{"id":39000,"date":"2019-10-31T22:27:16","date_gmt":"2019-10-31T19:27:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/shifruemsya-po-gostu-pamyatka-po-nastrojke-dinamicheskoj-marshrutizatsii-trafika\/"},"modified":"2019-10-31T22:27:16","modified_gmt":"2019-10-31T19:27:16","slug":"shifruemsya-po-gostu-pamyatka-po-nastrojke-dinamicheskoj-marshrutizatsii-trafika","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/shifruemsya-po-gostu-pamyatka-po-nastrojke-dinamicheskoj-marshrutizatsii-trafika","title":{"rendered":"\u0160ifrujeme podle GOSTu: p\u0159\u00edru\u010dka pro nastaven\u00ed dynamick\u00e9ho sm\u011brov\u00e1n\u00ed provozu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"\u0160ifrujeme podle GOSTu: p\u0159\u00edru\u010dka pro nastaven\u00ed dynamick\u00e9ho sm\u011brov\u00e1n\u00ed provozu\" src=\"\/wp-content\/uploads\/2019\/10\/ba9c77a9f71628300b6ac92c321065a3.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nPokud va\u0161e spole\u010dnost odes\u00edl\u00e1 nebo p\u0159ij\u00edm\u00e1 p\u0159es s\u00ed\u0165 osobn\u00ed \u00fadaje a dal\u0161\u00ed d\u016fv\u011brn\u00e9 informace, kter\u00e9 podl\u00e9haj\u00ed ochran\u011b podle z\u00e1kona, je nutn\u00e9 pou\u017e\u00edvat \u0161ifrov\u00e1n\u00ed podle GOST. Dnes v\u00e1m uk\u00e1\u017eeme, jak jsme implementovali takov\u00e9 \u0161ifrov\u00e1n\u00ed na z\u00e1klad\u011b kryptografick\u00e9 br\u00e1ny (KB) S-Terra u jednoho z na\u0161ich z\u00e1kazn\u00edk\u016f. Tento p\u0159\u00edb\u011bh bude zaj\u00edmav\u00fd pro specialisty na informa\u010dn\u00ed bezpe\u010dnost, stejn\u011b jako pro in\u017een\u00fdry, projektanty a architekty. V tomto p\u0159\u00edsp\u011bvku se nebudeme detailn\u011b zab\u00fdvat nuancemi technick\u00e9 konfigurace \u2014 soust\u0159ed\u00edme se na kl\u00ed\u010dov\u00e9 momenty z\u00e1kladn\u00edho nastaven\u00ed. Obrovsk\u00e9 mno\u017estv\u00ed dokumentace k nastaven\u00ed demon\u016f OS Linux, na kter\u00e9m je KB S-Terra zalo\u017eena, je voln\u011b dostupn\u00e9 na internetu. Dokumentace k nastaven\u00ed propriet\u00e1rn\u00edho softwaru S-Terra je tak\u00e9 k dispozici v otev\u0159en\u00e9m p\u0159\u00edstupu na <noindex><a rel=\"nofollow\" href=\"http:\/\/doc.s-terra.ru\/\">port\u00e1lu<\/a><\/noindex> webov\u00fdch str\u00e1nk\u00e1ch v\u00fdrobce.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>P\u00e1r slov o projektu <\/h2>\n<p>\nTopologie s\u00edt\u011b u z\u00e1kazn\u00edka byla standardn\u00ed \u2014 full mesh mezi centrem a pobo\u010dkami. Bylo pot\u0159eba implementovat \u0161ifrov\u00e1n\u00ed komunika\u010dn\u00edch kan\u00e1l\u016f mezi v\u0161emi lokalitami, kter\u00fdch bylo 8. <\/p>\n<p>Obvykle v podobn\u00fdch projektech je v\u0161echno statick\u00e9: na kryptografick\u00fdch br\u00e1n\u00e1ch (KB) se nastavuj\u00ed statick\u00e9 trasy do m\u00edstn\u00ed s\u00edt\u011b lokalit, zapisuj\u00ed se seznamy IP adres (ACL) pro \u0161ifrov\u00e1n\u00ed. V tomto p\u0159\u00edpad\u011b v\u0161ak nemaj\u00ed lokalit \u017e\u00e1dn\u00e9 centralizovan\u00e9 \u0159\u00edzen\u00ed, a v jejich m\u00edstn\u00edch s\u00edt\u00edch se m\u016f\u017ee d\u00edt cokoliv: s\u00edt\u011b mohou b\u00fdt