{"id":31058,"date":"2019-10-31T21:39:12","date_gmt":"2019-10-31T18:39:12","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya\/"},"modified":"2019-10-31T21:39:12","modified_gmt":"2019-10-31T18:39:12","slug":"kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya","title":{"rendered":"Jak p\u0159evz\u00edt kontrolu nad s\u00ed\u0165ovou infrastrukturou. Hlava t\u0159et\u00ed. S\u00ed\u0165ov\u00e1 bezpe\u010dnost. \u010c\u00e1st prvn\u00ed","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><i>Tento \u010dl\u00e1nek je t\u0159et\u00ed v s\u00e9rii \u010dl\u00e1nk\u016f \u201eJak vz\u00edt s\u00ed\u0165ovou infrastrukturu pod kontrolu\u201c. Obsah v\u0161ech \u010dl\u00e1nk\u016f s\u00e9rie a odkazy najdete <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/447008\/\">zde<\/a><\/noindex><\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"Jak p\u0159evz\u00edt kontrolu nad s\u00ed\u0165ovou infrastrukturou. Hlava t\u0159et\u00ed. S\u00ed\u0165ov\u00e1 bezpe\u010dnost. \u010c\u00e1st prvn\u00ed\" src=\"\/wp-content\/uploads\/2019\/04\/cdf33cc6797d26df8fef5533f2570c47.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNen\u00ed smyslupln\u00e9 hovo\u0159it o \u00fapln\u00e9m odstran\u011bn\u00ed bezpe\u010dnostn\u00edch rizik. V z\u00e1sad\u011b je nem\u016f\u017eeme sn\u00ed\u017eit na nulu. Je tak\u00e9 t\u0159eba ch\u00e1pat, \u017ee s t\u00edm, jak se sna\u017e\u00edme u\u010dinit s\u00ed\u0165 st\u00e1le bezpe\u010dn\u011bj\u0161\u00ed, na\u0161e \u0159e\u0161en\u00ed se st\u00e1vaj\u00ed st\u00e1le dra\u017e\u0161\u00edmi. Je nutn\u00e9 naj\u00edt rozumn\u00fd kompromis mezi cenou, slo\u017eitost\u00ed a bezpe\u010dnost\u00ed pro va\u0161i s\u00ed\u0165. <\/p>\n<p>Samoz\u0159ejm\u011b, n\u00e1vrh zabezpe\u010den\u00ed je organicky za\u010dlen\u011bn do celkov\u00e9 architektury a pou\u017e\u00edvan\u00e1 bezpe\u010dnostn\u00ed \u0159e\u0161en\u00ed ovliv\u0148uj\u00ed \u0161k\u00e1lovatelnost, spolehlivost, spravovatelnost,\u2026 s\u00ed\u0165ov\u00e9 infrastruktury, co\u017e tak\u00e9 mus\u00ed b\u00fdt zohledn\u011bno.<\/p>\n<p>Ale, p\u0159ipom\u00edn\u00e1m, \u017ee nyn\u00ed nemluv\u00edme o vytv\u00e1\u0159en\u00ed s\u00edt\u011b. V souladu s na\u0161imi <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/433614\/\">po\u010d\u00e1te\u010dn\u00edmi podm\u00ednkami<\/a><\/noindex> u\u017e m\u00e1me vybran\u00fd n\u00e1vrh, zvolen\u00e9 za\u0159\u00edzen\u00ed a vytvo\u0159enou infrastrukturu, a v t\u00e9to f\u00e1zi bychom m\u011bli, pokud mo\u017eno, \u201e\u017e\u00edt\u201c a hledat \u0159e\u0161en\u00ed v kontextu d\u0159\u00edve zvolen\u00e9ho p\u0159\u00edstupu.<\/p>\n<p>Na\u0161\u00edm \u00fakolem nyn\u00ed je identifikovat rizika spojen\u00e1 s bezpe\u010dnost\u00ed na \u00farovni s\u00edt\u011b a sn\u00ed\u017eit je na rozumnou \u00farove\u0148. <noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h1>Audity s\u00ed\u0165ov\u00e9 bezpe\u010dnosti<\/h1>\n<p>\nPokud ve va\u0161\u00ed organizaci byly implementov\u00e1ny procesy ISO 27k, m\u011bla by b\u00fdt auditov\u00e1n\u00ed bezpe\u010dnosti a zm\u011bny v s\u00edti organicky zahrnuty do celkov\u00fdch proces\u016f v r\u00e1mci tohoto p\u0159\u00edstupu. Tyto standardy v\u0161ak st\u00e1le nejsou o konkr\u00e9tn\u00edch \u0159e\u0161en\u00edch, nejsou o konfiguraci, nejsou o n\u00e1vrhu\u2026 Neexistuj\u00ed jednozna\u010dn\u00e9 rady, neexistuj\u00ed standardy, kter\u00e9 detailn\u011b diktuj\u00ed, jak by m\u011bla va\u0161e s\u00ed\u0165 vypadat, to je komplikovanost a kr\u00e1sa t\u00e9to \u00falohy.