Loni a yoo wo awọn aṣayan iṣeto ni VPN ti NSX Edge nfun wa.
Ni gbogbogbo, a le pin awọn imọ-ẹrọ VPN si awọn oriṣi bọtini meji:
- Ojula-si-ojula VPN. Lilo IPSec ti o wọpọ julọ ni lati ṣẹda oju eefin to ni aabo, fun apẹẹrẹ, laarin nẹtiwọọki ọfiisi akọkọ ati nẹtiwọọki ni aaye jijin tabi ni awọsanma.
- Wiwọle latọna jijin VPN. Ti a lo lati so awọn olumulo kọọkan pọ si awọn nẹtiwọọki ikọkọ ti ajo kan nipa lilo sọfitiwia alabara VPN.
NSX Edge gba wa laaye lati ṣe awọn mejeeji.
A yoo ṣe iṣeto ni lilo ibujoko idanwo kan pẹlu awọn Edges NSX meji, olupin Linux kan pẹlu daemon ti a fi sii ati kọǹpútà alágbèéká Windows kan lati ṣe idanwo VPN Wiwọle Latọna jijin.
IPsec
- Ni wiwo Oludari vCloud, lọ si apakan Isakoso ki o yan vDC. Lori taabu Awọn ẹnu-ọna Edge, yan Edge ti a nilo, tẹ-ọtun ati yan Awọn iṣẹ ẹnu-ọna Edge.
- Ni wiwo NSX Edge, lọ si taabu VPN-IPsec VPN, lẹhinna si apakan IPsec VPN Awọn aaye ki o tẹ + lati ṣafikun aaye tuntun kan.
- Fọwọsi awọn aaye ti a beere:
- sise – activates awọn latọna ojula.
- PFS - ṣe idaniloju pe bọtini cryptographic tuntun kọọkan ko ni nkan ṣe pẹlu eyikeyi bọtini iṣaaju.
- ID agbegbe ati Agbegbe Iparit – NSX eti ita adirẹsi.
- Subnet agbegbes – awọn nẹtiwọki agbegbe ti yoo lo IPsec VPN.
- Ẹlẹgbẹ ID ati Ẹlẹgbẹ Endpoint – adirẹsi ti awọn latọna ojula.
- Ẹlẹgbẹ Subnets - awọn nẹtiwọki ti yoo lo IPsec VPN ni ẹgbẹ latọna jijin.
- Alugoridimu ìsekóòdù - algorithm ìsekóòdù eefin.
- Ijeri - bawo ni a ṣe le jẹri awọn ẹlẹgbẹ. O le lo Bọtini Pipin-tẹlẹ tabi ijẹrisi kan.
- Bọtini Ṣaaju Pin - tọka bọtini ti yoo ṣee lo fun ijẹrisi ati pe o gbọdọ baramu ni ẹgbẹ mejeeji.
- Diffie-Hellman Ẹgbẹ - algorithm paṣipaarọ bọtini.
Lẹhin kikun awọn aaye ti o nilo, tẹ Jeki.
- Ṣe.
- Lẹhin fifi aaye naa kun, lọ si Ipo Iṣiṣẹ taabu ki o mu iṣẹ IPsec ṣiṣẹ.
- Lẹhin ti awọn eto ti lo, lọ si Awọn iṣiro -> IPsec VPN taabu ki o ṣayẹwo ipo oju eefin naa. A rii pe oju eefin ti dide.
- Jẹ ki a ṣayẹwo ipo oju eefin lati ẹnu-ọna ẹnu-ọna Edge:
- show iṣẹ ipsec – ṣayẹwo ipo iṣẹ naa.
- ṣe afihan aaye ipsec iṣẹ – alaye nipa ipo aaye naa ati awọn paramita ti o gba.
- show iṣẹ ipsec sa – ṣayẹwo awọn Aabo Association (SA) ipo.
- show iṣẹ ipsec – ṣayẹwo ipo iṣẹ naa.