p\u0159id\u00e1v\u00e1ny, odstra\u0148ov\u00e1ny a r\u016fzn\u011b modifikov\u00e1ny. Abychom se vyhnuli p\u0159enastavov\u00e1n\u00ed sm\u011brov\u00e1n\u00ed a ACL na KB p\u0159i zm\u011bn\u00e1ch adresace m\u00edstn\u00edch s\u00edt\u00ed na lokalit\u00e1ch, bylo rozhodnuto pou\u017e\u00edt GRE-tunneling a dynamick\u00e9 sm\u011brov\u00e1n\u00ed OSPF, do kter\u00e9ho jsou zahrnuty v\u0161echny KB a v\u011bt\u0161ina j\u00e1drov\u00fdch sm\u011brova\u010d\u016f s\u00edt\u011b na lokalit\u00e1ch (na n\u011bkter\u00fdch lokalit\u00e1ch preferovali spr\u00e1vci infrastruktury pou\u017e\u00edt SNAT sm\u011brem k KB na j\u00e1drov\u00fdch sm\u011brova\u010d\u00edch). <\/p>\n<p>GRE-tunneling umo\u017enilo vy\u0159e\u0161it dv\u011b \u00falohy:<br \/>\n<b>1.<\/b> Pou\u017e\u00edt v ACL pro \u0161ifrov\u00e1n\u00ed IP adresu extern\u00edho rozhran\u00ed KB, ve kter\u00e9m je inkapsulov\u00e1n ve\u0161ker\u00fd provoz sm\u011b\u0159uj\u00edc\u00ed na dal\u0161\u00ed lokalit.<br \/>\n<b>2.<\/b> Zorganizovat p-t-p tunely mezi KB, kter\u00e9 umo\u017e\u0148uj\u00ed nastavit dynamick\u00e9 sm\u011brov\u00e1n\u00ed (v na\u0161em p\u0159\u00edpad\u011b je mezi lokalitami organizov\u00e1no poskytovatelsk\u00e9 MPLS L3VPN).<\/p>\n<p>Klient objednal implementaci \u0161ifrov\u00e1n\u00ed jako slu\u017ebu. Jinak by musel nejen udr\u017eovat kryptop\u0159\u00edstupov\u00e9 br\u00e1ny nebo extern\u011b delegovat na n\u011bjakou organizaci, ale tak\u00e9 s\u00e1m sledovat \u017eivotn\u00ed cyklus \u0161ifrovac\u00edch certifik\u00e1t\u016f, v\u010das je obnovovat a instalovat nov\u00e9. <br \/>\n<img decoding=\"async\" alt=\"\u0160ifrujeme podle GOSTu: p\u0159\u00edru\u010dka pro nastaven\u00ed dynamick\u00e9ho sm\u011brov\u00e1n\u00ed provozu\" src=\"\/wp-content\/uploads\/2019\/10\/e6e172f0d615a2e7951f3951ec2d01fa.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nA nyn\u00ed vlastn\u00ed stru\u010dn\u00e1 p\u0159\u00edru\u010dka \u2013 jak a co jsme nastavovali<\/p>\n<h2>Subjektu KII k uv\u00e1\u017een\u00ed: nastavujeme kryptop\u0159\u00edstupovou br\u00e1nu <\/h2>\n<p><\/p>\n<h3>Z\u00e1kladn\u00ed nastaven\u00ed s\u00edt\u011b<\/h3>\n<p>\nP\u0159edev\u0161\u00edm spust\u00edme novou K\u0160 a dostaneme se do administra\u010dn\u00ed konzole. Za\u010d\u00edt bychom m\u011bli zm\u011bnou hesla vestav\u011bn\u00e9ho administr\u00e1tora \u2014 p\u0159\u00edkaz <b>change user password administrator<\/b>. Pot\u00e9 je t\u0159eba prov\u00e9st inicializa\u010dn\u00ed proceduru (p\u0159\u00edkaz <b>initialize<\/b>) b\u011bhem kter\u00e9 se zad\u00e1vaj\u00ed licen\u010dn\u00ed \u00fadaje a inicializuje gener\u00e1tor n\u00e1hodn\u00fdch \u010d\u00edsel (GNC).<\/p>\n<p><b><u>V\u0161imn\u011bte si!<\/u><\/b> P\u0159i inicializaci K\u0160 S-Terra se nastavuje bezpe\u010dnostn\u00ed politika, podle kter\u00e9 bezpe\u010dnostn\u00ed br\u00e1ny nepropou\u0161t\u011bj\u00ed pakety. Je nutn\u00e9 bu\u010f vytvo\u0159it vlastn\u00ed politiku, nebo pomoc\u00ed p\u0159\u00edkazu <b>run csconf_mgr activate<\/b> aktivovat p\u0159ednastavenou povolenou politiku.