Kungani i-BGP phezu kwe-VPN ingalawuli umzila wengqimba engezansi
I-BGP phezu kwe-VPN ishintshana ngokufinyeleleka futhi isebenzisa inqubomgomo yemizila, kodwa ingqimba engezansi isakhetha umzila wangaphandle. Lokho okuqondile okulawulwa yiseshini.
Amasayithi amabili enza i-BGP peer phezu komhubhe we-IPsec, afunda iziqalo zamagama zomunye nomunye, futhi umdwebo uqanjwa kabusha njengokulawula umzila. Yilowo lebula uqobo ukuqala kokudideka. Iseshini ishintshana ngokufinyeleleka futhi isebenzisa inqubomgomo ngempela, kodwa ayinalo izwi mayelana nokuthi iyiphi inkampani, intambo noma i-router ethwala amaphakethe abethelwe. Ngibone ithimba lakha kabusha umhubhe owawusebenza ngoba lalilindele ukuthi ushintsho lomzila we-BGP luzothutha ithrafikhi iye komunye umzila wefayibha iseshini eyayingasoze ikwazi ukuwuthinta.
Lokho abantu abacabanga ukuthi iseshini iyakuthenga
Iningi lalokho okulindelekile livela endleleni ushintsho lomzila olubonakala ngayo elabhorethri. Umemezela isiqalo samagama phezu komhubhe, uhlangothi olukude luyasifaka, futhi ithrafikhi iyahamba. Ukulandelana okufanayo kwenzeka ku-router enezilawuli zobunjiniyela bethrafikhi ngempela, ngakho kokubili kuyadidaniswa. Elabhorethri womabili amasayithi ngokuvamile ahlanganyela isixhumanisi esisodwa sokufinyelela, futhi yingakho umehluko ungalokothi ubonakale lapho.
I-BGP iyiphrothokholi yokufinyeleleka. Itshela i-peer ukuthi ungakwazi ukuletha amaphakethe esiqalo samagama futhi ivumela uhlangothi ngalunye ukuhlela iziphakamiso ezizitholayo. Lokhu kuyasiza ngempela phezu komhubhe: iziqalo zamagama ziyavela futhi zinyamalale njengoba amasayithi eza futhi ehamba, futhi ungakwazi ukwenqaba ububanzi ngaphandle kokubhala umzila oqinile kudivayisi ngayinye yomphetho. Lokho engakwenzi ukulethela ama-router enkampani ngaphansi kokulawula kwakho.
Ingqimba engezansi ithwala isihloko sangaphandle. Iphoyinti lakho lokugcina lomhubhe lithumela amaphakethe abethelwe ekhelini le-peer, futhi inethiwekhi phakathi kwalawo makheli amabili iwadlulisela ngemizila efakwe abasebenzi bayo. Akukho lutho eseshini ye-BGP olushintsha leso sinqumo, ngaphandle uma leyo nkampani inikela ngesevisi esekelwayo eyenza lokho.
Lokho iseshini ekuthwalayo ngempela
Isikhulumi se-BGP sivula uxhumano lwe-TCP oluya ephothini 179 ye-peer yaso, sisebenzisa izimo zemiyalezo nezimfanelo zomzila ezichazwe ku-RFC 4271. Lapho ikheli le-peer lisingaphakathi komhubhe, umhubhe kufanele ube phezulu futhi lelo kheli lifinyeleleke ngaphambi kokuba iseshini iqale. Ukushintshana kwe-IKE okuqediwe akuyona umakhelwane we-BGP. Izinhlelo ze-IPsec ezisekelwe emizileni zivumela ithrafikhi ukuthi idlule kuphela lapho kukhona umzila womhubhe ofanayo, kanti lowo osekelwe enqubomgopweni udinga ikheli le-peer ngaphakathi kwesikhethi esivikelwe. Ukuhlanekezela lokhu kuletha isimo sakudala lapho umhubhe uluhlaza khona kanti iseshini ihleli ingenzi lutho.