<\/p>\n<p>Vyzvedl bych n\u011bkolik mo\u017en\u00fdch audit\u016f bezpe\u010dnosti s\u00edt\u011b:<\/p>\n<ul>\n<li>audit konfigurace za\u0159\u00edzen\u00ed (hardening)<\/li>\n<li>audit bezpe\u010dnostn\u00edho n\u00e1vrhu<\/li>\n<li>audit p\u0159\u00edstup\u016f<\/li>\n<li>audit proces\u016f<\/li>\n<\/ul>\n<p><\/p>\n<h1>Audit konfigurace za\u0159\u00edzen\u00ed (hardening)<\/h1>\n<p>\nZd\u00e1 se, \u017ee v mnoha p\u0159\u00edpadech je to nejlep\u0161\u00ed v\u00fdchoz\u00ed bod pro audit a zlep\u0161en\u00ed bezpe\u010dnosti va\u0161\u00ed s\u00edt\u011b. IMHO je to dobr\u00e1 uk\u00e1zka Pareto z\u00e1kona (20 % \u00fasil\u00ed p\u0159in\u00e1\u0161\u00ed 80 % v\u00fdsledku, a zb\u00fdvaj\u00edc\u00edch 80 % \u00fasil\u00ed p\u0159in\u00e1\u0161\u00ed pouze 20 % v\u00fdsledku). <\/p>\n<p>Podstatou je, \u017ee obvykle m\u00e1me doporu\u010den\u00ed od dodavatel\u016f ohledn\u011b \u201enejlep\u0161\u00edch praktik\u201c pro bezpe\u010dnost p\u0159i konfiguraci za\u0159\u00edzen\u00ed. To se naz\u00fdv\u00e1 \u201ehardening\u201c.<\/p>\n<p>\u010casto lze tak\u00e9 nal\u00e9zt dotazn\u00edk (nebo si ho vytvo\u0159it sami) na z\u00e1klad\u011b t\u011bchto doporu\u010den\u00ed, kter\u00fd v\u00e1m pom\u016f\u017ee ur\u010dit, jak konfigurace va\u0161eho za\u0159\u00edzen\u00ed odpov\u00edd\u00e1 t\u011bmto \u201ebest practices\u201c, a v z\u00e1vislosti na v\u00fdsledku prov\u00e9st zm\u011bny ve va\u0161\u00ed s\u00edti. D\u00edky tomu budete moci snadno, v podstat\u011b bez n\u00e1klad\u016f, v\u00fdrazn\u011b sn\u00ed\u017eit bezpe\u010dnostn\u00ed rizika.<\/p>\n<blockquote><p>N\u011bkolik p\u0159\u00edklad\u016f pro n\u011bkter\u00e9 opera\u010dn\u00ed syst\u00e9my Cisco.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/support\/docs\/ip\/access-lists\/13608-21.html\">Zpevn\u011bn\u00ed konfigurace Cisco IOS<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/tools.cisco.com\/security\/center\/resources\/increase_security_ios_xr_devices.html\">Zpevn\u011bn\u00ed konfigurace Cisco IOS-XR<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/tools.cisco.com\/security\/center\/resources\/securing_nx_os.html\">Zpevn\u011bn\u00ed konfigurace Cisco NX-OS<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/solutions\/Enterprise\/Security\/Baseline_Security\/securebasebook\/appendxD.html\">Kontroln\u00ed seznam z\u00e1kladn\u00ed bezpe\u010dnosti Cisco<\/a><\/noindex><\/p>\n<p>Na z\u00e1klad\u011b t\u011bchto dokument\u016f m\u016f\u017ee b\u00fdt vytvo\u0159en seznam po\u017eadavk\u016f na konfiguraci pro ka\u017ed\u00fd typ za\u0159\u00edzen\u00ed. Nap\u0159\u00edklad pro Cisco N7K VDC mohou tyto po\u017eadavky vypadat <noindex><a rel=\"nofollow\" href=\"https:\/\/www.dropbox.com\/s\/hnat6yriyptigzb\/7k_hard.xlsx?dl=0\">takto<\/a><\/noindex>.<\/p><\/blockquote>\n<p>\nTakto mohou b\u00fdt vytvo\u0159eny konfigura\u010dn\u00ed soubory pro r\u016fzn\u00e9 typy aktivn\u00edho za\u0159\u00edzen\u00ed va\u0161\u00ed s\u00ed\u0165ov\u00e9 infrastruktury. Pot\u00e9, ru\u010dn\u011b nebo s pou\u017eit\u00edm automatizace, m\u016f\u017eete tyto konfigura\u010dn\u00ed soubory \u201enahr\u00e1t\u201c. Jak automatizovat tento proces bude podrobn\u011b rozebr\u00e1no v dal\u0161\u00ed s\u00e9rii \u010dl\u00e1nk\u016f zam\u011b\u0159en\u00fdch na orchestrace a automatizaci.<\/p>\n<h1>Audit n\u00e1vrhu bezpe\u010dnosti<\/h1>\n<p>\nObvykle v podnikov\u00e9 s\u00edti (enterprise network) existuj\u00ed v r\u016fzn\u00fdch form\u00e1ch n\u00e1sleduj\u00edc\u00ed segmenty: <\/p>\n<ul>\n<li>DC (DMZ ve\u0159ejn\u00fdch slu\u017eeb a intranetov\u00e9 datov\u00e9 centrum)<\/li>\n<li>p\u0159\u00edstup k internetu<\/li>\n<li>VPN pro vzd\u00e1len\u00fd p\u0159\u00edstup<\/li>\n<li>WAN okraj<\/li>\n<li>Pobo\u010dka<\/li>\n<li>Kampus (kancel\u00e1\u0159)<\/li>\n<li>Core<\/li>\n<\/ul>\n<p>\nN\u00e1zvy jsou p\u0159evzaty z <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/solutions\/Enterprise\/Security\/SAFE_RG\/SAFE_rg\/chap1.html\">Cisco SAFE<\/a><\/noindex> modelu, ale nen\u00ed nutn\u00e9 se samoz\u0159ejm\u011b v\u00e1zat pouze na t\u011bchto n\u00e1zv\u016f a tento model. Hlavn\u011b se chceme zam\u011b\u0159it na podstatu a nezapl\u00e9st se do form\u00e1lnost\u00ed.