<br \/>\nD\u00e1le je t\u0159eba nastavit adresaci extern\u00edch a intern\u00edch rozhran\u00ed a tak\u00e9 v\u00fdchoz\u00ed trasu. Pr\u00e1ci s s\u00ed\u0165ovou konfigurac\u00ed K\u0160 a nastaven\u00ed \u0161ifrov\u00e1n\u00ed je l\u00e9pe prov\u00e1d\u011bt prost\u0159ednictv\u00edm konzole podobn\u00e9 Cisco. Tato konzole je ur\u010dena pro zad\u00e1v\u00e1n\u00ed p\u0159\u00edkaz\u016f podobn\u00fdch p\u0159\u00edkaz\u016fm Cisco IOS. Konfigurace vytvo\u0159en\u00e1 pomoc\u00ed konzole podobn\u00e9 Cisco je op\u011bt p\u0159ev\u00e1d\u011bna do odpov\u00eddaj\u00edc\u00edch konfigura\u010dn\u00edch soubor\u016f, se kter\u00fdmi pracuj\u00ed d\u00e9moni OS. Do konzole podobn\u00e9 Cisco se z administra\u010dn\u00ed konzole p\u0159ech\u00e1z\u00ed p\u0159\u00edkazem <b>konfigurovat<\/b>.<\/p>\n<p>Zm\u011b\u0148te hesla pro vestav\u011bn\u00e9ho u\u017eivatele cscons a enable: <\/p>\n<p>&gt;enable<br \/>\nHeslo: csp(p\u0159ednastaven\u00e9)<br \/>\n#configure terminal<br \/>\n#username cscons privilege 15 secret 0 #enable secret 0 \u041d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c \u0431\u0430\u0437\u043e\u0432\u0443\u044e \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e:<\/p>\n<p>#interface GigabitEthernet0\/0<br \/>\n#ip address 10.111.21.3 255.255.255.0<br \/>\n#no shutdown<br \/>\n#interface GigabitEthernet0\/1<br \/>\n#ip address 192.168.2.5 255.255.255.252<br \/>\n#no shutdown<br \/>\n#ip route 0.0.0.0 0.0.0.0 10.111.21.254<\/p>\n<h3>GRE<\/h3>\n<p>\nOpou\u0161t\u00edme konzolu podobnou Cisco a p\u0159ech\u00e1z\u00edme do debian shellu p\u0159\u00edkazem <b>syst\u00e9m<\/b>. Nastavujeme vlastn\u00ed heslo pro u\u017eivatele <b>root<\/b> p\u0159\u00edkazem <b>passwd<\/b>.<br \/>\nNa ka\u017ed\u00e9 K\u0160 se nastavuje samostatn\u00fd tunel pro ka\u017edou lokalitu. Nastaven\u00ed tunelov\u00e9ho rozhran\u00ed se prov\u00e1d\u00ed v souboru <b>\/etc\/network\/interfaces<\/b>. Za vytvo\u0159en\u00ed samotn\u00e9ho rozhran\u00ed odpov\u00edd\u00e1 utilita IP tunnel, kter\u00e1 je sou\u010d\u00e1st\u00ed p\u0159edinstalovan\u00e9ho bal\u00ed\u010dku iproute2. P\u0159\u00edkaz k vytvo\u0159en\u00ed rozhran\u00ed se zapisuje do volby pre-up.<\/p>\n<p>P\u0159\u00edklad konfigurace typick\u00e9ho tunelov\u00e9ho rozhran\u00ed:<br \/>\nauto site1<br \/>\niface site1 inet static<br \/>\naddress 192.168.1.4<br \/>\nnetmask 255.255.255.254<br \/>\npre-up ip tunnel add site1 mode gre local 10.111.21.3 remote 10.111.22.3 key hfLYEg^vCh6p<\/p>\n<p><b><u>V\u0161imn\u011bte si!<\/u><\/b> Je t\u0159eba poznamenat, \u017ee nastaven\u00ed tunelov\u00fdch rozhran\u00ed by m\u011blo b\u00fdt um\u00edst\u011bno mimo sekci <\/p>\n<p>###netifcfg-begin###<br \/>\n*****<br \/>\n###netifcfg-end###<\/p>\n<p>V opa\u010dn\u00e9m p\u0159\u00edpad\u011b budou tato nastaven\u00ed p\u0159eps\u00e1na p\u0159i zm\u011bn\u011b s\u00ed\u0165ov\u00fdch nastaven\u00ed fyzick\u00fdch rozhran\u00ed prost\u0159ednictv\u00edm konzole typu Cisco.<\/p>\n<h3>Dynamick\u00e9 sm\u011brov\u00e1n\u00ed<\/h3>\n<p>\nV S-Terra je dynamick\u00e9 sm\u011brov\u00e1n\u00ed realizov\u00e1no pomoc\u00ed bal\u00ed\u010dku program\u016f Quagga. Pro nastaven\u00ed OSPF budeme pot\u0159ebovat aktivaci a konfiguraci d\u00e9mon\u016f. <b>zebra<\/b> a <b>ospfd<\/b>. Demon zebra zaji\u0161\u0165uje interakci mezi sm\u011brovac\u00edmi d\u00e9mony a OS. Demon ospfd, jak jasn\u011b nazna\u010duje jeho n\u00e1zev, je zodpov\u011bdn\u00fd za realizaci protokolu OSPF.