{"id":32126,"date":"2019-10-31T21:45:18","date_gmt":"2019-10-31T18:45:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/osobennosti-nastrojki-palo-alto-networks-ssl-vpn\/"},"modified":"2019-10-31T21:45:18","modified_gmt":"2019-10-31T18:45:18","slug":"osobennosti-nastrojki-palo-alto-networks-ssl-vpn","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/osobennosti-nastrojki-palo-alto-networks-ssl-vpn","title":{"rendered":"Specifika nastaven\u00ed Palo Alto Networks: SSL VPN","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Specifika nastaven\u00ed Palo Alto Networks: SSL VPN\" src=\"\/wp-content\/uploads\/2019\/04\/f1b7724dcec58c57688ca5020ebdbd96.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u0159es v\u0161echny v\u00fdhody firewall\u016f Palo Alto Networks nen\u00ed v \u010desk\u00e9m internetu p\u0159\u00edli\u0161 materi\u00e1l\u016f o nastaven\u00ed t\u011bchto za\u0159\u00edzen\u00ed, ani text\u016f popisuj\u00edc\u00edch zku\u0161enosti s jejich nasazen\u00edm. Rozhodli jsme se shrnout materi\u00e1ly, kter\u00e9 jsme nashrom\u00e1\u017edili b\u011bhem na\u0161\u00ed pr\u00e1ce s vybaven\u00edm tohoto dodavatele, a pov\u00eddat o zvl\u00e1\u0161tnostech, se kter\u00fdmi jsme se setkali p\u0159i realizaci r\u016fzn\u00fdch projekt\u016f. <\/p>\n<p>Pro sezn\u00e1men\u00ed s Palo Alto Networks se v tomto \u010dl\u00e1nku pod\u00edv\u00e1me na nastaven\u00ed pot\u0159ebn\u00e1 k \u0159e\u0161en\u00ed jednoho z nejb\u011b\u017en\u011bj\u0161\u00edch \u00fakol\u016f firewallu \u2014 SSL VPN pro vzd\u00e1len\u00fd p\u0159\u00edstup. Tak\u00e9 probereme pomocn\u00e9 funkce pro obecn\u00e9 nastaven\u00ed firewallu, identifikaci u\u017eivatel\u016f, aplikac\u00ed a bezpe\u010dnostn\u00edch politik. Pokud t\u00e9mata \u010dten\u00e1\u0159e zaujmou, v budoucnu vyd\u00e1me materi\u00e1ly s rozborem Site-to-Site, <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/cs\/vpn\/\"   title=\"VPN\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"33\">VPN<\/a>, dynamick\u00e9ho sm\u011brov\u00e1n\u00ed a centralizovan\u00e9ho \u0159\u00edzen\u00ed pomoc\u00ed Panorama. <br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nFirewally Palo Alto Networks vyu\u017e\u00edvaj\u00ed \u0159adu inovativn\u00edch technologi\u00ed, v\u010detn\u011b App-ID, User-ID a Content-ID. Pou\u017eit\u00ed t\u00e9to funk\u010dnosti umo\u017e\u0148uje zajistit vysokou \u00farove\u0148 bezpe\u010dnosti. Nap\u0159\u00edklad pomoc\u00ed App-ID je mo\u017en\u00e9 identifikovat provoz aplikac\u00ed na z\u00e1klad\u011b signatur, dek\u00f3dov\u00e1n\u00ed a heuristiky, bez ohledu na pou\u017eit\u00fd port a protokol, v\u010detn\u011b uvnit\u0159 SSL tunelu. User-ID umo\u017e\u0148uje identifikaci u\u017eivatel\u016f s\u00edt\u011b prost\u0159ednictv\u00edm integrace s LDAP. Content-ID d\u00e1v\u00e1 mo\u017enost skenovat provoz a identifikovat p\u0159en\u00e1\u0161en\u00e9 soubory a jejich obsah. Mezi dal\u0161\u00ed funkce firewall\u016f lze za\u0159adit ochranu proti \u00fatok\u016fm, ochranu proti zranitelnostem a \u00fatok\u016fm DDoS, integrovan\u00fd anti-spyware, URL filtraci, clustering a centralizovan\u00e9 \u0159\u00edzen\u00ed.<\/p>\n<p>Pro demonstraci budeme pou\u017e\u00edvat izolovan\u00fd testovac\u00ed stroj, jeho\u017e konfigurace je identick\u00e1 s re\u00e1lnou, s v\u00fdjimkou n\u00e1zv\u016f za\u0159\u00edzen\u00ed, n\u00e1zvu dom\u00e9ny AD a IP adres. Ve skute\u010dnosti je to slo\u017eit\u011bj\u0161\u00ed \u2014 m\u016f\u017ee b\u00fdt mnoho pobo\u010dek. Na hranic\u00edch centr\u00e1ln\u00edch lokalit bude v takov\u00e9m p\u0159\u00edpad\u011b m\u00edsto jednoho firewallu nainstalov\u00e1n cluster, a m\u016f\u017ee b\u00fdt tak\u00e9 vy\u017eadov\u00e1no dynamick\u00e9 sm\u011brov\u00e1n\u00ed.