- Ukusetshenziswa kwemigudu ebethelwe ukuxhuma amanethiwekhi endawo efwini le-Microsoft.
- Izakhiwo ezahlukene zokuxhumeka kuye ngokuthi ngabe kungokwabasebenzisi ngabanye noma indlunkulu yenkampani.
- Ukusetshenziswa kwamathuluzi omthombo ovulekile kanye nezinsizakalo eziphethwe ukuze kuthuthukiswe ukuphepha nokulawula.
- Ukuhlanganiswa kokuqinisekiswa okuthuthukisiwe kusetshenziswa i-Active Directory kanye nezitifiketi zedijithali.
Uma uke wazizwa udaluliwe kancane ngenkathi uphequlula iwebhu noma udinga ithimba lakho ukuthi lifinyelele amafayela ehhovisi ngaphandle kokuthi othile akulalele, ukusetha i-VPN yisisombululo esiphezulu. Ngokuyisisekelo, sikhuluma ngokudala i- Umhubhe obethelwe evikela idatha yakho, ekuvumela ukuthi ungene kunethiwekhi yangasese njengokungathi uxhunywe ngokomzimba ku-router yesayithi, noma ngabe ukude ngamakhilomitha ayizinkulungwane.
Kuhlelo lwe-Microsoft Azure, sinenhlanhla yokuba nezindlela eziningana zokufeza lokhu. Kusukela kunketho elula, ephethwe, ekusindisa amakhanda, kuya kokuningi okulungiselelwe ngezandla kusetshenziswa i-Linux nesofthiwe yomthombo ovulekile kulabo abafuna ukulawula okugcwele amaphakheji akhoKungakhathaliseki ukuthi ufuna ukusebenza ukude ngokuphephile noma ukuvikela nje ubuwena bakho bedijithali, nansi yonke ukwesekwa kobuchwepheshe okudingayo ukuze ukufeze lokho.
Izinketho eziphethwe: I-Azure VPN Gateway
Kulabo abangafuni ukuxinwa kakhulu yi-command console, i-Azure inikeza Isango le-VPNLeli thuluzi likuvumela ukuthi usungule izinhlobo ezimbili zokuxhumeka: I-Site-to-Site (S2S), exhumanisa amanethiwekhi amabili aphelele, kanye ne-Point-to-Site (P2S), exhumanisa ikhompyutha ngayinye efwini. Ukuze simise uxhumano lwe-S2S, sidinga kuqala ukudala Inethiwekhi Ebonakalayo (i-VNet) enesikhala sekheli le-IPv4 esiqhubekayo, okuqinisekisa ukuthi akukho ukugqagqana nenethiwekhi yendawo.
Iphuzu elibalulekile ukudalwa kwe I-GatewaySubnetLokhu akuyona nje noma iyiphi i-subnet; yindawo lapho isango lizohlala khona futhi kumele libizwe kanjalo. Usayizi we /27 noma ngaphezulu ukuqinisekisa ukuthi kukhona ama-IP anele atholakalayo ezimweni zesango, ikakhulukazi uma sivumela imodi esebenzayo ukuze kube nokutholakala okuphezulu.
Uma isango selivuliwe, okungathatha cishe imizuzu engama-45 ukuthi lisebenze, sidinga ukumisa Isango Lenethiwekhi YendawoLe nto iwukumelwa kwesayithi lethu elingokoqobo e-Azure; lapha sichaza ikheli le-IP lomphakathi le-router yethu yendawo kanye neziqalo zenethiwekhi esifuna ukuziqondisa. Ukuze siqedele inqubo, sakha Ukuxhumeka kwe-VPN ukuchaza ukhiye owabiwe (i-PSK) okumele ufane kuzo zombili izinhlangothi ukuze ukuxhawulana kuphumelele.
I-WAN ebonakalayo: Inethiwekhi yomhlaba wonke ye-Microsoft
Njengoba ingqalasizinda ikhula, indlela evamile yokungena ingahluleka, futhi yilapho lokhu kungena khona. I-WAN ebonakalayoLe nsizakalo yenza kube lula ukuxhumana okukhulu ngokudala "isikhungo" noma isikhungo sokuxhumana. Esikhundleni sokuphatha umhubhe ngamunye ngokwehlukana, i-Virtual WAN ivumela ukuphathwa okuphakathi kokuxhumana kwe-VPN yomsebenzisi, okwenza kube lula ngamakhasimende ukuxhuma. I-OpenVPN noma i-IKEv2.
Ukucushwa komsebenzisi ku-Virtual WAN kuyaguquguquka kakhulu. Singakhetha phakathi ukuqinisekiswa kusetshenziswa izitifiketi kusuka ku-Azure, Radius, noma ngisho nokuhlanganiswa ne-Microsoft Entra ID. Into elula kakhulu ukuthi uhlelo lukhiqiza i- ifayela le-ZIP lokucushwa umsebenzisi umane azilande futhi azifake kukhompyutha yakhe, okususa isidingo sokuthi Lungiselela futhi usethe i-VPN ku-Windows 11 ngesandla kupharamitha ngayinye yenethiwekhi kuklayenti.
Ukuze ithrafikhi igeleze, sidinga ukuxhumanisa amanethiwekhi ethu abonakalayo ne-Virtual WAN Hub. Lapha singazama nge- amathebula okuqondisa futhi sinqume ukuthi ithrafikhi isakazwa ngokuzenzakalelayo noma uma sikhetha ukuchaza imizila engaguquki. Kuyisisombululo esifanele ezinkampanini ezidinga inethiwekhi yomhlaba wonke eqinile ene- ukusebenza okulungiselelwe.