<br \/>\nKonfigurace OSPF se prov\u00e1d\u00ed bu\u010f prost\u0159ednictv\u00edm konzole d\u00e9mona, nebo p\u0159\u00edmo prost\u0159ednictv\u00edm konfigura\u010dn\u00edho souboru <b>\/etc\/quagga\/ospfd.conf<\/b>. Do souboru se p\u0159id\u00e1vaj\u00ed v\u0161echna fyzick\u00e1 a tunelov\u00e1 rozhran\u00ed \u00fa\u010dastn\u00edc\u00ed se dynamick\u00e9ho sm\u011brov\u00e1n\u00ed, stejn\u011b jako se vyhla\u0161uj\u00ed s\u00edt\u011b, kter\u00e9 budou ohl\u00e1\u0161eny a p\u0159ij\u00edmat ohl\u00e1\u0161en\u00ed.<\/p>\n<p>P\u0159\u00edklad konfigurace, kterou je t\u0159eba p\u0159idat do <b>ospfd.conf<\/b>:<br \/>\ninterface eth0<br \/>\n!<br \/>\ninterface eth1<br \/>\n!<br \/>\ninterface site1<br \/>\n!<br \/>\ninterface site2<br \/>\nrouter ospf<br \/>\n ospf router-id 192.168.2.21<br \/>\n network 192.168.1.4\/31 area 0.0.0.0<br \/>\n network 192.168.1.16\/31 area 0.0.0.0<br \/>\n network 192.168.2.4\/30 area 0.0.0.0<\/p>\n<p>V tomto p\u0159\u00edpad\u011b jsou adresy 192.168.1.x\/31 vyhrazeny pro tunelov\u00e9 ptp-s\u00edt\u011b mezi lokalitami, adresy 192.168.2.x\/30 jsou pro tranzitn\u00ed s\u00edt\u011b mezi K\u0160 a j\u00e1drov\u00fdmi sm\u011brova\u010di. <\/p>\n<p><u><b>V\u0161imn\u011bte si!<\/b><\/u> Pro zmen\u0161en\u00ed sm\u011brovac\u00ed tabulky ve velk\u00fdch instalac\u00edch lze filtrovat ohl\u00e1\u0161en\u00ed samotn\u00fdch tranzitn\u00edch s\u00edt\u00ed pomoc\u00ed konstrukc\u00ed <b>no redistribute connected<\/b> nebo <b>redistribute connected route-map<\/b>.<\/p>\n<p>Po nastaven\u00ed d\u00e9mon\u016f je nutn\u00e9 zm\u011bnit stav spu\u0161t\u011bn\u00ed d\u00e9mon\u016f v <b>\/etc\/quagga\/daemons<\/b>. V mo\u017enostech <b>zebra<\/b> a <b>ospfd<\/b> no zm\u011bnit na yes. Spustit d\u00e9mon quagga a nastavit jeho automatick\u00e9 spu\u0161t\u011bn\u00ed p\u0159i startu K\u0160 p\u0159\u00edkazem <b>update-rc.d quagga enable<\/b>.<\/p>\n<p>Pokud je nastaven\u00ed GRE-tunnel\u016f a OSPF provedeno spr\u00e1vn\u011b, m\u011bly by se na K\u0160 a j\u00e1drov\u00fdch sm\u011brova\u010d\u00edch objevit trasy do s\u00edt\u00ed ostatn\u00edch lokalit a t\u00edm vznik\u00e1 s\u00ed\u0165ov\u00e1 konektivita mezi m\u00edstn\u00edmi s\u00edt\u011bmi.<\/p>\n<h3>\u0160ifrujeme p\u0159en\u00e1\u0161en\u00fd provoz <\/h3>\n<p>\nJak bylo ji\u017e zm\u00edn\u011bno, p\u0159i \u0161ifrov\u00e1n\u00ed mezi za\u0159\u00edzen\u00edmi obvykle uv\u00e1d\u00edme rozsahy IP adres (ACL), mezi kter\u00fdmi se \u0161ifruje provoz: pokud zdrojov\u00e1 a c\u00edlov\u00e1 adresa spadaj\u00ed do t\u011bchto rozsah\u016f, provoz mezi nimi je \u0161ifrov\u00e1n. V tomto projektu je v\u0161ak struktura dynamick\u00e1 a adresy se mohou m\u011bnit. Zat\u00edmco jsme ji\u017e nastavili GRE tunelov\u00e1n\u00ed, m\u016f\u017eeme jako zdrojov\u00e9 a c\u00edlov\u00e9 adresy pro \u0161ifrov\u00e1n\u00ed provozu uv\u00e9st extern\u00ed adresy K\u0160 \u2014 nebo\u0165 \u0161ifrovan\u00fd provoz p\u0159ich\u00e1z\u00ed ji\u017e inkapsulovan\u00fd GRE protokolem. Jin\u00fdmi slovy, \u0161ifruje se v\u0161e, co