<\/p>\n<p>Pro ka\u017ed\u00fd z t\u011bchto segment\u016f budou po\u017eadavky na \u00farove\u0148 bezpe\u010dnosti, rizika a t\u00edm p\u00e1dem tak\u00e9 \u0159e\u0161en\u00ed odli\u0161n\u00e9.<\/p>\n<p>Pod\u00edvejme se na ka\u017ed\u00fd z nich jednotliv\u011b z hlediska probl\u00e9m\u016f, s nimi\u017e se m\u016f\u017eete setkat z pohledu n\u00e1vrhu bezpe\u010dnosti. Op\u011bt zd\u016fraz\u0148uji, \u017ee tento \u010dl\u00e1nek rozhodn\u011b nepretenduje na \u00faplnost, co\u017e je v t\u00e9to skute\u010dn\u011b hlubok\u00e9 a v\u00edcevrstv\u00e9 t\u00e9matice obt\u00ed\u017en\u00e9 (pokud v\u016fbec mo\u017en\u00e9), ale odr\u00e1\u017e\u00ed m\u00e9 osobn\u00ed zku\u0161enosti.<\/p>\n<p>Neexistuje ide\u00e1ln\u00ed \u0159e\u0161en\u00ed (alespo\u0148 ne nyn\u00ed). V\u017edy je to kompromis. D\u016fle\u017eit\u00e9 je, aby rozhodnut\u00ed o pou\u017eit\u00ed ur\u010dit\u00e9ho p\u0159\u00edstupu bylo u\u010din\u011bno v\u011bdom\u011b, s porozum\u011bn\u00edm jak jeho v\u00fdhod, tak nev\u00fdhod.<\/p>\n<h2>Datov\u00e9 centrum<\/h2>\n<p>\nNejkriti\u010dt\u011bj\u0161\u00ed z pohledu bezpe\u010dnosti segment.<br \/>\nA jako obvykle, zde tak\u00e9 neexistuje univerz\u00e1ln\u00ed \u0159e\u0161en\u00ed. V\u0161e z\u00e1vis\u00ed na po\u017eadavc\u00edch na s\u00ed\u0165. <\/p>\n<h3>Je pot\u0159eba firewall?<\/h3>\n<p>\nNa prvn\u00ed pohled se odpov\u011b\u010f zd\u00e1 z\u0159ejm\u00e1, ale situace nen\u00ed tak jednozna\u010dn\u00e1, jak by se mohlo zd\u00e1t. A na v\u00e1\u0161 v\u00fdb\u011br m\u016f\u017ee m\u00edt vliv nejen<b> cena<\/b>. <\/p>\n<blockquote><p>P\u0159\u00edklad 1. <b>Zpo\u017ed\u011bn\u00ed.<\/b><\/p>\n<p>Pokud je n\u00edzk\u00e9 zpo\u017ed\u011bn\u00ed mezi n\u011bkter\u00fdmi segmenty s\u00edt\u011b kl\u00ed\u010dov\u00fdm po\u017eadavkem, co\u017e plat\u00ed nap\u0159\u00edklad v p\u0159\u00edpad\u011b burzy, pak mezi t\u011bmito segmenty nebudeme moci pou\u017e\u00edvat firewally. Je obt\u00ed\u017en\u00e9 naj\u00edt studie o zpo\u017ed\u011bn\u00ed ve firewallech, ale jen n\u011bkolik model\u016f p\u0159ep\u00edna\u010d\u016f dok\u00e1\u017ee poskytnout zpo\u017ed\u011bn\u00ed men\u0161\u00ed nebo kolem 1 mksec, proto si mysl\u00edm, \u017ee pokud jsou pro v\u00e1s mikrosekundy d\u016fle\u017eit\u00e9, firewally nejsou pro v\u00e1s.<\/p><\/blockquote>\n<blockquote><p>P\u0159\u00edklad 2. <b>V\u00fdkon.<\/b><\/p>\n<p>Propustnost \u0161pi\u010dkov\u00fdch L3 p\u0159ep\u00edna\u010d\u016f je obvykle o \u0159\u00e1d vy\u0161\u0161\u00ed ne\u017e propustnost nejv\u00fdkonn\u011bj\u0161\u00edch firewall\u016f. Proto v p\u0159\u00edpad\u011b intenzivn\u00edho provozu pravd\u011bpodobn\u011b budete muset tento provoz nasm\u011brovat mimo firewally.<\/p><\/blockquote>\n<p><\/p>\n<blockquote><p>P\u0159\u00edklad 3. <b>Spolehlivost.<\/b><\/p>\n<p>Firewally, zejm\u00e9na modern\u00ed NGFW (Next-Generation FW) \u2013 jsou slo\u017eit\u00e1 za\u0159\u00edzen\u00ed. Jsou v\u00fdrazn\u011b slo\u017eit\u011bj\u0161\u00ed ne\u017e L3\/L2 p\u0159ep\u00edna\u010de. Nab\u00edzej\u00ed \u0161irokou \u0161k\u00e1lu slu\u017eeb a mo\u017enost\u00ed konfigurace, a proto nen\u00ed p\u0159ekvapen\u00edm, \u017ee jejich spolehlivost je v\u00fdrazn\u011b ni\u017e\u0161\u00ed. Pokud je kontinuita slu\u017eby kritick\u00e1 pro s\u00ed\u0165, mo\u017en\u00e1 budete muset zvolit, co povede k lep\u0161\u00ed dostupnosti \u2014 ochranu pomoc\u00ed firewallu nebo jednoduchost s\u00edt\u011b zalo\u017een\u00e9 na p\u0159ep\u00edna\u010d\u00edch (nebo r\u016fzn\u00fdch typech fabric) s vyu\u017eit\u00edm standardn\u00edch ACL.