Iphi i-VRF efinyelela umlingani we-VPN futhi iphi ethwala iphakethe?

Ithuneli ngayinye ngaphakathi komongo wokuhambisa imizila weklayenti kusamele ifinyelele umlingani wayo okude, futhi lokho kusesha kungenzeka kukuthebula elihluke ngokuphelele. Ukwenza lokhu ngokungalungile kukhiqiza okunye kwezinto eziwohlokayo kakhulu ku-IPsec eyazi i-VRF: ithuneli liyaphakama, imizila ibonakala ikhona, futhi ithrafikhi iyafa ngoba okukodwa kwalokho kusesha okubili kwasebenzisa umongo ongalungile. Yenza izinyathelo ezine ezingezansi ngokulandelana, futhi ubhale phansi izindawo ezimbili ngokwehlukana.

Ukusesha okubili, ithuneli elilodwa

Iphakethe langaphandle elisongelwe likhonjiswe ekhelini lokuthutha lomlingani, futhi lihambiswa ngemizila ngaphambi kokuba kube khona noma yikuphi ukuvikelwa. Iphakethe langaphakathi likhonjiswe kuseva yeklayenti futhi lihambiswa ngemizila ngemuva kokususwa kwesongelo, ngaphakathi komongo weklayenti. Lezo izindawo ezimbili, ukusesha okubili futhi ngokuvamile amathebula amabili ahlukene.

Imibhalo ye-Cisco ye-IPsec eyazi i-VRF ibabiza ngokuthi i-VRF yomnyango wangaphambili kanye ne-VRF yangaphakathi. Umnyango wangaphambili uthwala ukuthutha okubethelwe, futhi umongo wangaphakathi uthwala ithrafikhi evikelwe. Akukho lutho ekwethuleni ithuneli ngegama leklayenti okwenza noma yimuphi kule mizila ibonakale.

Ngakho-ke bhala amaqiniso amane ngaphambi kokushintsha ukucushwa: ikheli lokuthutha lomlingani kanye nomongo ofinyelela kulo, bese kuba isiqalo seseva kanye nomongo ofinyelela kuso. Uma ungeke ukwazi ukugcwalisa wonke amane, usuzokulinganisa. Ukulinganisa kule ndawo kuyabiza, ngoba umzila owengezwe kuthebula elingalungile ungasebenzisa ukuhamba okukodwa kuyilapho kuthula ephula okunye. Amaqiniso amane athatha imizuzu eyishumi ukuwaqoqa futhi asindisa usuku lokuhlaziya ukubanjwa.

Qinisekisa ukusesha kokuthutha komlingani

Qala ngomnyango wangaphambili, ngoba ithuneli elingakwazi ukufinyelela umlingani walo ngeke lize livumele nephakethe elilodwa elivikelwe ukuba lidlule. Ku-IOS buza umzila oya kumlingani ngaphakathi kwe-VRF yokuthutha hhayi kuthebula lomhlaba wonke.

show ip route vrf wan-blue 203.0.113.20
show ip vrf brief
show crypto ikev2 sa

Umyalo wokuqala uphendula ukuthi ikheli lomlingani liyafinyeleleka yini kulo mongo, owesibili ubala ama-VRF akhona ngempela, futhi owesithathu ukhombisa ukuthi ingabe kwakhiwe ubudlelwano bokuphepha. Ikheli lomlingani elixazululwa kuphela kuthebula lomhlaba wonke liyiphutha elivamile lomnyango wangaphambili, futhi libonakala njengengxoxo ye-IKE engaqali neze.

Hlola nokwabiwa kwesixhumi esibonakalayo. Ukuziphatha okubhaliwe kudinga ukuthi i-VRF yomnyango wangaphambili wethuneli kanye ne-VRF yesixhumi se-WAN kuvumelane; ukungavumelani kungavumela iphakethe ukuphuma futhi kube kusavimbela impendulo ukuba icutshungulwe kumongo ofanele.

Qinisekisa ukusesha kwangaphakathi kweseva

Lapho umnyango wangaphambili usufakazelwe, shintshela kumongo weklayenti futhi ubuze umbuzo ofanayo ngesiqalo seseva. Lokhu kusesha kunquma ukuthi iphakethe elisusiwe isongelo lingadluliselwa yini phambili.

show ip route vrf customer-blue 10.60.4.0
show crypto session detail

Umyalo wokuqala ukhombisa umzila wangaphakathi, futhi owesibili ukhombisa isimo sesikhathi kanye neminongo isikhungo esihlobanise nayo. Uma umzila ukhona kodwa imininingwane yesikhathi ibiza umongo wangaphakathi ongalungile, ithuneli lidlulisela ethebuleni elingawazi isiqalo seklayenti.

Umzila osuthebuleni lomhlaba wonke awubona ubufakazi bakho kokubili ukusesha. Imizila yomhlaba wonke isetshenziswa lapho iphakethe lingahlobene nayo i-VRF, futhi isixhumi sethuneli esabelwe umongo weklayenti sishintsha lokho kuhlangana. Uma umzila wangaphakathi ungekho, iphakethe liyasuswa isongelo bese liyalahlwa ngenxa yokuntuleka kombhalo wokudlulisa, lokho okubonakala njengokulahleka kwephakethe hhayi njengephutha lokuhambisa imizila.

Beka isilungiselelo lapho imodeli ilindele khona

Imibhalo efanayo yehlukanisa amamodeli okucushwa, futhi isilungiselelo esingesinye asidingeki ukuthi sibe sesinye. Ema-sixhumi ethuneli asebenzisa ukuvikelwa kwethuneli, i-VRF yangaphakathi ichazwa kusixhumi sethuneli. Emiklamweni esekelwe ku-crypto map, i-VRF yangaphakathi iyingxenye yombhalo we-crypto map. Ukuhambisa umyalo onegama elifanayo phakathi kwamamodeli ngaphandle kokuhlola indima yawo yiyo indlela umklamo osebenzayo ophenduka owesikhathi.

Ukuhambisa imizila kanye nobuwena kuyizinto ezihlukene. Ukufinyeleleka akukaze kuthathe indawo yephrofayela yomlingani ezokwamukelwa idivayisi, futhi ukuqamba kabusha i-VRF akumele kuguqule ubufakazi obunikeziwe. Hlola kokubili ngemuva kwanoma yiluphi ushintsho, ngoba ithuneli elixoxa nephrofayela engalungile lingakha ubudlelwano futhi lingadlulisi lutho.

Ekugcineni, bhala amaqiniso amane kanye nemiyalo eyawafakazelayo kurekhodi yezinguquko. Unjiniyela olandelayo uzothola ithuneli njengefa hhayi ukucabanga, futhi inothi elifushane elibiza kokubili umongo linengi kunomdwebo okungekho muntu okuwubuyekeza.