p\u0159ich\u00e1z\u00ed do K\u0160 z lok\u00e1ln\u00ed s\u00edt\u011b jednoho za\u0159\u00edzen\u00ed sm\u011brem k s\u00edt\u00edm, kter\u00e9 ozn\u00e1mily jin\u00e1 za\u0159\u00edzen\u00ed. A ji\u017e uvnit\u0159 ka\u017ed\u00e9ho za\u0159\u00edzen\u00ed m\u016f\u017ee prob\u00edhat jak\u00e9koliv p\u0159esm\u011brov\u00e1n\u00ed. Tak\u017ee p\u0159i jak\u00e9koliv zm\u011bn\u011b lok\u00e1ln\u00edch s\u00edt\u00ed sta\u010d\u00ed, aby administr\u00e1tor upravil ozn\u00e1men\u00ed vych\u00e1zej\u00edc\u00ed z jeho s\u00edt\u011b sm\u011brem k K\u0160, a ta bude dostupn\u00e1 pro jin\u00e1 za\u0159\u00edzen\u00ed.<\/p>\n<p>\u0160ifrov\u00e1n\u00ed v K\u0160 S-Terra se prov\u00e1d\u00ed prost\u0159ednictv\u00edm protokolu IPSec. Pou\u017e\u00edv\u00e1me algoritmus \u201eKuzn\u011bc\u201c v souladu s GOST R 34.12-2015, a pro kompatibilitu se star\u0161\u00edmi verzemi m\u016f\u017ee b\u00fdt pou\u017eit GOST 28147-89. Autentizace se technicky m\u016f\u017ee prov\u00e1d\u011bt jak na p\u0159edem ur\u010den\u00fdch kl\u00ed\u010d\u00edch (PSK), tak na certifik\u00e1tech. Nicm\u00e9n\u011b v pr\u016fmyslov\u00e9m provozu je nutn\u00e9 pou\u017e\u00edvat certifik\u00e1ty vydan\u00e9 podle GOST R 34.10-2012.<\/p>\n<p>Pr\u00e1ce s certifik\u00e1ty, kontejnery a CRL se prov\u00e1d\u00ed pomoc\u00ed utilitky <b>cert_mgr<\/b>. Nejprve pomoc\u00ed p\u0159\u00edkazu <b>cert_mgr create<\/b> je nutn\u00e9 vytvo\u0159it kontejner uzav\u0159en\u00e9ho kl\u00ed\u010de a \u017e\u00e1dost o certifik\u00e1t, kter\u00e1 bude zasl\u00e1na do Centra pro spr\u00e1vu certifik\u00e1t\u016f. Po obdr\u017een\u00ed certifik\u00e1tu je nutn\u00e9 jej spole\u010dn\u011b s ko\u0159enov\u00fdm certifik\u00e1tem \u00daC a CRL (pokud se pou\u017e\u00edv\u00e1) importovat p\u0159\u00edkazem <b>cert_mgr import<\/b>. Ov\u011b\u0159it, \u017ee v\u0161echny certifik\u00e1ty a CRL byly nainstalov\u00e1ny, lze p\u0159\u00edkazem <b>cert_mgr show<\/b>.<\/p>\n<p>. Po \u00fasp\u011b\u0161n\u00e9 instalaci certifik\u00e1t\u016f p\u0159ejdeme do Cisco-like konzole pro nastaven\u00ed IPSec.<br \/>\nVytvo\u0159\u00edme IKE politiku, ve kter\u00e9 uvedeme po\u017eadovan\u00e9 algoritmy a parametry pro vytv\u00e1\u0159en\u00fd chr\u00e1n\u011bn\u00fd kan\u00e1l, kter\u00e9 budou nab\u00eddnuty partnerovi pro dohodu. <\/p>\n<p>#crypto isakmp policy 1000<br \/>\n#encr gost341215k<br \/>\n#hash gost341112-512-tc26<br \/>\n#authentication sign<br \/>\n#group vko2<br \/>\n#lifetime 3600<\/p>\n<p>Tato politika se uplat\u0148uje p\u0159i vytv\u00e1\u0159en\u00ed prvn\u00ed f\u00e1ze IPSec. V\u00fdsledkem \u00fasp\u011b\u0161n\u00e9ho dokon\u010den\u00ed prvn\u00ed f\u00e1ze je ustanoven\u00ed SA (Security Association).<br \/>\nD\u00e1le je pot\u0159eba ur\u010dit seznam zdrojov\u00fdch a c\u00edlov\u00fdch IP adres (ACL) pro \u0161ifrov\u00e1n\u00ed, vytvo\u0159it sadu transformac\u00ed (transform set), vytvo\u0159it kryptografickou mapu (crypto map) a p\u0159ipojit ji k extern\u00edmu rozhran\u00ed K\u0160. <\/p>\n<p>Nastavujeme ACL:<br \/>\n#ip access-list extended site1<br \/>\n#permit gre host 10.111.21.3 host 10.111.22.3<\/p>\n<p>Sada transformac\u00ed (stejn\u011b jako v prvn\u00ed f\u00e1zi