<\/p><\/blockquote>\n<p> V p\u0159\u00edpad\u011b v\u00fd\u0161e uveden\u00fdch p\u0159\u00edklad\u016f pravd\u011bpodobn\u011b (jak u\u017e to b\u00fdv\u00e1) budete muset hledat kompromis. Pod\u00edvejte se na n\u00e1sleduj\u00edc\u00ed \u0159e\u0161en\u00ed: <\/p>\n<ul>\n<li>Pokud jste se rozhodli nepou\u017e\u00edvat firewally uvnit\u0159 datov\u00e9ho centra, m\u011bli byste promyslet, jak co nejv\u00edce omezit p\u0159\u00edstupy na perimetru. Nap\u0159\u00edklad m\u016f\u017eete otev\u0159\u00edt pouze nezbytn\u00e9 porty z Internetu (pro klientsk\u00fd provoz) a administrativn\u00ed p\u0159\u00edstupy do datov\u00e9ho centra pouze z jump host\u016f. Na jump hostech prov\u00e1d\u011bt ve\u0161kerou pot\u0159ebnou kontrolu (autentizaci\/ autorizaci, antiviry, logov\u00e1n\u00ed, \u2026)<\/li>\n<li>M\u016f\u017eete pou\u017e\u00edt logick\u00e9 rozd\u011blen\u00ed s\u00edt\u011b datov\u00e9ho centra na segmenty, podobn\u011b jako je pops\u00e1no ve sch\u00e9matu PSEFABRIC. <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/nihole\/PSEFABRIC\/wiki\/p002-design\">p\u0159\u00edklad p002<\/a><\/noindex>Routing must be configured in such a way that latency-sensitive or high-intensity traffic remains 'within' a segment (in the case of p002, the VRF) and does not pass through the firewall. Traffic between different segments, however, will still go through the firewall. Route leaking between VRFs can also be used to avoid redirecting traffic through the firewall.<\/li>\n<li>You can also use the firewall in transparent mode and only for those VLANs where these factors (latency\/performance) are not critical. However, it is important to carefully study the limitations associated with using this mode for each vendor.<\/li>\n<li>You might consider implementing a service chain architecture. This will allow you to route only the necessary traffic through the firewall. Theoretically, it looks nice, but I have never seen this solution in production. We tested service chains for Cisco ACI\/Juniper SRX\/F5 LTM about three years ago, but at that time, the solution seemed 'raw' to us.<\/li>\n<\/ul>\n<p><\/p>\n<h3>Level of Protection<\/h3>\n<p>\nNow you need to answer the question of what tools you want to use for traffic filtering. Here are some of the capabilities that are typically present in NGFW (for example, <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.paloaltonetworks.com\/pan-os\/8-0\/pan-os-admin\/policy\/security-profiles.html\">tady<\/a><\/noindex>):<\/p>\n<ul>\n<li>stateful firewalling (by default)<\/li>\n<li>aplika\u010dn\u00ed firewall<\/li>\n<li>prevence hrozeb (antivirus, antispyware a zranitelnost)<\/li>\n<li>filtrace URL<\/li>\n<li>filtrace dat (filtrace obsahu)<\/li>\n<li>blokov\u00e1n\u00ed soubor\u016f (blokov\u00e1n\u00ed typ\u016f soubor\u016f)<\/li>\n<li>dos protection<\/li>\n<\/ul>\n<p>\nAnd it's not all that straightforward either. One might think that the higher the level of protection, the better. But you also need to consider that<\/p>\n<ul>\n<li>the more features mentioned above you use in the firewall, the more expensive it will naturally be (licenses, additional modules).<\/li>\n<li>The use of certain algorithms can significantly reduce the firewall's throughput and increase latency, see for example <noindex><a rel=\"nofollow\" href=\"https:\/\/www.paloaltonetworks.com\/products\/secure-the-network\/next-generation-firewall\/pa-7000-series\">tady<\/a><\/noindex><\/li>\n<li>Like any complex solution, using sophisticated protection methods may lower the reliability of your solution. For instance, I have encountered application firewalling that blocked some standard applications (dns, smb).