Lapho iseshini isiphezulu, inqubomgomo inquma okudlula kuyo. Uhlu lweziqalo zamagama, izihlungi ze-AS-path, umkhawulo wamasentimitha eziqalo zamagama kanye nesinqumo esicacile mayelana nemizila ezenzakalelayo kuyisisekelo, futhi kusebenza kuzo zombili izinhlangothi. I-peer eyamukela konke ekutholayo ingakunika umzila ozenzakalelayo othatha indawo yokufinyelela i-inthanethi yasendaweni buthule. Izinhlangothi ezimbili zidinga uhlu oluhlukile, ngoba lokho okwamukela ku-peer nalokho okumemezela kuyo kuyizinqumo ezimbili ezihlukile.
router bgp 65010
neighbor 10.255.0.2 remote-as 65020
address-family ipv4 unicast
neighbor 10.255.0.2 prefix-list SITE-B-IN in
neighbor 10.255.0.2 prefix-list SITE-B-OUT out
neighbor 10.255.0.2 maximum-prefix 50
Ngemva kwalokho i-MTU iyaluma. Ukuhlanganisa kunciphisa umthwalo osebenzisekayo, ngakho ukubuyekezwa okukhulu kungamisa iseshini ebonakala isungulwe ngokuphelele: i-peer ihlala phezulu, iziqalo zamagama azifiki neze, futhi akukho lutho olucacile olungena kulo ilogi. Khawulela i-TCP MSS kusixhumanisi somhubhe, noma setha i-MTU yomhubhe enendawo yokwengeza, ngaphambi kokusola izihlungi.
Amaphakethe angaphandle asaya kuphi namanje
Amaphakethe abethelwe ukusuka kwesinye isayithi aya kwesinye aphuma ngokuthi i-router yasendaweni ikhetha ini ngekheli lomphakathi le-peer. Uma womabili amasayithi ethenga ukudluliswa kunkampani eyodwa, edlula esakhiweni esisodwa se-metro, noma uhlangothi olulodwa lungemuva kwe-NAT yezinga lenkampani, umhubhe usinda ekuhlulekeni kwenkampani ngengozi kuphela. Ukubala izithonjana zomhubhe kuthuluzi lokuqapha akukutsheli lutho ngalokhu.
Ukukhetha umzila nokufaka ukudlulisela nakho kuyizigameko ezihlukile. Isiqalo samagama singahlala etafuleni le-BGP njengokungcono kakhulu futhi sisashoda etafuleni lokudlulisela, ngoba igxathu elilandelayo alikwazi ukuxazululwa noma umzila oqondile kakhulu uyaphumelela. Lapho othile ebika ukuthi i-BGP ifunde isiqalo samagama kodwa ithrafikhi ayihambi, umbuzo owusizo ukuthi ngabe sifakiwe futhi sikhomba kuyiphi igxathu elilandelayo.
Impendulo eqotho yokubuyekezwa komklamo uhlu lwemibono edingekayo ehlanganyelwayo: isifunda sokufinyelela, inkampani ephezulu, isakhiwo kanye nanoma iyiphi idivayisi egcina isimo emzileni wokubuya. Iseshini phezu komhubhe ayikwazi ukususa umbono engahlali phezu kwawo.
Izinqumo ezintathu okufanele zihlukaniswe
Lapho umklamo uhlanganisa lezi, yonke ingxoxo yokuhluleka ihamba iyindilinga. Hlukanisa kuqala ephepheni, bese uhlanganisa ngakunye nedivayisi eliyisebenzisayo ngempela.
| Decision | Who controls it | Typical failure |
|---|---|---|
| Which prefixes may cross the relationship? | Both sides, through prefix and AS-path policy you configure deliberately | A default route accepted by mistake, or a vague aggregate |
| Which overlay next hop wins? | Local BGP selection plus next-hop resolution on your own routers | Prefix learned, never installed in the forwarding table |
| Where do the encrypted packets travel? | The underlay operators, unless a supported service adds real control | Path diversity that was never there |
Umgqa ngamunye unomnikazi ohlukile. Owokuqala uyingxoxo, owesibili ukumiswa kumadivayisi akho, owesithathu inethiwekhi yomunye umuntu ikakhulukazi. Isicelo soshintsho esibiza umgqa osuthintayo silula kakhulu ukusivuma kunesicelo esithi inkinga ye-BGP.
Izimo zokuhluleka okufanele zihlelwe
Ukwamukela umzila ofingqiwe we-peer yilona nxeba elizibangelwa ngokwethu elivame kakhulu. Othile umemezela ukuhlanganisa okufushane ukuze enze ukushintshana kube lula, uhlangothi olukude luyakwamukela, futhi ithrafikhi yobubanzi obungekho ngemuva komhubhe ilandela umhubhe bese ifa. Hlunga ngeziqalo zamagama ezilindeleke ngokunembile, noma sebenzisa uhlu lweziqalo zamagama olunemingcele efanele, futhi ungalokothi wamukele ukuhlanganisa okungenalutho ngoba kwenza iseshini ibonakale ihlelekile.