pou\u017eijeme \u0161ifrovac\u00ed algoritmus \u201eKuzn\u011b\u010dek\u201c s pou\u017e\u00edv\u00e1n\u00edm re\u017eimu v\u00fdstupu imitace):<\/p>\n<p>#crypto ipsec transform-set GOST esp-gost341215k-mac<\/p>\n<p>Vytv\u00e1\u0159\u00edme kryptomapu, specifikujeme ACL, transform set a adresu peer:<\/p>\n<p>#crypto map MAIN 100 ipsec-isakmp<br \/>\n#match address site1<br \/>\n#set transform-set GOST<br \/>\n#set peer 10.111.22.3<\/p>\n<p>P\u0159ipojujeme kryptomapu k extern\u00edmu rozhran\u00ed K\u0160:<\/p>\n<p>#interface GigabitEthernet0\/0<br \/>\n#ip address 10.111.21.3 255.255.255.0<br \/>\n#crypto map MAIN<\/p>\n<p>Pro \u0161ifrov\u00e1n\u00ed kan\u00e1l\u016f s jin\u00fdmi lokalitami je nutn\u00e9 zopakovat proceduru vytv\u00e1\u0159en\u00ed ACL a kryptomapy, p\u0159i\u010dem\u017e se zm\u011bn\u00ed n\u00e1zev ACL, IP adresy a \u010d\u00edslo kryptomapy.<\/p>\n<p><b><u>V\u0161imn\u011bte si! <\/u><\/b>V p\u0159\u00edpad\u011b, \u017ee se neprov\u00e1d\u00ed kontrola certifik\u00e1t\u016f pomoc\u00ed CRL, je nutn\u00e9 to explicitn\u011b uv\u00e9st:<\/p>\n<p>#crypto pki trustpoint s-terra_technological_trustpoint<br \/>\n#revocation-check none<\/p>\n<p>T\u00edmto lze pova\u017eovat konfiguraci za dokon\u010denou. V v\u00fdstupu p\u0159\u00edkaz\u016f konzole Cisco-like <b>show crypto isakmp sa<\/b> a <b>show crypto ipsec sa<\/b> by m\u011bly b\u00fdt uvedeny vybudovan\u00e9 prvn\u00ed a druh\u00e9 f\u00e1ze IPSec. Tyto informace lze tak\u00e9 z\u00edskat pomoc\u00ed p\u0159\u00edkazu <b>sa_mgr show<\/b>, proveden\u00e9ho z debian shellu. V v\u00fdstupu p\u0159\u00edkazu <b>cert_mgr show<\/b> by m\u011bly b\u00fdt zobrazeny certifik\u00e1ty vzd\u00e1len\u00fdch lokalit. Stav t\u011bchto certifik\u00e1t\u016f bude <b>remote<\/b>. V p\u0159\u00edpad\u011b, \u017ee tunely nejsou vybudov\u00e1ny, je t\u0159eba se pod\u00edvat do logu <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/cs\/vpn\/\"   title=\"VPN\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"51\">VPN<\/a>-slu\u017eby, kter\u00fd je ulo\u017een v souboru <b>\/var\/log\/cspvpngate.log<\/b>. Kompletn\u00ed seznam logovac\u00edch soubor\u016f s popisem jejich obsahu je uveden v dokumentaci.<\/p>\n<h2>Sledujeme \"zdrav\u00ed\" syst\u00e9mu<\/h2>\n<p>\nV K\u0160 S-Terra se pro monitorov\u00e1n\u00ed pou\u017e\u00edv\u00e1 standardn\u00ed d\u00e9mon snmpd. Krom\u011b obvykl\u00fdch parametr\u016f pro Linux S-Terra \u201eout of the box\u201c podporuje poskytov\u00e1n\u00ed \u00fadaj\u016f o IPSec tunelech podle CISCO-IPSEC-FLOW-MONITOR-MIB, co\u017e pou\u017e\u00edv\u00e1me pro sledov\u00e1n\u00ed stavu IPSec tunel\u016f. Tak\u00e9 je podporov\u00e1na funk\u010dnost vlastn\u00edch OID, kter\u00e9 poskytuj\u00ed jako hodnoty v\u00fdsledky prov\u00e1d\u011bn\u00ed skriptu. Tato mo\u017enost n\u00e1m umo\u017e\u0148uje sledovat term\u00edny vypr\u0161en\u00ed platnosti certifik\u00e1t\u016f. Napsan\u00fd skript parsuje v\u00fdstup p\u0159\u00edkazu <b>cert_mgr show<\/b> a v d\u016fsledku toho vrac\u00ed po\u010det dn\u00ed do vypr\u0161en\u00ed platnosti m\u00edstn\u00edho a ko\u0159enov\u00e9ho certifik\u00e1tu. Tento p\u0159\u00edstup je nezbytn\u00fd p\u0159i spr\u00e1v\u011b velk\u00e9ho po\u010dtu K\u0160.