<\/li>\n<\/ul>\n<p>\nAs usual, you need to find a solution that is optimal for your network.<\/p>\n<p>Nen\u00ed mo\u017en\u00e9 jednozna\u010dn\u011b odpov\u011bd\u011bt na ot\u00e1zku, jak\u00e9 ochrann\u00e9 funkce mohou b\u00fdt pot\u0159eba. Za prv\u00e9, proto\u017ee to samoz\u0159ejm\u011b z\u00e1vis\u00ed na datech, kter\u00e1 p\u0159ed\u00e1v\u00e1te nebo ukl\u00e1d\u00e1te a sna\u017e\u00edte se chr\u00e1nit. Za druh\u00e9, ve skute\u010dnosti je v\u00fdb\u011br ochrann\u00fdch prost\u0159edk\u016f \u010dasto ot\u00e1zkou v\u00edry a d\u016fv\u011bry v\u016f\u010di dodavateli. Nezn\u00e1te algoritmy, nev\u00edte, jak efektivn\u00ed jsou, a nem\u016f\u017eete je pln\u011b otestovat. <\/p>\n<p>Proto v kritick\u00fdch segmentech m\u016f\u017ee b\u00fdt dobr\u00fdm \u0159e\u0161en\u00edm vyu\u017e\u00edt nab\u00eddky od r\u016fzn\u00fdch spole\u010dnost\u00ed. Nap\u0159\u00edklad m\u016f\u017eete zapnout antivir na firewallu, ale tak\u00e9 pou\u017e\u00edt antivirovou ochranu (jin\u00e9ho v\u00fdrobce) lok\u00e1ln\u011b na hostech.<\/p>\n<h3>Segmentace<\/h3>\n<p>\nMluv\u00edme o logick\u00e9 segmentaci s\u00edt\u011b datacentra. Nap\u0159\u00edklad rozd\u011blen\u00ed na VLANy a pods\u00edt\u011b - to je tak\u00e9 logick\u00e1 segmentace, ale nebudeme ji br\u00e1t v \u00favahu vzhledem k jej\u00ed samoz\u0159ejmosti. Zaj\u00edmav\u00e1 je segmentace se zohledn\u011bn\u00edm takov\u00fdch entit jako FW bezpe\u010dnostn\u00ed z\u00f3ny, VRF (a jejich ekvivalent\u016f u r\u016fzn\u00fdch dodavatel\u016f), logick\u00fdch za\u0159\u00edzen\u00ed (PA VSYS, Cisco N7K VDC, Cisco ACI Tenant, \u2026), \u2026<\/p>\n<blockquote><p>P\u0159\u00edklad takov\u00e9 logick\u00e9 segmentace a v sou\u010dasn\u00e9 dob\u011b \u017e\u00e1dan\u00e9ho designu datacentra je uveden v <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/nihole\/PSEFABRIC\/wiki\/p002-design\">p002 projektu PSEFABRIC<\/a><\/noindex>.<\/p><\/blockquote>\n<p> Po ur\u010den\u00ed logick\u00fdch \u010d\u00e1st\u00ed va\u0161\u00ed s\u00edt\u011b m\u016f\u017eete d\u00e1le popsat, jak se pohybuje provoz mezi r\u016fzn\u00fdmi segmenty, na jak\u00fdch za\u0159\u00edzen\u00edch se bude prov\u00e1d\u011bt filtrov\u00e1n\u00ed a jak\u00fdmi prost\u0159edky.<\/p>\n<p>Pokud ve va\u0161\u00ed s\u00edti chyb\u00ed jasn\u00e9 logick\u00e9 rozd\u011blen\u00ed a nejsou formalizov\u00e1na pravidla pro uplat\u0148ov\u00e1n\u00ed bezpe\u010dnostn\u00edch politik pro r\u016fzn\u00e9 datov\u00e9 toky (flow), znamen\u00e1 to, \u017ee p\u0159i otev\u00edr\u00e1n\u00ed p\u0159\u00edstupu mus\u00edte tuto ot\u00e1zku \u0159e\u0161it, a s velkou pravd\u011bpodobnost\u00ed ji poka\u017ed\u00e9 vy\u0159e\u0161\u00edte r\u016fzn\u011b. <\/p>\n<p>\u010casto je segmentace zalo\u017eena pouze na FW bezpe\u010dnostn\u00edch z\u00f3n\u00e1ch. Pot\u00e9 se mus\u00edte odpov\u011bd\u011bt na n\u00e1sleduj\u00edc\u00ed ot\u00e1zky:<\/p>\n<ul>\n<li>jak\u00e9 bezpe\u010dnostn\u00ed z\u00f3ny pot\u0159ebujete<\/li>\n<li>jakou \u00farove\u0148 ochrany chcete uplatnit na ka\u017edou z t\u011bchto z\u00f3n <\/li>\n<li>bude povolen intra-z\u00f3nov\u00fd provoz jako v\u00fdchoz\u00ed <\/li>\n<li>pokud ne, jak\u00e9 politiky filtrov\u00e1n\u00ed provozu budou uplat\u0148ov\u00e1ny uvnit\u0159 jednotliv\u00fdch z\u00f3n<\/li>\n<li>jak\u00e9 politiky filtrov\u00e1n\u00ed provozu budou uplat\u0148ov\u00e1ny pro ka\u017edou dvojici z\u00f3n (source\/destination)<\/li>\n<\/ul>\n<p><\/p>\n<h3>TCAM<\/h3>\n<p>\n\u010casto se setk\u00e1v\u00e1me s probl\u00e9mem nedostate\u010dn\u00e9 TCAM (Tern\u00e1rn\u00ed obsahov\u011b adresovateln\u00e9 pam\u011bti), jak pro sm\u011brov\u00e1n\u00ed, tak pro p\u0159\u00edstupy. IMHO, je to jedna z nejd\u016fle\u017eit\u011bj\u0161\u00edch ot\u00e1zek p\u0159i v\u00fdb\u011bru za\u0159\u00edzen\u00ed, proto je t\u0159eba k tomu p\u0159istupovat s pat\u0159i\u010dnou opatrnost\u00ed.