- Ṣiṣayẹwo isopọmọ pẹlu aaye jijin:
root@racoon:~# ifconfig eth0:1 | grep inet inet 10.255.255.1 netmask 255.255.255.0 broadcast 0.0.0.0 root@racoon:~# ping -c1 -I 10.255.255.1 192.168.0.10 PING 192.168.0.10 (192.168.0.10) from 10.255.255.1 : 56(84) bytes of data. 64 bytes from 192.168.0.10: icmp_seq=1 ttl=63 time=59.9 ms --- 192.168.0.10 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 59.941/59.941/59.941/0.000 msAwọn faili atunto ati awọn aṣẹ afikun fun awọn iwadii aisan lati ọdọ olupin Lainos latọna jijin:
root@racoon:~# cat /etc/racoon/racoon.conf log debug; path pre_shared_key "/etc/racoon/psk.txt"; path certificate "/etc/racoon/certs"; listen { isakmp 80.211.43.73 [500]; strict_address; } remote 185.148.83.16 { exchange_mode main,aggressive; proposal { encryption_algorithm aes256; hash_algorithm sha1; authentication_method pre_shared_key; dh_group modp1536; } generate_policy on; } sainfo address 10.255.255.0/24 any address 192.168.0.0/24 any { encryption_algorithm aes256; authentication_algorithm hmac_sha1; compression_algorithm deflate; } === root@racoon:~# cat /etc/racoon/psk.txt 185.148.83.16 testkey === root@racoon:~# cat /etc/ipsec-tools.conf #!/usr/sbin/setkey -f flush; spdflush; spdadd 192.168.0.0/24 10.255.255.0/24 any -P in ipsec esp/tunnel/185.148.83.16-80.211.43.73/require; spdadd 10.255.255.0/24 192.168.0.0/24 any -P out ipsec esp/tunnel/80.211.43.73-185.148.83.16/require; === root@racoon:~# racoonctl show-sa isakmp Destination Cookies Created 185.148.83.16.500 2088977aceb1b512:a4c470cb8f9d57e9 2019-05-22 13:46:13 === root@racoon:~# racoonctl show-sa esp 80.211.43.73 185.148.83.16 esp mode=tunnel spi=1646662778(0x6226147a) reqid=0(0x00000000) E: aes-cbc 00064df4 454d14bc 9444b428 00e2296e c7bb1e03 06937597 1e522ce0 641e704d A: hmac-sha1 aa9e7cd7 51653621 67b3b2e9 64818de5 df848792 seq=0x00000000 replay=4 flags=0x00000000 state=mature created: May 22 13:46:13 2019 current: May 22 14:07:43 2019 diff: 1290(s) hard: 3600(s) soft: 2880(s) last: May 22 13:46:13 2019 hard: 0(s) soft: 0(s) current: 72240(bytes) hard: 0(bytes) soft: 0(bytes) allocated: 860 hard: 0 soft: 0 sadb_seq=1 pid=7739 refcnt=0 185.148.83.16 80.211.43.73 esp mode=tunnel spi=88535449(0x0546f199) reqid=0(0x00000000) E: aes-cbc c812505a 9c30515e 9edc8c4a b3393125 ade4c320 9bde04f0 94e7ba9d 28e61044 A: hmac-sha1 cd9d6f6e 06dbcd6d da4d14f8 6d1a6239 38589878 seq=0x00000000 replay=4 flags=0x00000000 state=mature created: May 22 13:46:13 2019 current: May 22 14:07:43 2019 diff: 1290(s) hard: 3600(s) soft: 2880(s) last: May 22 13:46:13 2019 hard: 0(s) soft: 0(s) current: 72240(bytes) hard: 0(bytes) soft: 0(bytes) allocated: 860 hard: 0 soft: 0 sadb_seq=0 pid=7739 refcnt=0 - Ohun gbogbo ti šetan, ojula-si-ojula IPsec VPN ti wa ni tunto ati ki o ṣiṣẹ.
Ninu apẹẹrẹ yii, a lo PSK lati ṣe ijẹrisi ẹlẹgbẹ, ṣugbọn ijẹrisi ijẹrisi tun jẹ aṣayan kan. Lati ṣe eyi, lọ si taabu Iṣeto Agbaye, mu ijẹrisi ijẹrisi ṣiṣẹ ki o yan ijẹrisi naa funrararẹ.
Ni afikun, iwọ yoo nilo lati yi ọna ijẹrisi pada ninu awọn eto aaye.