<\/p>\n<p>Na testovac\u00edm za\u0159\u00edzen\u00ed se pou\u017e\u00edv\u00e1 <b>PAN-OS 7.1.9<\/b>. Jako typickou konfiguraci zva\u017eujeme s\u00ed\u0165 s firewall Palo Alto Networks na hranici. Firewall poskytuje vzd\u00e1len\u00fd p\u0159\u00edstup SSL VPN do centr\u00e1ly. Jako datab\u00e1ze u\u017eivatel\u016f bude pou\u017eit dom\u00e9nov\u00fd Active Directory (obr\u00e1zek 1).<\/p>\n<p><img decoding=\"async\" alt=\"Specifika nastaven\u00ed Palo Alto Networks: SSL VPN\" src=\"\/wp-content\/uploads\/2019\/04\/b3db829ea3d1361cb2106bc70cad8ef0.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Obr\u00e1zek 1 \u2013 Strukturn\u00ed sch\u00e9ma s\u00edt\u011b<\/i><\/p>\n<p>Etapy nastaven\u00ed:<\/p>\n<ol>\n<li>P\u0159ednastaven\u00ed za\u0159\u00edzen\u00ed. Zad\u00e1n\u00ed n\u00e1zvu, <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/cs\/lir\/ipv4\/\"   title=\"IP adres\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"624\">IP adres<\/a> \u0159\u00edzen\u00ed, statick\u00fdch tras, \u00fa\u010dt\u016f administr\u00e1tor\u016f, profil\u016f \u0159\u00edzen\u00ed<\/li>\n<li>Instalace licenc\u00ed, nastaven\u00ed a instalace aktualizac\u00ed<\/li>\n<li>Nastaven\u00ed bezpe\u010dnostn\u00edch z\u00f3n, s\u00ed\u0165ov\u00fdch rozhran\u00ed, politiky provozu, p\u0159eklady adres<\/li>\n<li>Nastaven\u00ed profilu autentizace LDAP a funkce User Identification<\/li>\n<li>Nastaven\u00ed SSL VPN<\/li>\n<\/ol>\n<p><\/p>\n<h4>1. P\u0159ednastaven\u00ed<\/h4>\n<p>\nHlavn\u00edm n\u00e1strojem pro nastaven\u00ed firewallu Palo Alto Networks je webov\u00e9 rozhran\u00ed, je mo\u017en\u00e9 tak\u00e9 \u0159\u00edzen\u00ed p\u0159es CLI. Ve v\u00fdchoz\u00edm nastaven\u00ed m\u00e1 management-interface nastavenou IP adresu 192.168.1.1\/24, login: admin, heslo: admin. <\/p>\n<p>Adresu lze zm\u011bnit bu\u010f p\u0159ipojen\u00edm k webov\u00e9mu rozhran\u00ed ze stejn\u00e9 s\u00edt\u011b, nebo pomoc\u00ed p\u0159\u00edkazu <b>set deviceconfig system ip-address  netmask<\/b>. Ten se prov\u00e1d\u00ed v konfigura\u010dn\u00edm re\u017eimu. Pro p\u0159epnut\u00ed do konfigura\u010dn\u00edho re\u017eimu se pou\u017e\u00edv\u00e1 p\u0159\u00edkaz <b>konfigurovat<\/b>. V\u0161echna zm\u011bny na firewallu se prov\u00e1d\u011bj\u00ed pouze po potvrzen\u00ed nastaven\u00ed p\u0159\u00edkazem <b>commit<\/b>, jak v re\u017eimu p\u0159\u00edkazov\u00e9ho \u0159\u00e1dku, tak v webov\u00e9m rozhran\u00ed.<\/p>\n<p>Pro zm\u011bnu nastaven\u00ed v webov\u00e9m rozhran\u00ed se pou\u017e\u00edv\u00e1 sekce <b>Device -&gt; General Settings a Device -&gt; Management Interface Settings.<\/b> N\u00e1zev, bannery, \u010dasov\u00e1 p\u00e1sma a dal\u0161\u00ed nastaven\u00ed lze konfigurovat v sekci General Settings (obr. 2).<\/p>\n<p><img decoding=\"async\" alt=\"Specifika nastaven\u00ed Palo Alto Networks: SSL VPN\" src=\"\/wp-content\/uploads\/2019\/04\/6e46d795deed506a57fe1375ca90ad25.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Obr\u00e1zek 2 \u2013 Parametry managementov\u00e9ho rozhran\u00ed<\/i><\/p>\n<p>Pokud se pou\u017e\u00edv\u00e1 virtu\u00e1ln\u00ed firewall v prost\u0159ed\u00ed ESXi, je v sekci General Settings t\u0159eba povolit pou\u017eit\u00ed MAC adresy p\u0159id\u011blen\u00e9 hypervizorem, nebo nastavit na hypervizoru MAC adresy p\u0159id\u011blen\u00e9 na rozhran\u00edch firewallu, nebo zm\u011bnit nastaven\u00ed virtu\u00e1ln\u00edch p\u0159ep\u00edna\u010d\u016f tak, aby povolily zm\u011bny MAC adres. Jinak provoz neprojde.