Isikhathi sokuhoxisa yisona sesibili. Ukutholwa kuncike kuzibali zokubamba, ku-BFD uma uyivulile, ekutholweni kwe-peer efile yomhubhe nasekutheni uhlangothi olukude luyeke ngokushesha kangakanani ukumemezela. Amaseshini akhona ayinkinga ehlukile: umzila omusha ungabuyisela ukuxhumana okusha kuyilapho amaseshini e-TCP asunguliwe eqhubeka nokusebenzisa amakheli aphelelwe yisikhathi, futhi izivikeli zomlilo ezigcina isimo noma i-NAT emzileni zingagcina okufakiwe okungasahambisani. Faka ukululama kohlelo ezimisweni zokwamukela esikhundleni sokucabanga ukuthi ushintsho lomzila lulungisa konke.
Okwesithathu ukungalingani komzila wokubuya. Ithrafikhi ingafika ngomhubhe bese ibuyela ngokuxhumana kwenkampani okwakungaklanyelwe ukuyithwala, lokhu okubonakala njengomsindo wohlangothi olulodwa, ukuxhawula okuhlulekile noma isivikeli somlilo esilahla izimpendulo. Hlola izinhlangothi zombili ngokwehlukana.
Okufanele kubhalwe esivumelwaneni, nokuthi kuqinisekiswa kanjani
Cela iziqalo zamagama ezivunyelwe ngokubhaliwe: ubani ogunyaziwe ukudala ububanzi ngabunye, ukuthi umzila ozenzakalelayo uvunyelwe yini, nokuthi yimaphi amaqembu amakheli asekelwa isevisi yomhubhe. I-RFC 8212 yenza inqubomgomo ecacile yokungenisa nokuthumela ngaphandle ibe okulindelekile kwe-eBGP ezinhlelweni eziyilandelayo, ngakho i-peer esathembele ekuziphatheni okucashile kokwamukela konke ifanele ibuzwe.
Ngemva kwalokho qinisekisa kudivayisi hhayi kumdwebo. Imiyalo ewusizo kuma-router esitayela se-FRR:
show bgp summary
show bgp ipv4 unicast 10.10.0.0/16
show bgp ipv4 unicast neighbors 10.255.0.2 advertised-routes
show ip route 10.10.0.0/16
Engeza okubili okuqashelwe okungeke itafula lemizila likunikeze khona. Bhala kusixhumanisi sangaphandle ukuze uqinisekise ukuthi amaphakethe ahlanganisiwe aqondise kweliphi ikheli ngempela, isibonelo tcpdump -ni eth0 udp port 51820 kumhubhe we-WireGuard, noma isihlungi se-ESP se-IPsec. Bese ulandelela ubheke ikheli lomphakathi le-peer futhi uqhathanise izigxathu nokulandelela okungaphakathi komhubhe; uma zombili zilandela uchungechunge olufanayo lwenkampani, ukusilela kwakho kuhlala enqubomgopweni yemizila hhayi enethiwekhi.
Ekugcineni, hlola ukuhoxisa ngamabomu. Yehlisa umhubhe esikhathini sokulungisa, qopha ukuthi isiqalo samagama sihlala isikhathi esingakanani sifakiwe, okwenzeka kumaseshini akhona nokuthi uhlangothi olukude lubuyela emzileni ongayamukela ngempela yini. Lowo msebenzi usho okuningi ngomklamo kunanoma yimuphi umdwebo.
Umzila awusona isigunyazo. Iziqalo zamagama okuvumelana ukuzishintsha azisho lutho mayelana nokuthi abaphi abasebenzisi abangafinyelela kuphi isevisi ngemuva komhubhe, ngakho gcina ukuqinisekisa, amasevisi avunyelwe kanye nezivikeli zomlilo zomsingathi endaweni yazo yangempela. I-peer efinyeleleka nayo ayisona isigunyazo sokudluliswa okungenamkhawulo noma ukudala amakheli angokuthanda, futhi igunya elinjalo lingelesivumelwano njengombuzo wezebhizinisi, hhayi umugqa wenqubomgomo ye-BGP.
- Shono iziqalo zamagama uhlangothi ngalunye olungazidala, nalezo okungafanele zilwamukele neze.
- Khawulela i-MSS kumhubhe futhi uqinisekise ukuthi ukubuyekezwa okukhulu kufika ngempela.
- Bhala uhlu lwemibono ehlanganyelwayo yengqimba engezansi, hhayi inani lemihubhe.
- Linganisa ukuhoxisa kwangempela futhi uqophe okwenziwa uhlelo.