Mo ṣe akiyesi pe nọmba awọn tunnels IPsec da lori iwọn ti ẹnu-ọna Edge ti a fi ranṣẹ (ka nipa eyi ninu wa ).
SSL VPN
SSL VPN-Plus jẹ ọkan ninu awọn aṣayan Wiwọle Latọna jijin VPN. O ngbanilaaye awọn olumulo latọna jijin kọọkan lati sopọ ni aabo si awọn nẹtiwọọki aladani lẹhin ẹnu-ọna NSX Edge. Eefin ti paroko ni ọran SSL VPN-plus ti wa ni idasilẹ laarin alabara (Windows, Linux, Mac) ati NSX Edge.
- Jẹ ká bẹrẹ eto soke. Ninu igbimọ iṣakoso awọn iṣẹ ẹnu-ọna Edge, lọ si SSL VPN-Plus taabu, lẹhinna si Eto olupin. A yan adirẹsi ati ibudo lori eyiti olupin yoo tẹtisi awọn asopọ ti nwọle, mu gedu ṣiṣẹ ati yan awọn algoridimu fifi ẹnọ kọ nkan pataki.
Nibi o le yi ijẹrisi ti olupin yoo lo pada. - Lẹhin ohun gbogbo ti ṣetan, tan olupin naa ki o maṣe gbagbe lati fi awọn eto pamọ.
- Nigbamii ti, a nilo lati tunto adagun ti awọn adirẹsi ti a yoo fun awọn alabara nigbati a ba sopọ. Nẹtiwọọki yii yato si eyikeyi subnet ti o wa tẹlẹ ninu agbegbe NSX rẹ ko nilo lati tunto lori awọn ẹrọ miiran lori awọn nẹtiwọọki ti ara yatọ si awọn ipa-ọna ti o tọka si.
Lọ si awọn IP Pools taabu ki o si tẹ +.
- Yan awọn adirẹsi, iboju subnet ati ẹnu-ọna. Nibi o tun le yi awọn eto pada fun DNS ati olupin WINS.
- Abajade pool.
- Bayi jẹ ki a ṣafikun awọn nẹtiwọọki ti awọn olumulo ti n sopọ si VPN yoo ni iwọle si. Jẹ ki a lọ si taabu Awọn nẹtiwọki Aladani ki o tẹ +.
- Pon si:
- Nẹtiwọọki - nẹtiwọọki agbegbe eyiti awọn olumulo latọna jijin yoo ni iwọle si.
- Firanṣẹ ijabọ, o ni awọn aṣayan meji:
- lori eefin-firanṣẹ ijabọ si nẹtiwọọki nipasẹ oju eefin,
- eefin fori-firanṣẹ ijabọ si nẹtiwọọki taara ti o kọja oju eefin naa. - Mu TCP ti o dara ju ṣiṣẹ – ṣayẹwo apoti yii ti o ba ti yan aṣayan oju eefin ju. Nigbati iṣapeye ba ṣiṣẹ, o le pato awọn nọmba ibudo fun eyiti o fẹ mu ijabọ dara si. Ijabọ fun awọn ebute oko oju omi to ku lori nẹtiwọọki kan pato kii yoo ni iṣapeye. Ti awọn nọmba ibudo ko ba pato, ijabọ fun gbogbo awọn ebute oko oju omi ti wa ni iṣapeye. Ka diẹ sii nipa ẹya ara ẹrọ yii .
- Nigbamii, lọ si taabu Ijeri ki o tẹ +. Fun ìfàṣẹsí a yoo lo olupin agbegbe kan lori NSX Edge funrararẹ.
- Nibi a le yan awọn eto imulo fun ṣiṣẹda awọn ọrọ igbaniwọle tuntun ati tunto awọn aṣayan fun didi awọn akọọlẹ olumulo (fun apẹẹrẹ, nọmba awọn atunwo ti ọrọ igbaniwọle ba ti tẹ lọna ti ko tọ).
- Niwọn bi a ti nlo ijẹrisi agbegbe, a nilo lati ṣẹda awọn olumulo.
- Ni afikun si awọn nkan ipilẹ bi orukọ ati ọrọ igbaniwọle, nibi o le, fun apẹẹrẹ, ṣe idiwọ olumulo lati yi ọrọ igbaniwọle pada tabi, ni idakeji, fi ipa mu u lati yi ọrọ igbaniwọle pada nigbamii ti o wọle.