<\/p>\n<p>Management interface se nastavuje samostatn\u011b a neobjevuje se v seznamu s\u00ed\u0165ov\u00fdch rozhran\u00ed. V sekci <b>Management Interface Settings<\/b> se uv\u00e1d\u00ed v\u00fdchoz\u00ed br\u00e1na pro management interface. Dal\u0161\u00ed statick\u00e9 trasy se nastavuj\u00ed v sekci virtu\u00e1ln\u00edch router\u016f, o tom bude naps\u00e1no d\u00e1le. <\/p>\n<p>Pro povolen\u00ed p\u0159\u00edstupu k za\u0159\u00edzen\u00ed p\u0159es jin\u00e9 rozhran\u00ed je nutn\u00e9 vytvo\u0159it profil spr\u00e1vy <b>Profil spr\u00e1vy<\/b> v sekci <b>S\u00ed\u0165 -&gt; S\u00ed\u0165ov\u00e9 profily -&gt; Spr\u00e1va rozhran\u00ed<\/b> a p\u0159i\u0159adit ho k odpov\u00eddaj\u00edc\u00edmu rozhran\u00ed. <\/p>\n<p>D\u00e1le je t\u0159eba nastavit DNS a NTP v sekci <b>Za\u0159\u00edzen\u00ed -&gt; Slu\u017eby<\/b> pro z\u00edsk\u00e1n\u00ed aktualizac\u00ed a spr\u00e1vn\u00e9 zobrazen\u00ed \u010dasu (obr. 3). Ve v\u00fdchoz\u00edm nastaven\u00ed ve\u0161ker\u00fd provoz generovan\u00fd firewallem pou\u017e\u00edv\u00e1 jako IP adresu zdroje IP adresu spr\u00e1vy. Jin\u00e9mu rozhran\u00ed lze p\u0159i\u0159adit ka\u017edou konkr\u00e9tn\u00ed slu\u017ebu v sekci <b>Konfigurace sm\u011brov\u00e1n\u00ed slu\u017eeb<\/b>.<\/p>\n<p><img decoding=\"async\" alt=\"Specifika nastaven\u00ed Palo Alto Networks: SSL VPN\" src=\"\/wp-content\/uploads\/2019\/04\/7f13e6631daf8924405216fa07f4e39b.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Obr\u00e1zek 3 \u2013 Parametry slu\u017eeb DNS, NTP a syst\u00e9mov\u00fdch tras<\/i><\/p>\n<h4>2. Instalace licenc\u00ed, nastaven\u00ed a instalace aktualizac\u00ed<\/h4>\n<p>\nPro plnou funk\u010dnost v\u0161ech funkc\u00ed firewalla je nutn\u00e9 nainstalovat licenci. Je mo\u017en\u00e9 pou\u017e\u00edt zku\u0161ebn\u00ed licenci, kterou lze z\u00edskat od partner\u016f Palo Alto Networks. Jej\u00ed platnost je 30 dn\u00ed. Licence se aktivuje bu\u010f prost\u0159ednictv\u00edm souboru, nebo pomoc\u00ed Auth-Codu. Licence se nastavuj\u00ed v sekci <b>Za\u0159\u00edzen\u00ed -&gt; Licence<\/b> (obr. 4).<br \/>\nPo instalaci licence je pot\u0159eba nastavit instalaci aktualizac\u00ed v sekci <b>Za\u0159\u00edzen\u00ed -&gt; Dynamick\u00e9 aktualizace<\/b>.<br \/>\nV sekci <b>Za\u0159\u00edzen\u00ed -&gt; Software<\/b> lze st\u00e1hnout a nainstalovat nov\u00e9 verze PAN-OS.<\/p>\n<p><img decoding=\"async\" alt=\"Specifika nastaven\u00ed Palo Alto Networks: SSL VPN\" src=\"\/wp-content\/uploads\/2019\/04\/0e3790b5f2234c563d2a46a47f37602f.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Obr\u00e1zek 4 \u2013 Ovl\u00e1dac\u00ed panel licenc\u00ed<\/i><\/p>\n<h4>3. Nastaven\u00ed bezpe\u010dnostn\u00edch z\u00f3n, s\u00ed\u0165ov\u00fdch rozhran\u00ed, politiky provozu, p\u0159eklad adres<\/h4>\n<p>\nFirewally Palo Alto Networks pou\u017e\u00edvaj\u00ed logiku z\u00f3n p\u0159i nastavov\u00e1n\u00ed s\u00ed\u0165ov\u00fdch pravidel. S\u00ed\u0165ov\u00e1 rozhran\u00ed jsou p\u0159i\u0159azena konkr\u00e9tn\u00ed z\u00f3n\u011b, kter\u00e1 se pou\u017e\u00edv\u00e1 v pravidlech provozu. Tento p\u0159\u00edstup umo\u017e\u0148uje p\u0159i budouc\u00edch zm\u011bn\u00e1ch nastaven\u00ed rozhran\u00ed nem\u011bnit pravidla provozu, ale m\u00edsto toho p\u0159e\u0159adit po\u017eadovan\u00e1 rozhran\u00ed do odpov\u00eddaj\u00edc\u00edch z\u00f3n. Ve v\u00fdchoz\u00edm nastaven\u00ed je provoz uvnit\u0159 z\u00f3ny povolen, provoz mezi z\u00f3nami je zak\u00e1z\u00e1n, co\u017e zaji\u0161\u0165uj\u00ed p\u0159ednastaven\u00e1 pravidla <b>intrazone-default<\/b> a <b>interzone-default<\/b>.<\/p>\n<p><img decoding=\"async\" alt=\"Specifika nastaven\u00ed Palo Alto Networks: SSL VPN\" src=\"\/wp-content\/uploads\/2019\/04\/16a1d20529e7ab3b31bde5a90a20dec0.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Obr\u00e1zek 5 \u2013 Bezpe\u010dnostn\u00ed z\u00f3ny<\/i><\/p>\n<p>V tomto p\u0159\u00edkladu je rozhran\u00ed v intern\u00ed s\u00edti p\u0159i\u0159azeno k z\u00f3n\u011b <b>intern\u00ed<\/b>, zat\u00edmco rozhran\u00ed sm\u011b\u0159uj\u00edc\u00ed na internet je p\u0159i\u0159azeno k z\u00f3n\u011b <b>extern\u00ed<\/b>. Pro SSL VPN byl vytvo\u0159en tunelov\u00fd interface, kter\u00fd je p\u0159i\u0159azen do z\u00f3ny <b>vpn <\/b>(obr. 5).