Kungani isikhathi sakho se-BGP singaveli kuthebula lezindiza le-VPC

Indaba eshiwoyo ngukuthi i-daemon yokuhambisa izindiza kudivayisi ye-VPN ku-EC2 izofundisa i-VPC iziqalo zayo ezikude lapho i-BGP isiphakama. Ingxenye yalokho iqiniso. Isikhathi siyaphakama, futhi akukho okushintshayo kuthebula lezindiza le-VPC ngenxa yaso, yingakho uphawu lokuqala ngokuvamile kuba yi-subnet ethula ngokuthula ithrafikhi emgodini omnyama.

Izinto ezimbili ezahlukene ziyahlangana lapha: ukuxhumana ne-server yezindiza, nokufaka izindiza kuthebula.

Inganekwane: phakamisa i-BGP futhi i-VPC izofunda iziqalo

I-BGP iyingxoxo phakathi kwabakhulumi ababili, futhi kulo mklamo abakhulumi yi-daemon yezindiza kudivayisi yakho kanye nendawo yokugcina ye-VPC Route Server i-AWS eyibeka ku-subnet okungokwakho. Leyo ngxoxo ithwala iziqalo. Ayithinti ithebula lezindiza lama-subnet omsebenzi wakho, ngoba lawo mathebula afunda kuphela ngokusabalala okufanele kuvulwe kwelinye nelinye. Kuze kube lokho kwenzeka, indwangu ye-VPC ayazi lutho ngalokho okwaziwe yidivayisi.

Izinyathelo zokuhlela zihlukene ngesizathu: xhumanisa, dala indawo yokugcina, yenza i-peer, bese uvula ukusabalala.

I-Route Server iyipulani yokulawula, akusiyo umhubhe

I-Route Server ayibethelisi, ayidlulisi futhi ayihloli ngisho iphakethe elilodwa. Ikhona ukuze ishintshisane nge-BGP nedivayisi futhi inikeze iziqalo ezivelayo kumathebula ezindiza ahlelwe ukuzamukela. Ipulani yedatha ayishintshanga: amaphakethe asaphuma ngesixhumanisi senethiwekhi sedivayisi, ahamba nge-VPN yayo, futhi abuye ngendlela efanayo.

Lokho kusho ukuthi ukuhlolwa komthombo nendawo okukholelwa kuyo ku-instance yokudlulisa kusabalulekile, ngoba i-instance manje idlulisa ithrafikhi eqondiswe komunye umuntu.

Amaqembu okuphepha nezilawuli ze-subnet nawo ayasebenza kumgelezo odlulisiwe. I-Route Server ngeke iphoqe idivayisi elahla ithrafikhi ukuthi lidlulise, futhi ngeke ilungise indlela yokubuya engekho ohlangothini olukude.

Ukusabalala kungokwetebula lezindiza ngalinye, hhayi i-VPC yonke

Ukuxhumanisa i-route server ne-VPC nokuvula ukusabalala kuthebula lezindiza kuyizinqumo ezimbili, futhi eyesibili kuphela eshintsha okwenziwa yi-subnet. I-VPC enamathebula ayisithupha ezindiza ingamukela isiqalo esisabalalisiwe kwelinye hhayi kwamanye amahlanu, okulungile ngqo kwi-subnet ye-hub futhi kuyikho kanye okukhiqiza umphumela odidayo othi «isebenza ingxenye». Ngisho lapho ukusabalala kuvuliwe, indlela eqhudelanayo inganqoba, ngoba ukukhetha indlela kwe-VPC kuthanda isiqalo eside kakhulu futhi, uma ubude bulingana, kuthanda indlela eqinile kuneyo esabalalisiwe. Lokho kukhetha kusetshenziswa ngokuthula.

Hlola ithebula elisebenzayo lesi-subnet esithile esikhundleni sohlu lweziqalo ezimemezelwa idivayisi. I-API iphendula lowo mbuzo ngqo: aws ec2 associate-route-server ne-aws ec2 enable-route-server-propagation --route-table-id <id> yizinyathelo ezimbili abantu abazikhohlwayo, futhi i-aws ec2 describe-route-tables --route-table-ids <id> ikhombisa ukuthi isiqalo safika njengengxenye ye-route server.

Idiyivayisi isathwala iphakethe ngalinye

Ukumemezela ukufinyeleleka akufani nokuba nakho. Isikhathi se-BGP singahlala siphakanyisiwe ngenkathi i-VPN yedivayisi iphansi, futhi isimemezelo esiqinile esingashintshi silokhu sidadisa ithrafikhi endleleni efile. I-Route Server isekela ukutholwa kokwehluleka okufana ne-BFD, kodwa lokho kuhlola ukuphila kukahamba naye, hhayi impilo yakho konke okungemuva kwakhe.

Hlanganisa isimemezelo nendlela yokugcina yangempela: memezela isiqalo lapho umhubhe nenethiwekhi ekude kukhona, futhi usihoxise lapho kungekho.

Hoxisa isiqalo bese ubona okwenzekayo

Hlola ngezigaba, futhi wenze isigaba sokugcina sibe ukususa. Qinisekisa ukuthi isimemezelo siyafika, isiqalo sivela kuthebula ngalinye elihlosiwe, idivayisi iyihop elilandelayo, ukudlulisa kuwela umhubhe osebenzayo futhi uhlangothi olukude luyaphendula. Bese uhoxisa isiqalo sokuhlola, noma uvale umhubhe ogunyaziwe, futhi ubheke ukuthi ithrafikhi iyahamba yini iya lapho umklamo uthi kufanele iye khona. Bhala amathebula angaphambi nangemuva ngenkathi ukuhlola kusavuliwe.

Ukuhambisa indlela iye kudivayisi yesibili akuhambisi izikhathi ebezizithwala, ngoba isimo se-NAT ne-firewall sihlala kudivayisi yokuqala.

Kusethi eqinile yeziqalo eziyishumi nambili, izindlela eziqinile kumathebula e-VPC zihlala ziyimpendulo eshibhile. I-Route Server ithola indawo yayo lapho uhlu lweziqalo lushintsha ngempela futhi inqubomgomo yokuhoxisa iyinto ongayichazela umuntu osemsebenzini wokulinda.