhe nokuthi yini esaphendula lapho umhubhe uvinjiwe. Ukuhambisana, ukufinyeleleka nelayisense konke kufanele kuqhathaniswe nombhalo wamanje womhlinzeki wemodeli eqondile, ngoba igama lomkhiqizo aliqinisekisi imodi. Gcina lelo khasi kanye nerekhodi ledivayisi ukuze unjiniyela olandelayo azuze izinqumo hhayi umdwebo.
ip -br addr
ip route
traceroute -n 10.80.4.10
dig +short intranet.corp.examplePhinda leyo bhulokhi lapho umhubhe uvinjiwe, futhi umehluko phakathi kokugijima kokubili ukuziphatha kokwehluleka owakuthenga ngempela.