<\/p>\n<p>S\u00ed\u0165ov\u00e1 rozhran\u00ed firewallu Palo Alto Networks mohou pracovat v p\u011bti r\u016fzn\u00fdch re\u017eimech:<\/p>\n<ul>\n<li><b>Tap <\/b>\u2013 pou\u017e\u00edv\u00e1 se pro shroma\u017e\u010fov\u00e1n\u00ed provozu za \u00fa\u010delem monitorov\u00e1n\u00ed a anal\u00fdzy<\/li>\n<li><b>HA <\/b>\u2013 pou\u017e\u00edv\u00e1 se pro provoz clustera<\/li>\n<li><b>Virtu\u00e1ln\u00ed dr\u00e1t<\/b> \u2013 V tomto re\u017eimu Palo Alto Networks spojuje dv\u011b rozhran\u00ed a transparentn\u011b propou\u0161t\u00ed mezi nimi provoz, ani\u017e by m\u011bnil MAC a IP adresy<\/li>\n<li><b>Layer2<\/b> \u2013 re\u017eim p\u0159ep\u00edna\u010de<\/li>\n<li><b>Layer3<\/b> \u2013 re\u017eim routeru<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Specifika nastaven\u00ed Palo Alto Networks: SSL VPN\" src=\"\/wp-content\/uploads\/2019\/04\/692a1a767d50092b29e863da13895aa3.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Obr\u00e1zek 6 \u2013 Nastaven\u00ed re\u017eimu pr\u00e1ce rozhran\u00ed<\/i><\/p>\n<p>V tomto p\u0159\u00edkladu bude pou\u017eit re\u017eim Layer3 (viz obr. 6). V parametrech s\u00ed\u0165ov\u00e9ho rozhran\u00ed je uvedena IP adresa, pracovn\u00ed re\u017eim a odpov\u00eddaj\u00edc\u00ed bezpe\u010dnostn\u00ed z\u00f3na. Krom\u011b pracovn\u00ed re\u017eimu rozhran\u00ed je t\u0159eba jej p\u0159i\u0159adit k virtu\u00e1ln\u00edmu routeru Virtual Router, co\u017e je ekvivalent instance VRF v Palo Alto Networks. Virtu\u00e1ln\u00ed routery jsou izolov\u00e1ny jeden od druh\u00e9ho a maj\u00ed sv\u00e9 tabulky sm\u011brov\u00e1n\u00ed a nastaven\u00ed s\u00ed\u0165ov\u00fdch protokol\u016f.<\/p>\n<p>V nastaven\u00ed virtu\u00e1ln\u00edho routeru se uv\u00e1d\u011bj\u00ed statick\u00e9 sm\u011bry a nastaven\u00ed sm\u011brovac\u00edch protokol\u016f. V tomto p\u0159\u00edkladu byl vytvo\u0159en pouze v\u00fdchoz\u00ed sm\u011brovac\u00ed bod pro p\u0159\u00edstup do extern\u00edch s\u00edt\u00ed (viz obr. 7).<\/p>\n<p><img decoding=\"async\" alt=\"Specifika nastaven\u00ed Palo Alto Networks: SSL VPN\" src=\"\/wp-content\/uploads\/2019\/04\/a9a51f51c84d5fd47762a4167c7b7e2c.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Obr\u00e1zek 7 \u2013 Nastaven\u00ed virtu\u00e1ln\u00edho routeru<\/i><\/p>\n<p>Dal\u0161\u00edm krokem nastaven\u00ed jsou politiky provozu, sekce <b>Policies -&gt; Security<\/b>. P\u0159\u00edklad nastaven\u00ed je zobrazen na obr\u00e1zku 8. Logika pr\u00e1ce pravidel je stejn\u00e1 jako u v\u0161ech firewall\u016f. Pravidla se kontroluj\u00ed shora dol\u016f, a\u017e do prvn\u00edho shody. Stru\u010dn\u00fd popis pravidel:<\/p>\n<p>1. SSL VPN Access to Web Portal. Umo\u017e\u0148uje p\u0159\u00edstup k webov\u00e9mu port\u00e1lu pro autentizaci vzd\u00e1len\u00fdch p\u0159ipojen\u00ed<br \/>\n2. VPN traffic \u2013 povolen\u00ed provozu mezi vzd\u00e1len\u00fdmi p\u0159ipojen\u00edmi a centr\u00e1ln\u00edm kancel\u00e1\u0159em<br \/>\n3. Basic Internet \u2013 povolen\u00ed aplikac\u00ed dns, ping, traceroute, ntp. Firewall povoluje aplikace na z\u00e1klad\u011b signatur, dek\u00f3dov\u00e1n\u00ed a heuristiky, nikoliv na z\u00e1klad\u011b \u010d\u00edsel port\u016f a protokol\u016f, proto je v \u010d\u00e1sti Service uvedeno application-default. Port\/protokol podle v\u00fdchoz\u00edho nastaven\u00ed pro tuto aplikaci<br \/>\n4. Web Access \u2013 povolen\u00ed p\u0159\u00edstupu na internet prost\u0159ednictv\u00edm protokol\u016f HTTP a HTTPS bez kontroly aplikac\u00ed<br \/>\n5,6. V\u00fdchoz\u00ed pravidla pro ostatn\u00ed provoz.<\/p>\n<p><img decoding=\"async\" alt=\"Specifika nastaven\u00ed Palo Alto Networks: SSL VPN\" src=\"\/wp-content\/uploads\/2019\/04\/2aea65b9e482df4dcee3294a59203165.