- Lẹhin gbogbo awọn olumulo pataki ti ṣafikun, lọ si taabu Awọn idii fifi sori ẹrọ, tẹ + ki o ṣẹda insitola funrararẹ, eyiti oṣiṣẹ latọna jijin yoo ṣe igbasilẹ fun fifi sori ẹrọ.
- Tẹ +. A yan adirẹsi ati ibudo olupin si eyiti alabara yoo sopọ, ati awọn iru ẹrọ fun eyiti a nilo lati ṣe agbekalẹ package fifi sori ẹrọ.
Ni isalẹ ni window yii o le pato awọn eto alabara fun Windows. Yan:- bẹrẹ alabara lori logon - alabara VPN yoo ṣafikun si ibẹrẹ lori ẹrọ latọna jijin;
- ṣẹda aami tabili - yoo ṣẹda aami alabara VPN lori deskitọpu;
- Ijẹrisi ijẹrisi aabo olupin – yoo fọwọsi ijẹrisi olupin lori asopọ.
Eto olupin ti pari.
- Bayi jẹ ki a ṣe igbasilẹ package fifi sori ẹrọ ti a ṣẹda ni igbesẹ ti o kẹhin si PC latọna jijin. Nigbati o ba ṣeto olupin naa, a pato adirẹsi ita rẹ (185.148.83.16) ati ibudo (445). O jẹ si adirẹsi yii ti a nilo lati lọ si ẹrọ aṣawakiri wẹẹbu. Ninu ọran mi o jẹ : 445.
Ninu ferese aṣẹ, o gbọdọ tẹ awọn iwe-ẹri olumulo ti a ṣẹda tẹlẹ.
- Lẹhin aṣẹ, a rii atokọ ti awọn idii fifi sori ẹrọ ti o ṣẹda ti o wa fun igbasilẹ. A ti ṣẹda ọkan nikan - a yoo ṣe igbasilẹ rẹ.
- Tẹ ọna asopọ naa ati igbasilẹ alabara bẹrẹ.
- Ṣii iwe ipamọ ti a gbasile ati ṣiṣe insitola naa.
- Lẹhin fifi sori ẹrọ, ṣe ifilọlẹ alabara ki o tẹ Wọle ni window aṣẹ.
- Ninu ferese ijẹrisi ijẹrisi, yan Bẹẹni.
- A tẹ awọn iwe-ẹri fun olumulo ti o ṣẹda tẹlẹ ati rii pe asopọ ti pari ni aṣeyọri.
- Ṣiṣayẹwo awọn iṣiro alabara VPN lori kọnputa agbegbe.
- Ninu laini aṣẹ Windows (ipconfig / gbogbo) a rii pe afikun ohun ti nmu badọgba foju ti han ati pe Asopọmọra wa pẹlu nẹtiwọọki latọna jijin, ohun gbogbo ṣiṣẹ:
- Ati nikẹhin, ṣayẹwo lati Edge Gateway console.
L2 VPN
L2VPN yoo nilo nigbati o nilo lati darapọ ọpọlọpọ ni agbegbe
awọn nẹtiwọọki ti a pin si agbegbe igbohunsafefe kan.
Eyi le wulo, fun apẹẹrẹ, nigbati o ba nṣipo ẹrọ foju kan: nigbati VM ba gbe si ipo agbegbe miiran, ẹrọ naa yoo da awọn eto adirẹsi IP rẹ duro ati pe kii yoo padanu Asopọmọra pẹlu awọn ẹrọ miiran ti o wa ni agbegbe L2 kanna pẹlu rẹ.
Ni agbegbe idanwo wa, a yoo so awọn aaye meji pọ si ara wọn, jẹ ki a pe wọn A ati B, lẹsẹsẹ. Ẹrọ A ni adirẹsi 10.10.10.250/24, ẹrọ B ni adirẹsi 10.10.10.2/24.
- Ninu Oludari vCloud, lọ si taabu Isakoso, lọ si VDC ti a nilo, lọ si Org VDC Networks taabu ki o ṣafikun awọn nẹtiwọọki tuntun meji.
