Kungani i-VM ye-Azure enedivayisi ye-VPN ilahlekelwa umzila wokubuyela
Idivayisi ye-VPN ku-VM ye-Azure idinga ukuthi i-UDR, ifulegi lokudlulisa lek hadi lenethiwekhi kanye nenqubomgomo yesivakashi kuvumelane. Landela isicelo esisodwa segatsha kuzo zontathu.
I-VM ye-Azure eqhuba idivayisi ye-VPN ihlezi ngaphakathi kwezinhlelo ezimbili ezizimele zokuthatha izinqumo. I-Azure inquma ukuthi iphakethe liphuma kuphi kusubneti, isebenzisa amathebula emizila kanye nesilungiselelo sokudlulisa sekhadi lenethiwekhi. Uhlelo lokusebenza lwedivayisi ngokwalo lunquma ukuthi luzodlulisela yini iphakethe elisusiwe ukubhala. Ithuneli eliphuma ngokuphelele lingase lihluleke kusistimu yesibili, futhi yilapho iningi lalokhu kufakwa kumiswa khona.
Abanikazi abathathu bomzila owodwa
Thatha inethiwekhi yegatsha 192.168.50.0/24 nesubneti yomthwalo womsebenzi 10.0.10.0/24, idivayisi ise 10.0.0.4 kusubneti yayo. Isicelo esisodwa sithinta izilungiselelo ezintathu ezihlukene.
| Decision | Configured in | How it fails |
|---|---|---|
| Where the workload subnet sends branch traffic | Azure route table entry | Traffic leaves the subnet and never reaches the appliance |
| Whether a NIC may accept traffic not addressed to it | Azure NIC IP forwarding | Packets arrive and disappear at the interface |
| Whether the guest forwards decrypted traffic | Guest OS or vendor appliance policy | Tunnel is up, workload is unreachable |
| Whether the workload accepts the source | NSG and service policy | Requests delivered, replies refused |
Umgqa ngamunye uphethwe yithimba elihlukile ezinhlanganweni eziningi, yingakho lokhu kwehluleka ngokuvamile kufika njengamathikithi amathathu esikhundleni elilodwa.
Umzila okhombisa kudivayisi
Hlanganisa ithebula lemizila nesubneti yomthwalo womsebenzi bese unikeza isiqalo segatsha ihophu elilandelayo yohlobo lwe-Virtual appliance ene 10.0.0.4 njengekheli. Sebenzisa ikheli langasese elifinyelelekayo ledivayisi, ungalokothi usebenzise iphoyinti layo lokungena le-VPN lomphakathi. Ihophu elilandelayo kufanele kube ikheli isubneti yomthwalo womsebenzi esivele ikwazi ukulufinyelela. Shiya okunye ukuhlela umzila komthwalo womsebenzi njengoba kunjalo, ngaphandle uma unqume ngamabomu ukushintsha umzila ozenzakalelayo.
Gcina idivayisi kusubneti yayo, futhi qinisekisa ukuthi umzila odlulisela ithrafikhi yegatsha kudivayisi awubambi nomzila wokuphuma wedivayisi uqobo. Umjikelezo onjalo ubukeka njengethuneli elinempilo elingenazimpendulo, futhi lokho kuyinto embi kakhulu ukuyihlola ngehora lesi-2 ebusuku.
Ifulegi lekhadi lenethiwekhi elikhohlwa yiwo wonke umuntu
I-Azure inesilungiselelo sokudlulisa i-IP sekhadi ngalinye lenethiwekhi, futhi sicishiwe ngokuzenzakalelayo. Sikhona ngoba ikhadi elidlulisayo lamukela amaphakethe aqondiswe kwenye into, futhi ukuwalahla buthule kuyisimo esiphephile esizenzakalelayo kubo bonke abanye.
az network nic update --resource-group rg-net --name appliance-nic --ip-forwarding true ivula lona kuhlelo lokusebenza olulodwa. Iziqondiso ze-Microsoft mayelana nokudlulisa kukhadi lenethiwekhi zidinga isilungiselelo kukhadi ngalinye elixhunyiwe elidlulisa ithrafikhi, ngakho idivayisi enekhadi elilodwa isilidinga kulelo khadi.
Ifulegi akuwona umzila futhi akuwona umthetho we-firewall. Ukulivula kunikeza imvume futhi akukho okunye.
Isivakashi senza ini ngephakethe elisusiwe ukubhala
Lapho ithuneli liphela, isitaki sedivayisi uqobo sithatha isinqumo esilandelayo. Kusivakashi se-Linux, ukudlulisa i-IPv4 kuyisilungiselelo sesikhathi sokusebenza, futhi sysctl -w net.ipv4.ip_forward=1 kuhlala kuze kube ukuqalisa okulandelayo. Kugcine efayeleni elingaphansi kwe /etc/sysctl.d/ esikhundleni salokho. Idivayisi yomkhiqizi inokulingana kwayo, futhi iziyalezo ze-Linux ezixunywe kunkundla yomkhiqizi ngokuvamile azenzi lutho.
Inqubomgomo ye-firewall yesivakashi yehlukile futhi, kanjalo neqembu lokuphepha kwenethiwekhi lomthwalo womsebenzi. Ukuvumela i-UDP 500 ne-4500 kukheli lomphakathi le-VM kuvikela ithuneli; akusho lutho mayelana nokuthi isicelo segatsha esisusiwe ukubhala singafinyelela yini embobeni yomthwalo womsebenzi.
Landela isicelo esisodwa kanye nempendulo yaso
Khetha ukuhamba okukodwa okuvunyelwe futhi ukulandele kusukela ekuqaleni kuze kube sekupheleni. Igatsha lidinga umzila we 10.0.10.0/24 ngokusebenzisa uxhumano lwendawo, idivayisi idinga indlela yokuletha eya kusubneti yomthwalo womsebenzi, futhi isubneti yomthwalo womsebenzi idinga umzila wokubuyela ogatsheni.
Nquma kusenesikhathi ukuthi umklamo ugcina ikheli lomthombo wegatsha noma uyalihumusha. I-NAT ishintsha lokho umthwalo womsebenzi okubonayo, ngakho imithetho yawo yokufinyelela kufanele ichaze imodeli oyikhethile ngempela hhayi ikheli lesango eliqanjiwe.
Ukuxhawulana okuphumelelayo kufakazela ikhonkco elilodwa lalolo chungechunge. Umzila uphelele lapho impendulo ibuya ngayedivayisi futhi inqubomgomo yomthwalo womsebenzi uqobo iyivuma.