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Obr\u00e1zek 8 \u2014 P\u0159\u00edklad nastaven\u00ed s\u00ed\u0165ov\u00fdch pravidel<\/i><\/p>\n<p>Pro nastaven\u00ed NAT se pou\u017e\u00edv\u00e1 sekce <b>Policies -&gt; NAT<\/b>. P\u0159\u00edklad nastaven\u00ed NAT je zobrazen na obr\u00e1zku 9.<\/p>\n<p><img decoding=\"async\" alt=\"Specifika nastaven\u00ed Palo Alto Networks: SSL VPN\" src=\"\/wp-content\/uploads\/2019\/04\/c059a4f84b981f3205f1a4b33c5344b3.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Obr\u00e1zek 9 \u2013 P\u0159\u00edklad nastaven\u00ed NAT<\/i><\/p>\n<p>Pro ve\u0161ker\u00fd provoz z intern\u00ed do extern\u00ed m\u016f\u017ee b\u00fdt zm\u011bn\u011bna adresa zdroje na extern\u00ed IP adresu firewallu a pou\u017e\u00edt dynamick\u00e1 adresa portu (PAT).<\/p>\n<p><b>4. Nastaven\u00ed profilu autentizace LDAP a funkce User Identification<\/b><br \/>\nP\u0159ed p\u0159ipojen\u00edm u\u017eivatel\u016f p\u0159es SSL-VPN je nutn\u00e9 nastavit mechanismus autentizace. V tomto p\u0159\u00edkladu bude autentizace prob\u00edhat na \u0159adi\u010di dom\u00e9ny Active Directory prost\u0159ednictv\u00edm webov\u00e9ho rozhran\u00ed Palo Alto Networks.<\/p>\n<p><img decoding=\"async\" alt=\"Specifika nastaven\u00ed Palo Alto Networks: SSL VPN\" src=\"\/wp-content\/uploads\/2019\/04\/3d766a14f1e01ba051c2aa171c209156.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Obr\u00e1zek 10 \u2013 LDAP profil<\/i><\/p>\n<p>Aby autentizace fungovala, je t\u0159eba nastavit <b>LDAP Profil<\/b> a <b>Profil autentizace<\/b>. V \u010d\u00e1sti <b>Za\u0159\u00edzen\u00ed -&gt; Serverov\u00e9 profily -&gt; LDAP<\/b> (obr\u00e1z. 10) je nutn\u00e9 uv\u00e9st IP adresu a port \u0159adi\u010de dom\u00e9ny, typ LDAP a u\u017eivatelsk\u00fd \u00fa\u010det, kter\u00fd pat\u0159\u00ed do skupin <b>Server Operators<\/b>, <b>Event Log Readers<\/b>, <b>Distributed COM Users<\/b>. D\u00e1le v sekci <b>Za\u0159\u00edzen\u00ed -&gt; Profil autentizace<\/b> vytvo\u0159\u00edme profil autentizace (obr\u00e1z. 11), ozna\u010d\u00edme d\u0159\u00edve vytvo\u0159en\u00fd <b>LDAP Profil<\/b> a v z\u00e1lo\u017ece Advanced uvedeme skupinu u\u017eivatel\u016f (obr\u00e1z. 12), kter\u00fdm je povolen vzd\u00e1len\u00fd p\u0159\u00edstup. Je d\u016fle\u017eit\u00e9 uv\u00e9st v profilu parametr <b>U\u017eivatelsk\u00e1 dom\u00e9na<\/b>, jinak autorizace na z\u00e1klad\u011b skupin nebude fungovat. V poli mus\u00ed b\u00fdt uvedeno NetBIOS jm\u00e9no dom\u00e9ny.<\/p>\n<p><img decoding=\"async\" alt=\"Specifika nastaven\u00ed Palo Alto Networks: SSL VPN\" src=\"\/wp-content\/uploads\/2019\/04\/465351361288da9fd2db00afc43c2ddf.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Obr\u00e1zek 11 \u2013 Profil autentizace<\/i><\/p>\n<p><img decoding=\"async\" alt=\"Specifika nastaven\u00ed Palo Alto Networks: SSL VPN\" src=\"\/wp-content\/uploads\/2019\/04\/43983491298482daad6c39a5369137c1.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Obr\u00e1zek 12 \u2013 V\u00fdb\u011br skupiny AD<\/i><\/p>\n<p>Dal\u0161\u00edm krokem je nastaven\u00ed <b>Za\u0159\u00edzen\u00ed -&gt; Identifikace u\u017eivatel\u016f<\/b>. Zde je t\u0159eba uv\u00e9st IP adresu \u0159adi\u010de dom\u00e9ny, p\u0159ihla\u0161ovac\u00ed \u00fadaje pro p\u0159ipojen\u00ed a tak\u00e9 nastavit parametry <b>Povolit bezpe\u010dnostn\u00ed protokol<\/b>, <b>Povolit relaci<\/b>, <b>Povolit pr\u016fzkum<\/b> (obr\u00e1z. 13). V sekci <b>Mapov\u00e1n\u00ed skupin<\/b> (obr\u00e1z. 14) je t\u0159eba ozna\u010dit parametry identifikace objekt\u016f v LDAP a seznam skupin, kter\u00e9 budou pou\u017eity pro autorizaci. Tak\u00e9 jako v profilu autentizace je t\u0159eba zde nastavit parametr U\u017eivatelsk\u00e1 dom\u00e9na.