- A yan iru nẹtiwọọki ti a ti mu ki o so nẹtiwọọki yii pọ mọ NSX wa. Ṣayẹwo awọn Ṣẹda bi subinterface apoti ayẹwo.
- Bi abajade, o yẹ ki a ni awọn nẹtiwọọki meji. Ninu apẹẹrẹ wa, wọn pe ni nẹtiwọki-a ati nẹtiwọki-b pẹlu awọn eto ẹnu-ọna kanna ati iboju-boju kanna.
- Bayi jẹ ki a lọ si awọn eto ti NSX akọkọ. Eyi yoo jẹ NSX ti Nẹtiwọọki A ti sopọ si. Yoo ṣiṣẹ bi olupin naa.
Pada si wiwo NSx Edge / Lọ si taabu VPN -> L2VPN. A mu L2VPN ṣiṣẹ, yan ipo iṣẹ olupin, ati ninu awọn eto Agbaye Server pato adiresi IP ita ti NSX lori eyiti ibudo fun eefin yoo gbọ. Nipa aiyipada, iho yoo ṣii lori ibudo 443, ṣugbọn eyi le yipada. Maṣe gbagbe lati yan awọn eto fifi ẹnọ kọ nkan fun oju eefin iwaju.
- Lọ si taabu Awọn aaye olupin ki o ṣafikun ẹlẹgbẹ kan.
- A tan-an ẹlẹgbẹ, ṣeto orukọ kan, apejuwe, ti o ba jẹ dandan, ṣeto orukọ olumulo ati ọrọ igbaniwọle. A yoo nilo data yii nigbamii nigbati o ba ṣeto aaye alabara.
Ni Adirẹsi ẹnu-ọna Imudara Egress a ṣeto adirẹsi ẹnu-ọna. Eyi jẹ pataki lati yago fun rogbodiyan ti awọn adirẹsi IP, nitori ẹnu-ọna lori awọn nẹtiwọọki wa ni adirẹsi kanna. Lẹhinna tẹ bọtini YAN SUB-INTERFACES.
- Nibi ti a yan awọn subinterface ti o fẹ. Fi awọn eto pamọ.
- A rii pe aaye alabara tuntun ti o ṣẹda ti han ninu awọn eto.
- Bayi jẹ ki a tẹsiwaju si atunto NSX lati ẹgbẹ alabara.
A lọ si ẹgbẹ NSX B, lọ si VPN -> L2VPN, mu L2VPN ṣiṣẹ, ṣeto ipo L2VPN si ipo iṣẹ alabara. Lori taabu Global Client, ṣeto adirẹsi ati ibudo NSX A, eyiti a ti sọ tẹlẹ bi IP gbigbọran ati Port ni ẹgbẹ olupin. O tun jẹ dandan lati ṣeto awọn eto fifi ẹnọ kọ nkan kanna ki wọn wa ni ibamu nigbati oju eefin ba dide.
Yi lọ si isalẹ ki o yan oju-ọna abẹlẹ nipasẹ eyiti oju eefin fun L2VPN yoo kọ.
Ni Adirẹsi ẹnu-ọna Imudara Egress a ṣeto adirẹsi ẹnu-ọna. Ṣeto olumulo-id ati ọrọ igbaniwọle. Yan oju-ọna iha ati maṣe gbagbe lati fi awọn eto pamọ. - Lootọ, iyẹn ni gbogbo rẹ. Onibara ati awọn eto ẹgbẹ olupin fẹrẹ jẹ aami kanna, ayafi ti awọn nuances diẹ.
- Bayi a le rii pe oju eefin wa n ṣiṣẹ nipa lilọ si Awọn iṣiro -> L2VPN lori eyikeyi NSX.
- Ti a ba lọ si console ti ẹnu-ọna Edge eyikeyi, a yoo rii awọn adirẹsi ti awọn VM mejeeji ni tabili arp fun ọkọọkan wọn.
Iyẹn ni gbogbo fun mi nipa VPN lori NSX Edge. Beere boya ohunkohun ko mọ. Eyi tun jẹ apakan ti o kẹhin ninu lẹsẹsẹ awọn nkan lori ṣiṣẹ pẹlu NSX Edge. A nireti pe wọn wulo :)
orisun: www.habr.com