Ukuqaliswa ngokwezifiso nge-Linux ne-StrongSwan
Uma ukhetha ukungathembeli ngokuphelele kumasevisi aphethwe, ungasetha iseva yakho ye-VPN usebenzisa umshini we-Linux obonakalayo one i-Swan enamandlaLe ndlela iwusizo kakhulu uma ufuna ukugwema izindleko ze-Virtual Gateway noma uma udinga ukulawula okunembile kokubethela. Imfihlo lapha itholakala ekulungiseleleni iseva njenge- i-router yangaphakathi Ngokusebenzisa i- iptables.
Ukuze lokhu kusebenze, kubalulekile ukusebenzisa Ukudlulisela i-IP ku-kernel ye-Linux. Ekucushweni kwe-strongSwan, sichaza amapharamitha e- ikev2 kanye nama-algorithms okubethela (njenge-AES256). Imininingwane ebalulekile yobuchwepheshe ukusetshenziswa Amathebula e-UDR (Imizila Echazwe Umsebenzisi) ku-Azure; ngaphandle kwabo, imishini ebonakalayo kunethiwekhi ibingeke yazi ukuthi ingasabela kanjani kuthrafikhi evela ku-VPN, njengoba ithrafikhi ibizobhajwa kuseva ye-VPN.
Kubasebenzisi ngabanye, i-strongSwan ikuvumela ukuthi udale ukuxhumana Ukusingatha kusayithi ngokukhiqiza i-PKI yethu. Sakha i-Certificate Authority (CA), sasayina isitifiketi seseva kanye nesinye seklayenti. Lapho isitifiketi sesingenisiwe esitolo sesitifiketi Izinhlangano zesitifiketi ezithembekile Ku-Windows, uxhumano luqiniswa ngokusobala nangokuphephile kakhulu.
Ukuqhubekela phambili ngeSoftEther VPN kanye ne-Active Directory
Elinye igugu lomthombo ovulekile yileli I-SoftEther VPNLe software isebenziseka ngezindlela eziningi kakhulu, isekela amaphrothokholi afana ne-SSTP, i-L2TP/IPsec, kanye ne-OpenVPN konke ngesikhathi esisodwa. Enye yezinzuzo zayo ezinkulu ikhono layo lokuhlanganisa neseva. I-RADIUS ixhunywe ku-Active Directoryokuvumela abasebenzi ukuthi basebenzise iziqinisekiso zabo zebhizinisi ezivamile ukuze bangene ngemvume ku-VPN.
Ukuze kusetshenziswe lokhu, i-SoftEther VM ifakwa ku-subnet ye-DMZ futhi ilungiselelwe I-SecureNATI-SecureNAT empeleni iyinhlanganisela ye-DHCP, i-DNS, kanye ne-NAT ebonakalayo enikeza ama-IP kumakhasimende ngaphandle kokudinga ukudalwa kwama-subnet engeziwe ku-Azure. Ukuze kuqinisekiswe, indima iyafakwa. Iseva Yenqubomgomo Yenethiwekhi (i-NPS) kusilawuli sesizinda se-Windows Server, silungiselela iseva ye-SoftEther njengeklayenti le-RADIUS eligunyaziwe.
Ngokuphathelene nokuphepha, asikwazi ukushiya umshini uvikelekile ezintweni zezulu. Kubalulekile ukufaka Ukuphatha: shintsha imbobo ye-SSH, faka fail2ban ukuvimba ukuhlaselwa ngamandla amakhulu nokuphoqelela ukusetshenziswa I-TLS 1.2 Ngokukhubaza izinguqulo ezindala njenge-SSL 3.0, sinesango lobuchwepheshe elimelana nokuhlaselwa kwangaphandle.
Ukuxhumana okukhethekile: Amafayela e-Azure kanye nesitoreji
Ngezinye izikhathi asidingi ukuthi inethiwekhi yonke ixhunywe, kodwa sidinga nje ukufinyelela amafolda abiwe. Amafayela e-Azure ngaphandle kwedatha ehamba nge-inthanethi yomphakathi. Icebo lalokhu ukudala I-Endpoint Eyimfihlo (i-endpoint yangasese). Lokhu kunikeza ikheli le-IP eliyimfihlo kusuka ku-VNet kuya ku-akhawunti yokugcina, okubangela ukuthi ithrafikhi idluliselwe ngokuzenzakalelayo emhubheni we-VPN.
Inselele lapha ukulungiswa kwamagama. Uma iklayenti lizama ukuxhumana ne- storageaccount.file.core.windows.netI-DNS yomphakathi izokunikeza ikheli le-IP lomphakathi futhi idlule i-VPN. Isixazululo ukusebenzisa i- Isixazululi Esiyimfihlo se-Azure DNS noma i-VM esebenza njenge-DNS forwarder. Ngale ndlela, igama lizovela ku- Ikheli le-IP eliyimfihlo le-endpoint futhi iyunithi yenethiwekhi ifakwe ngokungabonakali nangokuphephile.
Umbhali oshisekayo ngomhlaba wamabhayithi nobuchwepheshe ngokujwayelekile. Ngiyathanda ukwabelana ngolwazi lwami ngokubhala, futhi yilokho engizokwenza kule bhulogi, ngikubonise zonke izinto ezithakazelisayo kakhulu ngamagajethi, isofthiwe, ihadiwe, izitayela zobuchwepheshe, nokuningi. Inhloso yami ukukusiza ukuthi uzulazule emhlabeni wedijithali ngendlela elula nejabulisayo.