<\/p>\n<p><img decoding=\"async\" alt=\"Specifika nastaven\u00ed Palo Alto Networks: SSL VPN\" src=\"\/wp-content\/uploads\/2019\/04\/ba466e3187bc01434c4afb9469434bc4.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Obr\u00e1zek 13 \u2013 Parametry mapov\u00e1n\u00ed u\u017eivatel\u016f<\/i><\/p>\n<p><img decoding=\"async\" alt=\"Specifika nastaven\u00ed Palo Alto Networks: SSL VPN\" src=\"\/wp-content\/uploads\/2019\/04\/3c43d0156849e6f3f99b92818b76445e.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Obr\u00e1zek 14 \u2013 Parametry mapov\u00e1n\u00ed skupin<\/i><\/p>\n<p>Posledn\u00edm krokem v t\u00e9to f\u00e1zi bude vytvo\u0159en\u00ed VPN z\u00f3ny a rozhran\u00ed pro tuto z\u00f3nu. Na rozhran\u00ed je t\u0159eba povolit parametr <b>Povolit identifikaci u\u017eivatel\u016f<\/b> (obr\u00e1z. 15).<\/p>\n<p><img decoding=\"async\" alt=\"Specifika nastaven\u00ed Palo Alto Networks: SSL VPN\" src=\"\/wp-content\/uploads\/2019\/04\/45d28b957c2d889cb51cd3fb1096896d.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Obr\u00e1zek 15 \u2013 Nastaven\u00ed VPN z\u00f3ny<\/i><\/p>\n<h4>5. Nastaven\u00ed SSL VPN<\/h4>\n<p>\nP\u0159ed p\u0159ipojen\u00edm SSL VPN se mus\u00ed vzd\u00e1len\u00fd u\u017eivatel p\u0159ihl\u00e1sit na webov\u00fd port\u00e1l, proj\u00edt autentifikac\u00ed a st\u00e1hnout klienta Global Protect. Tento klient pot\u00e9 po\u017e\u00e1d\u00e1 o p\u0159ihla\u0161ovac\u00ed \u00fadaje a p\u0159ipoj\u00ed se k podnikov\u00e9mu s\u00ed\u0165ov\u00e9mu prost\u0159ed\u00ed. Webov\u00fd port\u00e1l pracuje v re\u017eimu https, a proto je nutn\u00e9 nainstalovat certifik\u00e1t. Pou\u017eijte ve\u0159ejn\u00fd certifik\u00e1t, pokud je to mo\u017en\u00e9. V takov\u00e9m p\u0159\u00edpad\u011b u\u017eivatel nedostane varov\u00e1n\u00ed o neplatnosti certifik\u00e1tu na str\u00e1nk\u00e1ch. Pokud nen\u00ed mo\u017en\u00e9 pou\u017e\u00edt ve\u0159ejn\u00fd certifik\u00e1t, je t\u0159eba vydat vlastn\u00ed, kter\u00fd bude pou\u017eit na webov\u00e9 str\u00e1nce pro https. M\u016f\u017ee b\u00fdt bu\u010f samopodepsan\u00fd, nebo vydan\u00fd prost\u0159ednictv\u00edm m\u00edstn\u00edho certifika\u010dn\u00edho \u00fa\u0159adu. Vzd\u00e1len\u00fd po\u010d\u00edta\u010d by m\u011bl m\u00edt ko\u0159enov\u00fd nebo samopodepsan\u00fd certifik\u00e1t v seznamu d\u016fv\u011bryhodn\u00fdch ko\u0159enov\u00fdch certifika\u010dn\u00edch autorit, aby se u\u017eivateli nezobrazovala chyba p\u0159i p\u0159ipojov\u00e1n\u00ed na webov\u00fd port\u00e1l. V tomto p\u0159\u00edkladu bude pou\u017eit certifik\u00e1t vydan\u00fd prost\u0159ednictv\u00edm certifika\u010dn\u00edch slu\u017eeb Active Directory.<\/p>\n<p>Pro vyd\u00e1n\u00ed certifik\u00e1tu je t\u0159eba vytvo\u0159it \u017e\u00e1dost o certifik\u00e1t v sekci<b> Za\u0159\u00edzen\u00ed -&gt; Spr\u00e1va certifik\u00e1t\u016f -&gt; Certifik\u00e1ty -&gt; Vytvo\u0159it<\/b>. V \u017e\u00e1dosti uvedeme n\u00e1zev certifik\u00e1tu a IP adresu nebo FQDN webov\u00e9ho port\u00e1lu (obr. 16). Po vygenerov\u00e1n\u00ed \u017e\u00e1dosti st\u00e1hn\u011bte <b>.csr<\/b> soubor a zkop\u00edrujte jeho obsah do pole \u017e\u00e1dosti o certifik\u00e1t na webov\u00e9m formul\u00e1\u0159i AD CS Web Enrollment. V z\u00e1vislosti na nastaven\u00ed certifika\u010dn\u00edho \u00fa\u0159adu je t\u0159eba \u017e\u00e1dost o certifik\u00e1t schv\u00e1lit a st\u00e1hnout vydan\u00fd certifik\u00e1t ve form\u00e1tu <b>certifik\u00e1t k\u00f3dovan\u00fd ve form\u00e1tu Base64<\/b>. D\u00e1le je t\u0159eba st\u00e1hnout ko\u0159enov\u00fd certifik\u00e1t certifika\u010dn\u00edho \u00fa\u0159adu. Pot\u00e9 je nutn\u00e9 importovat oba certifik\u00e1ty do firewallu. P\u0159i importu certifik\u00e1tu pro webov\u00fd port\u00e1l je t\u0159eba vybrat \u017e\u00e1dost ve stavu pending