<br \/>\n<img decoding=\"async\" alt=\"\u0160ifrujeme podle GOSTu: p\u0159\u00edru\u010dka pro nastaven\u00ed dynamick\u00e9ho sm\u011brov\u00e1n\u00ed provozu\" src=\"\/wp-content\/uploads\/2019\/10\/bbc2d40ea1ccfdd5215c8fb29affcefe.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>V \u010dem je smysl takov\u00e9ho \u0161ifrov\u00e1n\u00ed<\/h2>\n<p>\nVe\u0161ker\u00e1 v\u00fd\u0161e popsan\u00e1 funkcionalita je podporov\u00e1na \u201ez krabice\u201c K\u0160 S-Terra. To znamen\u00e1, \u017ee nebylo pot\u0159eba instalovat \u017e\u00e1dn\u00e9 dal\u0161\u00ed moduly, kter\u00e9 by mohly ovlivnit certifikaci kryptogateway a atestaci cel\u00e9ho informa\u010dn\u00edho syst\u00e9mu. Kan\u00e1ly mezi platformami mohou b\u00fdt jak\u00e9koli, klidn\u011b p\u0159es internet. <\/p>\n<p>D\u00edky tomu, \u017ee p\u0159i zm\u011bn\u011b vnit\u0159n\u00ed infrastruktury nen\u00ed pot\u0159eba p\u0159eprogramov\u00e1vat kryptogateway, <b>syst\u00e9m funguje jako slu\u017eba<\/b>, co\u017e je velmi pohodln\u00e9 pro z\u00e1kazn\u00edka: sv\u00e9 slu\u017eby (klientsk\u00e9 i serverov\u00e9) m\u016f\u017ee umis\u0165ovat na jak\u00e9koli adresy a v\u0161echny zm\u011bny se dynamicky p\u0159enesou mezi \u0161ifrovac\u00edm vybaven\u00edm. <\/p>\n<p>Nejist\u011b, \u0161ifrov\u00e1n\u00ed d\u00edky p\u0159\u00eddavn\u00fdm n\u00e1klad\u016fm (overhead) ovliv\u0148uje rychlost p\u0159enosu dat, ale zanedbateln\u011b \u2013 propustnost kan\u00e1lu m\u016f\u017ee klesnout maxim\u00e1ln\u011b o 5\u201310 %. Tato technologie byla testov\u00e1na a uk\u00e1zala dobr\u00e9 v\u00fdsledky i na satelitn\u00edch kan\u00e1lech, kter\u00e9 jsou pom\u011brn\u011b nestabiln\u00ed a maj\u00ed n\u00edzkou propustnost. <\/p>\n<p><i>Igor Vinokhodov, in\u017een\u00fdr 2. linie administrace \u201eRostelecom-Solar\u201c<\/i><br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/solarsecurity\/blog\/471470\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0415\u0441\u043b\u0438 \u0432\u0430\u0448\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u0435\u0440\u0435\u0434\u0430\u0451\u0442 \u0438\u043b\u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u043f\u043e \u0441\u0435\u0442\u0438 \u043f\u0435\u0440\u0441\u0434\u0430\u043d\u043d\u044b\u0435 \u0438 \u0434\u0440\u0443\u0433\u0443\u044e \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e, \u043f\u043e\u0434\u043b\u0435\u0436\u0430\u0449\u0443\u044e \u0437\u0430\u0449\u0438\u0442\u0435 \u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0438 \u0441 \u0437\u0430\u043a\u043e\u043d\u043e\u0434\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e\u043c, \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e \u0413\u041e\u0421\u0422\u0443. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0435\u043c, \u043a\u0430\u043a \u0432\u043d\u0435\u0434\u0440\u0438\u043b\u0438 \u0442\u0430\u043a\u043e\u0435 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0430 \u0431\u0430\u0437\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0448\u043b\u044e\u0437\u0430 (\u041a\u0428) S-Terra \u0443 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u043e\u0432. \u042d\u0442\u0430 \u0438\u0441\u0442\u043e\u0440\u0438\u044f \u0431\u0443\u0434\u0435\u0442 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0430 \u0418\u0411-\u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0430\u043c, \u043f\u0440\u043e\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0430\u043c \u0438 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u043e\u0440\u0430\u043c. \u0413\u043b\u0443\u0431\u043e\u043a\u043e \u043f\u043e\u0433\u0440\u0443\u0436\u0430\u0442\u044c\u0441\u044f \u0432 \u043d\u044e\u0430\u043d\u0441\u044b [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":29260,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-39000","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0415\u0441\u043b\u0438 \u0432\u0430\u0448\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/shifruemsya-po-gostu-pamyatka-po-nastrojke-dinamicheskoj-marshrutizatsii-trafika\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0428\u0438\u0444\u0440\u0443\u0435\u043c\u0441\u044f \u043f\u043e \u0413\u041e\u0421\u0422\u0443: \u043f\u0430\u043c\u044f\u0442\u043a\u0430 \u043f\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0415\u0441\u043b\u0438 \u0432\u0430\u0448\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/shifruemsya-po-gostu-pamyatka-po-nastrojke-dinamicheskoj-marshrutizatsii-trafika\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:27:16+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:27:16+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u0160ifrujeme podle GOSTu: p\u0159\u00edru\u010dka pro nastaven\u00ed dynamick\u00e9ho sm\u011brov\u00e1n\u00ed provozu | ProHoster","description":"Pokud va\u0161e spole\u010dnost.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/shifruemsya-po-gostu-pamyatka-po-nastrojke-dinamicheskoj-marshrutizatsii-trafika","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0428\u0438\u0444\u0440\u0443\u0435\u043c\u0441\u044f \u043f\u043e \u0413\u041e\u0421\u0422\u0443: \u043f\u0430\u043c\u044f\u0442\u043a\u0430 \u043f\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 | ProHoster","og:description":"\u0415\u0441\u043b\u0438 \u0432\u0430\u0448\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/shifruemsya-po-gostu-pamyatka-po-nastrojke-dinamicheskoj-marshrutizatsii-trafika","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:27:16+00:00","article:modified_time":"2019-10-31T19:27:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"39000","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-04 15:17:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:58:40","updated":"2026-02-04 15:17:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/39000","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=39000"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/39000\/revisions"}],"predecessor-version":[{"id":156680,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/39000\/revisions\/156680"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/29260"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=39000"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=39000"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=39000"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}