<\/p>\n<blockquote><p>P\u0159\u00edklad 1. Sm\u011brovac\u00ed tabulka TCAM.<\/p>\n<p>Poj\u010fme se pod\u00edvat na <noindex>Palo Alto 7k<\/noindex> firewall.<br \/>\nVid\u00edme, \u017ee velikost IPv4 sm\u011brovac\u00ed tabulky* = 32K<br \/>\nP\u0159itom je toto mno\u017estv\u00ed rout\u016f celkov\u00e9 pro v\u0161echny VSYS.<\/p>\n<p>P\u0159edpokl\u00e1d\u00e1me, \u017ee podle va\u0161eho designu jste se rozhodli pou\u017e\u00edt 4 VSYS.<br \/>\nKa\u017ed\u00fd z t\u011bchto VSYS je p\u0159es BGP p\u0159ipojen k dv\u011bma PE MPLS cloud\u016fm, kter\u00e9 pou\u017e\u00edv\u00e1te jako BB. T\u00edmto zp\u016fsobem si 4 VSYS vym\u011b\u0148uj\u00ed v\u0161echny specifick\u00e9 routy mezi sebou a maj\u00ed sm\u011brovac\u00ed tabulku s p\u0159ibli\u017en\u011b stejnou sadou tras (ale r\u016fzn\u00fdmi NH). Proto\u017ee ka\u017ed\u00fd VSYS m\u00e1 2 BGP relace (se stejn\u00fdmi nastaven\u00edmi), ka\u017ed\u00fd rout, z\u00edskan\u00fd p\u0159es MPLS, m\u00e1 2 NH a tud\u00ed\u017e 2 FIB z\u00e1znamy ve sm\u011brovac\u00ed tabulce. Pokud p\u0159edpokl\u00e1d\u00e1me, \u017ee to je jedin\u00fd firewall v datacentru a m\u011bl by zn\u00e1t v\u0161echny routy, bude to znamenat, \u017ee celkov\u00e9 mno\u017estv\u00ed rout v na\u0161em datacentru nem\u016f\u017ee b\u00fdt v\u00edce ne\u017e 32K\/(4 * 2) = 4K. <\/p>\n<p>Te\u010f, pokud p\u0159edpokl\u00e1d\u00e1me, \u017ee m\u00e1me 2 datov\u00e1 centra (se stejn\u00fdm designem), a chceme pou\u017e\u00edt VLANy \u201erozta\u017een\u00e9\u201c mezi datov\u00fdmi centry (nap\u0159\u00edklad pro vMotion), abychom vy\u0159e\u0161ili probl\u00e9m sm\u011brov\u00e1n\u00ed, mus\u00edme pou\u017e\u00edt hostitelsk\u00e9 trasy. To v\u0161ak znamen\u00e1, \u017ee pro 2 datov\u00e1 centra m\u00e1me maxim\u00e1ln\u011b 4096 mo\u017en\u00fdch hostitel\u016f a to samoz\u0159ejm\u011b nemus\u00ed b\u00fdt dostate\u010dn\u00e9.<\/p><\/blockquote>\n<blockquote><p>P\u0159\u00edklad 2. ACL TCAM.<\/p>\n<p>Pokud pl\u00e1nujete filtrovat provoz na L3 p\u0159ep\u00edna\u010d\u00edch (nebo jin\u00fdch \u0159e\u0161en\u00edch, kter\u00e1 pou\u017e\u00edvaj\u00ed L3 p\u0159ep\u00edna\u010de, nap\u0159\u00edklad Cisco ACI), mus\u00edte p\u0159i v\u00fdb\u011bru za\u0159\u00edzen\u00ed v\u011bnovat pozornost ACL TCAM.<\/p>\n<p>P\u0159edpokl\u00e1dejme, \u017ee chcete kontrolovat p\u0159\u00edstupy na SVI rozhran\u00edch Cisco Catalyst 4500. Jak je vid\u011bt z <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/support\/docs\/switches\/catalyst-4000-series-switches\/66978-tcam-cat-4500.html\">tohoto \u010dl\u00e1nku<\/a><\/noindex>, pro kontrolu odchoz\u00edho (i p\u0159\u00edchoz\u00edho) provozu na rozhran\u00edch m\u016f\u017eete pou\u017e\u00edt pouze 4096 \u0159\u00e1dk\u016f TCAM. Co\u017e p\u0159i pou\u017eit\u00ed TCAM3 poskytne p\u0159ibli\u017en\u011b 4000 ACE (\u0159\u00e1dk\u016f ACL).<\/p><\/blockquote>\n<p> Pokud se setk\u00e1te s probl\u00e9mem nedostate\u010dn\u00e9ho TCAM, m\u011bli byste nejprve zv\u00e1\u017eit mo\u017enosti optimalizace. Pokud je probl\u00e9m s velikost\u00ed Forwarding Table, je dobr\u00e9 zv\u00e1\u017eit agregaci tras. Pokud je probl\u00e9m s velikost\u00ed TCAM pro p\u0159\u00edstupy, je t\u0159eba prov\u00e9st audit p\u0159\u00edstup\u016f, odstranit zastaral\u00e9 a p\u0159ekr\u00fdvaj\u00edc\u00ed se z\u00e1znamy a p\u0159\u00edpadn\u011b p\u0159ehodnotit postup otv\u00edr\u00e1n\u00ed p\u0159\u00edstup\u016f (toto bude podrobn\u011bji rozebr\u00e1no v kapitole v\u011bnovan\u00e9 auditu p\u0159\u00edstup\u016f).