a kliknout na import. N\u00e1zev certifik\u00e1tu by m\u011bl odpov\u00eddat n\u00e1zvu uveden\u00e9mu d\u0159\u00edve v \u017e\u00e1dosti. N\u00e1zev ko\u0159enov\u00e9ho certifik\u00e1tu lze uv\u00e9st libovoln\u011b. Po importu certifik\u00e1tu je t\u0159eba vytvo\u0159it <b>profil slu\u017eby SSL\/TLS<\/b> v sekci <b>Za\u0159\u00edzen\u00ed -&gt; Spr\u00e1va certifik\u00e1t\u016f<\/b>. V profilu uvedeme d\u0159\u00edve importovan\u00fd certifik\u00e1t. <\/p>\n<p><img decoding=\"async\" alt=\"Specifika nastaven\u00ed Palo Alto Networks: SSL VPN\" src=\"\/wp-content\/uploads\/2019\/04\/b3a7e2c99b0e4b7fdc63e12942dd03ba.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Obr\u00e1zek 16 \u2013 \u017d\u00e1dost o certifik\u00e1t<\/i><\/p>\n<p>Dal\u0161\u00edm krokem je konfigurace objekt\u016f <b>Glob\u00e1ln\u00ed Protect Gateway<\/b> a <b>Glob\u00e1ln\u00ed Protect Port\u00e1l<\/b> v sekci <b>S\u00ed\u0165 -&gt; Glob\u00e1ln\u00ed Protect<\/b>. V nastaven\u00edch <b>Glob\u00e1ln\u00ed Protect Gateway<\/b> uvedeme extern\u00ed IP adresu firewallu a tak\u00e9 d\u0159\u00edve vytvo\u0159en\u00e9 <b>profil SSL<\/b>, <b>Profil autentizace<\/b>, tunelov\u00e9 rozhran\u00ed a IP nastaven\u00ed klienta. Je nutn\u00e9 specifikovat IP adresn\u00ed rozsah, ze kter\u00e9ho bude adresa p\u0159i\u0159azena klientovi, a Access Route \u2013 to jsou pods\u00edt\u011b, k nim\u017e bude m\u00edt klient p\u0159\u00edstup. Pokud je c\u00edlem sm\u011brovat ve\u0161ker\u00fd provoz u\u017eivatele p\u0159es firewall, je t\u0159eba uv\u00e9st pods\u00ed\u0165 0.0.0.0\/0 (obr. 17).<\/p>\n<p><img decoding=\"async\" alt=\"Specifika nastaven\u00ed Palo Alto Networks: SSL VPN\" src=\"\/wp-content\/uploads\/2019\/04\/6594b57408f40ee13b669219c8bb6b45.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Obr\u00e1zek 17 \u2013 Nastaven\u00ed IP adresn\u00edho poolu a tras<\/i><\/p>\n<p>Pot\u00e9 je nutn\u00e9 nastavit <b>Glob\u00e1ln\u00ed Protect Port\u00e1l<\/b>. Uv\u00e1d\u00edme IP adresu firewallu, <b>profil SSL<\/b> a <b>Profil autentizace<\/b> a seznam extern\u00edch IP adres firewall\u016f, ke kter\u00fdm se klient p\u0159ipoj\u00ed. Pokud je v\u00edce firewall\u016f, je mo\u017en\u00e9 pro ka\u017ed\u00fd nastavit prioritu, podle n\u00ed\u017e si u\u017eivatel\u00e9 vyberou firewall pro p\u0159ipojen\u00ed.<\/p>\n<p>V sekci <b>Za\u0159\u00edzen\u00ed -&gt; GlobalProtect Client<\/b> je nutn\u00e9 st\u00e1hnout instala\u010dn\u00ed bal\u00ed\u010dek VPN klienta ze server\u016f Palo Alto Networks a aktivovat ho. Pro p\u0159ipojen\u00ed se u\u017eivatel mus\u00ed p\u0159ihl\u00e1sit na webovou str\u00e1nku port\u00e1lu, kde mu bude nab\u00eddnuto st\u00e1hnout <b>GlobalProtect Client<\/b>. Po sta\u017een\u00ed a instalaci bude moci zadat sv\u00e9 p\u0159ihla\u0161ovac\u00ed \u00fadaje a p\u0159ipojit se k firemn\u00ed s\u00edti p\u0159es SSL VPN.<\/p>\n<h4>Z\u00e1v\u011br<\/h4>\n<p>\nT\u00edmto je \u010d\u00e1st nastaven\u00ed Palo Alto Networks dokon\u010dena. Douf\u00e1me, \u017ee informace byly u\u017eite\u010dn\u00e9 a \u010dten\u00e1\u0159 z\u00edskal p\u0159edstavu o technologi\u00edch pou\u017e\u00edvan\u00fdch v Palo Alto Networks. Pokud m\u00e1te ot\u00e1zky k nastaven\u00ed nebo p\u0159\u00e1n\u00ed k t\u00e9mat\u016fm budouc\u00edch \u010dl\u00e1nk\u016f \u2013 pi\u0161te je do koment\u00e1\u0159\u016f, r\u00e1di odpov\u00edme.