Kungani umsebenzisi okude we-ASA efinyelela isubneti kodwa engayifinyeleli i-app
Imizila ikhombisa ukuthi ithuneli iyasebenza, hhayi ukuthi umsebenzisi uvunyelwe ukuvula i-app. Funda isihlungi iseshini esitholile, bese uhlola ukuxhumana okuvunyelwe nokwenqatshiwe.
Umsebenzisi wakho uxhumana, uthola ikheli, uphinga iseva esisubnetini ye-app, futhi awukwazi ukuvula insizakalo ekulo. Leyo nhlanganisela ijwayelekile ku-ASA, ngoba ithuneli eliphumelelayo nemvume esebenzisekayo kunqunywa izilungiselelo ezihlukene. Uhlu lwethuneli elihlukanisiwe lukhethe ukuthi iziphetho ziphi ezingena kuthuneli; isihlungi se-VPN nemithetho yokufinyelela yesiphetho ngokwaso kunquma ukuthi isicelo esichithiwe siyafinyelela ini. Dlula izinqumo ezintathu ngokulandelana esikhundleni sokwandisa uhlu lwemizila kuze kushintshe okuthile.
Izinqumo ezintathu okulula ukuzidida
Ukwamukelwa kuphendula ukuthi umsebenzisi angakha ithuneli noma cha: imininingwane yobunikazi, isitifiketi nanoma yisiphi isici sesibili. Ukukhethwa komzila kuphendula ukuthi iziphetho ziphi iklayenti elizithumelayo kulelo thuneli. Ukugunyazwa kuphendula ukuthi isicelo esichithiwe singayifinyelela insizakalo noma cha. Kuphela kungokwesithathu okukhiqiza iphutha umsebenzisi alibikayo.
Indlela esheshayo yokuhlukanisa ukubuza ukuthi ushintsho lungalimaza ini. Ukususa umzila ohlwini oluhlukanisiwe kumisa ukuhamba kwedatha eya kuleyo subneti ngaphandle kokunikeza lutho; ukwengeza i-ACE esihlungini se-VPN kunikeza isiphetho ngaphandle kokushintsha lokho iklayenti elikufaka kuthuneli.
| Setting | What it decides | Symptom when it is wrong |
|---|---|---|
| Connection profile and authentication | Whether the tunnel is built | Login fails, no address assigned |
| Split-tunnel network list | Which destinations the client routes into the tunnel | Subnet unreachable from the client, everything else fine |
| VPN filter (ACL) | Which decrypted flows are permitted | Tunnel up, ping may work, TCP service refused or dropped |
Funda isihlungi iseshini esithole ngempela
Qala esesheni ekhona hhayi ekucushweni ocabanga ukuthi kuyasebenza. show vpn-sessiondb detail anyconnect iphrinta inqubomgomo yeqembu eyabelwe kanye negama lesihlungi elixhunywe kuleyo seshini. Uma le nkambu ingenalutho, asikho isihlungi esiphoqa noma yini futhi ukuvinjelwa kuvela kwenye indawo.
Bese ufunda inqubomgomo ephethe lelo nani, kuhlanganise namanani azijwayelekile, ngoba isihlungi singase sizuzwe njengefa esikhundleni sokubhalwa lapho ubheka khona:
show run all group-policy <policy-name>
show run access-list <acl-name>
show run webvpn
Qhathanisa igama lesihlungi esesheni ne-ACL oyihlele kabusha. I-ACL enegama elifanayo umsebenzisi angakaze ayithole ayikwazi ukushintsha inqubomgomo yezinsiza yaleyo seshini, futhi lesi yisizathu esivame kakhulu sokuthi ushintsho olubonakala lulungile lungabi nawo umthelela.
Ukubaluleka kuchaza okunye. Kokulungiselelwa kwesihlungi, irekhodi le-DAP liphezu kwezimfanelo zegama lomsebenzisi, futhi izimfanelo zegama lomsebenzisi ziphezu kwenqubomgomo yeqembu. Uma iseshini ikhombisa isihlungi obungasilindele, funa inqubomgomo ye-DAP ehambisana nalo msebenzisi ngaphambi kokuthinta iqembu.
Uhlu oluhlukanisiwe nesihlungi kuyizinkambu ezihlukene
Ku-ASA 9.x inqubomgomo yeqembu igcina split-tunnel-network-list kanye vpn-filter njengezilungiselelo ezihlukene, futhi umhlahlandlela wenqubomgomo yeqembu 9.22 uzibhala ngokwehlukana ngenxa yaleso sizathu. Uhlu lwenethiwekhi luyisikhombisi somzila kuklayenti; isihlungi uhlu lokulawula ukufinyelela olusetshenziswa kudatha echithiwe.
Lowo mehluko ubalulekile lapho umsebenzisi edinga insizakalo eyodwa ye-HTTPS kusubneti. Faka isubneti ohlwini oluhlukanisiwe ukuze amaphakethe angene kuthuneli, bese uvumela kuphela leyo nsizakalo esihlungini. Ukwandisa uhlu lwemizila akugunyazi lutho, futhi ukulunciphisa akusona isisetshenziswa sokuphoqelela.
Hlola ukuthi i-ACL yesixhumanisi isemzileni yini ngisho
Idatha yokufinyelela kude echithiwe ayihlali idlula ku-ACL yesixhumanisi sangaphandle njengoba abantu becabanga. Lapho sysopt connection permit-vpn kusebenza khona, i-ASA isebenzisa ukweqa kwayo kwe-VPN okubhaliwe kuleyo datha, kuyilapho izihlungi ze-VPN ezisebenzayo zisaqhubeka ngemva kwalokho. Hlola isilungiselelo nge-show run all sysopt esikhundleni sokuqagela kusuka kumdwebo wethopoloji.
Noma kunjalo, i-firewall yesibambi somkhathi kanye nokugunyazwa kwe-app kuhlala kusemzileni. Umthetho we-ASA ovumela i-TCP 443 awenzi i-app yamukele umsebenzisi.
Yamukela ushintsho ngokuxhumana okwenqatshiwe futhi
Ukuhlola okuvunyelwe kuphela akufakazi lukhulu, ngoba ithuneli elisebenzayo likhiqiza iphakethe lokuqala elifanayo noma ngabe isihlungi sikhona noma asikho. Vula insizakalo ehlosiwe kusuka kuklayenti, bese uzama isiphetho okufanele sihlale sivaliwe futhi uqinisekise ukuthi sehluleka ngesizathu esifanele.
Rekhoda amaqiniso amane lapho uvala ithikithi: ubunikazi obamukelwe, inqubomgomo nesihlungi iseshini ekuthole ngempela, iziphetho ezisohlwini oluhlukanisiwe, kanye nesisetshenziswa umsebenzisi avunyelwe ukusifinyelela. Lawa mane achaza lapho idatha ilawulwa khona ngaphandle kokuguqula uhlu lwemizila lube yi-firewall.
Uma insizakalo isala ngemva kokuba isihlungi siyivumile, dlulela kusibambi: ikheli lokulalela, i-firewall yesibambi kanye nokumephwa kwabasebenzisi kwe-app ngokwayo. Ngaleso sikhathi ithuneli lenze umsebenzi walo, futhi ezinye izinguquko ku-ASA zengeza ingozi kuphela.