<\/p>\n<h3>Vysok\u00e1 dostupnost<\/h3>\n<p>\nM\u011bli bychom pou\u017e\u00edt HA pro firewally, nebo rad\u011bji um\u00edstit \"paraleln\u011b\" dv\u011b nez\u00e1visl\u00e9 jednotky a v p\u0159\u00edpad\u011b selh\u00e1n\u00ed jedn\u00e9 z nich sm\u011brovat provoz p\u0159es druhou?<\/p>\n<p>Na prvn\u00ed pohled se zd\u00e1, \u017ee odpov\u011b\u010f je jasn\u00e1 \u2013 pou\u017e\u00edt HA. D\u016fvod, pro\u010d se v\u0161ak tato ot\u00e1zka objevuje, spo\u010d\u00edv\u00e1 v tom, \u017ee bohu\u017eel teoretick\u00fdch a reklamn\u00edch 99 a n\u011bkolik dev\u00edtek za desetinnou \u010d\u00e1rkou dostupnosti se v praxi ukazuje b\u00fdt daleko od ide\u00e1lu. HA je logicky pom\u011brn\u011b slo\u017eit\u00e1 z\u00e1le\u017eitost a na r\u016fzn\u00fdch za\u0159\u00edzen\u00edch a s r\u016fzn\u00fdmi v\u00fdrobci (\u017e\u00e1dn\u00e1 v\u00fdjimka nebyla) jsme narazili na probl\u00e9my a chyby a zastaven\u00ed slu\u017eby.<\/p>\n<p>Pokud pou\u017eijete HA, z\u00edsk\u00e1te mo\u017enost vyp\u00ednat jednotliv\u00e9 uzly a p\u0159ep\u00ednat mezi nimi bez p\u0159eru\u0161en\u00ed slu\u017eby, co\u017e je d\u016fle\u017eit\u00e9 nap\u0159\u00edklad p\u0159i upgradech. M\u00e1te v\u0161ak tak\u00e9 pom\u011brn\u011b vysokou pravd\u011bpodobnost, \u017ee se v\u00e1m ob\u011b uzly rozbij\u00ed sou\u010dasn\u011b, a i to, \u017ee dal\u0161\u00ed upgrade neprob\u011bhne tak hladce, jak to slibuje v\u00fdrobce (tomuto probl\u00e9mu se lze vyhnout, pokud m\u00e1te mo\u017enost testovat upgrade na laboratorn\u00edm za\u0159\u00edzen\u00ed).<\/p>\n<p>Pokud nepou\u017e\u00edv\u00e1te HA, jsou va\u0161e rizika v p\u0159\u00edpad\u011b dvojit\u00e9ho selh\u00e1n\u00ed v\u00fdrazn\u011b ni\u017e\u0161\u00ed (proto\u017ee m\u00e1te 2 nez\u00e1visl\u00e9 firewally), ale jeliko\u017e se relace nesynchronizuj\u00ed, poka\u017ed\u00e9, kdy\u017e dojde k p\u0159epnut\u00ed mezi t\u011bmito firewally, budete ztr\u00e1cet provoz. M\u016f\u017eete sice pou\u017e\u00edt stateless firewalling, ale pak v\u011bt\u0161ina smyslu pou\u017e\u00edv\u00e1n\u00ed firewallu ztr\u00e1c\u00ed v\u00fdznam.<\/p>\n<p>Pokud jste tedy p\u0159i auditu zjistili osam\u011ble stoj\u00edc\u00ed firewally a p\u0159em\u00fd\u0161l\u00edte o zv\u00fd\u0161en\u00ed spolehlivosti va\u0161\u00ed s\u00edt\u011b, HA je samoz\u0159ejm\u011b jedn\u00edm z doporu\u010den\u00fdch \u0159e\u0161en\u00ed, ale mus\u00edte zv\u00e1\u017eit i nev\u00fdhody spojen\u00e9 s t\u00edmto p\u0159\u00edstupem a mo\u017en\u00e1 pro va\u0161i s\u00ed\u0165 bude vhodn\u011bj\u0161\u00ed jin\u00e9 \u0159e\u0161en\u00ed.<\/p>\n<h3>Pohodl\u00ed v \u0159\u00edzen\u00ed (manageability)<\/h3>\n<p>\nV podstat\u011b je HA tak\u00e9 o \u0159\u00edzen\u00ed. M\u00edsto konfigurace dvou za\u0159\u00edzen\u00ed odd\u011blen\u011b a \u0159e\u0161en\u00ed probl\u00e9mu se synchronizac\u00ed konfigurac\u00ed je spravujete do zna\u010dn\u00e9 m\u00edry tak, jako byste m\u011bli jedno za\u0159\u00edzen\u00ed. <\/p>\n<p>Ale mo\u017en\u00e1 m\u00e1te v\u00edce datov\u00fdch center a mnoho firewall\u016f, pak se tento probl\u00e9m posune na novou \u00farove\u0148. A ot\u00e1zka nen\u00ed jen o konfiguraci, ale tak\u00e9 o<\/p>\n<ul>\n<li>z\u00e1lohov\u00e1n\u00ed konfigurac\u00ed<\/li>\n<li>aktualizac\u00edch<\/li>\n<li>upgrady<\/li>\n<li>monitorov\u00e1n\u00ed<\/li>\n<li>logov\u00e1n\u00ed<\/li>\n<\/ul>\n<p>\nA to v\u0161e mohou vy\u0159e\u0161it centralizovan\u00e9 syst\u00e9my spr\u00e1vy. <\/p>\n<blockquote><p>Nap\u0159\u00edklad pokud pou\u017e\u00edv\u00e1te firewally Palo Alto, pak <noindex><a rel=\"nofollow\" href=\"https:\/\/www.paloaltonetworks.com\/products\/management\/panorama\">Panorama<\/a><\/noindex> je takov\u00fdm \u0159e\u0161en\u00edm.