<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/crosstech\/blog\/443726\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0432\u0441\u0435 \u043f\u0440\u0435\u0438\u043c\u0443\u0449\u0435\u0441\u0442\u0432\u0430 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u044d\u043a\u0440\u0430\u043d\u043e\u0432 Palo Alto Networks, \u0432 \u0440\u0443\u043d\u0435\u0442\u0435 \u043d\u0435 \u0442\u0430\u043a \u043c\u043d\u043e\u0433\u043e \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u043e\u0432 \u043f\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u044d\u0442\u0438\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0442\u0435\u043a\u0441\u0442\u043e\u0432, \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u043e\u043f\u044b\u0442 \u0438\u0445 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f. \u041c\u044b \u0440\u0435\u0448\u0438\u043b\u0438 \u043e\u0431\u043e\u0431\u0449\u0438\u0442\u044c \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u044b, \u043d\u0430\u043a\u043e\u043f\u043b\u0435\u043d\u043d\u044b\u0435 \u0443 \u043d\u0430\u0441 \u0437\u0430 \u0432\u0440\u0435\u043c\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u044d\u0442\u043e\u0433\u043e \u0432\u0435\u043d\u0434\u043e\u0440\u0430 \u0438 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u0442\u044c \u043e\u0431 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u044f\u0445, \u0441 \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0432 \u0445\u043e\u0434\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432. \u0414\u043b\u044f \u0437\u043d\u0430\u043a\u043e\u043c\u0441\u0442\u0432\u0430 \u0441 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23965,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-32126","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0432\u0441\u0435 \u043f\u0440\u0435\u0438\u043c\u0443\u0449\u0435\u0441\u0442\u0432\u0430 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u044b\u0445.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/osobennosti-nastrojki-palo-alto-networks-ssl-vpn\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 Palo Alto Networks: SSL VPN | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0432\u0441\u0435 \u043f\u0440\u0435\u0438\u043c\u0443\u0449\u0435\u0441\u0442\u0432\u0430 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u044b\u0445.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/osobennosti-nastrojki-palo-alto-networks-ssl-vpn\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:45:18+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:45:18+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vlastnosti nastaven\u00ed Palo Alto Networks: SSL VPN | ProHoster","description":"Navzdory v\u0161em v\u00fdhod\u00e1m firewall\u016f.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/osobennosti-nastrojki-palo-alto-networks-ssl-vpn","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 Palo Alto Networks: SSL VPN | ProHoster","og:description":"\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0432\u0441\u0435 \u043f\u0440\u0435\u0438\u043c\u0443\u0449\u0435\u0441\u0442\u0432\u0430 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u044b\u0445.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/osobennosti-nastrojki-palo-alto-networks-ssl-vpn","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:45:18+00:00","article:modified_time":"2019-10-31T18:45:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"32126","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:27:18","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:04:40","updated":"2026-02-08 20:27:18","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/32126","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=32126"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/32126\/revisions"}],"predecessor-version":[{"id":157815,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/32126\/revisions\/157815"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/23965"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=32126"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=32126"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=32126"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}