\n<\/p><\/blockquote>\n<p>\n<i>Pokra\u010dov\u00e1n\u00ed n\u00e1sleduje.<\/i><br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0440\u0435\u0442\u044c\u0435\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb. \u0421\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u0441\u0442\u0430\u0442\u0435\u0439 \u0446\u0438\u043a\u043b\u0430 \u0438 \u0441\u0441\u044b\u043b\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0437\u0434\u0435\u0441\u044c. \u041d\u0435\u0442 \u0441\u043c\u044b\u0441\u043b\u0430 \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u044c \u043e \u043f\u043e\u043b\u043d\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 security \u0440\u0438\u0441\u043a\u043e\u0432. \u041c\u044b \u0432 \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0435 \u043d\u0435 \u043c\u043e\u0436\u0435\u043c \u0441\u043d\u0438\u0437\u0438\u0442\u044c \u0438\u0445 \u0434\u043e \u043d\u0443\u043b\u044f. \u0422\u0430\u043a\u0436\u0435 \u043d\u0443\u0436\u043d\u043e \u043f\u043e\u043d\u0438\u043c\u0430\u0442\u044c, \u0447\u0442\u043e \u043f\u0440\u0438 \u0441\u0442\u0440\u0435\u043c\u043b\u0435\u043d\u0438\u0438 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0441\u0435\u0442\u044c \u0431\u043e\u043b\u0435\u0435 \u0438 \u0431\u043e\u043b\u0435\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043d\u0430\u0448\u0438 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0441\u0442\u0430\u043d\u043e\u0432\u044f\u0442\u0441\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23033,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31058","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0440\u0435\u0442\u044c\u0435\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c. \u0413\u043b\u0430\u0432\u0430 \u0442\u0440\u0435\u0442\u044c\u044f. \u0421\u0435\u0442\u0435\u0432\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c. \u0427\u0430\u0441\u0442\u044c \u043f\u0435\u0440\u0432\u0430\u044f | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0440\u0435\u0442\u044c\u0435\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:39:12+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:39:12+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Jak vz\u00edt s\u00ed\u0165ovou infrastrukturu pod vlastn\u00ed kontrolu. Hlava t\u0159et\u00ed. S\u00ed\u0165ov\u00e1 bezpe\u010dnost. \u010c\u00e1st prvn\u00ed | ProHoster","description":"Tento \u010dl\u00e1nek je t\u0159et\u00ed v cyklu \u010dl\u00e1nk\u016f \u201eJak vz\u00edt s\u00ed\u0165ovou infrastrukturu pod vlastn\u00ed kontrolu\u201c.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c. \u0413\u043b\u0430\u0432\u0430 \u0442\u0440\u0435\u0442\u044c\u044f. \u0421\u0435\u0442\u0435\u0432\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c. \u0427\u0430\u0441\u0442\u044c \u043f\u0435\u0440\u0432\u0430\u044f | ProHoster","og:description":"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0440\u0435\u0442\u044c\u0435\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:39:12+00:00","article:modified_time":"2019-10-31T18:39:12+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31058","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 04:20:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:24:14","updated":"2026-01-21 04:20:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/31058","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=31058"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/31058\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/23033"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=31058"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=31058"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=31058"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}