{"id":89739,"date":"2020-07-26T01:42:18","date_gmt":"2020-07-25T23:42:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/2-ngfw-dlya-malogo-biznesa-raspakovka-i-nastrojka"},"modified":"2020-07-26T01:42:18","modified_gmt":"2020-07-25T23:42:18","slug":"2-ngfw-dlya-malogo-biznesa-raspakovka-i-nastrojka","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/2-ngfw-dlya-malogo-biznesa-raspakovka-i-nastrojka","title":{"rendered":"2. NGFW pro mal\u00e9 firmy. Rozbalen\u00ed a nastaven\u00ed","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"2. NGFW pro mal\u00e9 firmy. Rozbalen\u00ed a nastaven\u00ed\" src=\"\/wp-content\/uploads\/2020\/07\/b17e2b30240cfa92fa78ac24dbd126e2.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>Pokra\u010dujeme v cyklu \u010dl\u00e1nk\u016f o pr\u00e1ci s novou modelovou \u0159adou SMB CheckPoint, p\u0159ipom\u00edn\u00e1me, \u017ee v <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/510342\/\">prvn\u00ed \u010d\u00e1sti<\/a><\/noindex> jsme popisovali vlastnosti a mo\u017enosti nov\u00fdch model\u016f, zp\u016fsoby spr\u00e1vy a administrace. Dnes se pod\u00edv\u00e1me na sc\u00e9n\u00e1\u0159 nasazen\u00ed nejv\u00fdkonn\u011bj\u0161\u00edho modelu s\u00e9rie: CheckPoint 1590 NGFW. P\u0159ilo\u017e\u00edme stru\u010dn\u00e9 shrnut\u00ed t\u00e9to \u010d\u00e1sti:<\/p>\n<p><\/p>\n<ol>\n<li>Rozbalen\u00ed za\u0159\u00edzen\u00ed (popis komponent\u016f, fyzick\u00e9 a s\u00ed\u0165ov\u00e9 p\u0159ipojen\u00ed).<\/li>\n<li>Prvotn\u00ed inicializace za\u0159\u00edzen\u00ed.<\/li>\n<li>Prvotn\u00ed nastaven\u00ed.<\/li>\n<li>Hodnocen\u00ed funk\u010dnosti. <\/li>\n<\/ol>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Rozbalen\u00ed za\u0159\u00edzen\u00ed<\/h2>\n<p><\/p>\n<p>Sezn\u00e1men\u00ed s vybaven\u00edm za\u010d\u00edn\u00e1 vyjmut\u00edm za\u0159\u00edzen\u00ed z krabice, rozebr\u00e1n\u00edm komponent\u016f a instalac\u00ed d\u00edl\u016f, klikn\u011bte na spoiler, kde je stru\u010dn\u011b prezentov\u00e1n proces<\/p>\n<p><\/p>\n<p>                        <b class=\"spoiler_title\">Dod\u00e1vka NGFW 1590<\/b><br \/>\n                        <img decoding=\"async\" alt=\"2. NGFW pro mal\u00e9 firmy. Rozbalen\u00ed a nastaven\u00ed\" src=\"\/wp-content\/uploads\/2020\/07\/868d20466d642d38d748058e9f33ae37.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p> Stru\u010dn\u011b o komponent\u00e1ch:<\/p>\n<p><\/p>\n<ul>\n<li>NGFW 1590;<\/li>\n<li>Nap\u00e1jec\u00ed adapt\u00e9r;<\/li>\n<li>2 Wifi ant\u00e9ny (2.4 GHz a 5 GHz);<\/li>\n<li>2 LTE ant\u00e9ny;<\/li>\n<li>Bro\u017eury s dokumentac\u00ed (stru\u010dn\u00fd pr\u016fvodce po\u010d\u00e1te\u010dn\u00edm p\u0159ipojen\u00edm, licen\u010dn\u00ed smlouva atd.)<\/li>\n<\/ul>\n<p>\nCo se t\u00fd\u010de s\u00ed\u0165ov\u00fdch port\u016f a rozhran\u00ed, zde jsou v\u0161echny modern\u00ed mo\u017enosti pro p\u0159enos dat a interakci, samostatn\u011b vy\u010dlen\u011bn port pro DMZ z\u00f3nu, USB 3.0 pro synchronizaci s PC. <\/p>\n<p>\n<img decoding=\"async\" alt=\"2. NGFW pro mal\u00e9 firmy. Rozbalen\u00ed a nastaven\u00ed\" src=\"\/wp-content\/uploads\/2020\/07\/de1442162762a4c29dcff0d2badfcc3f.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>Verze 1590 z\u00edskala modernizovan\u00fd design, modern\u00ed mo\u017enosti pro bezdr\u00e1tov\u00e9 p\u0159ipojen\u00ed a roz\u0161\u00ed\u0159en\u00ed pam\u011bti: 2 sloty pro Micro\/Nano SIM v LTE re\u017eimu. (O t\u00e9to mo\u017enosti pl\u00e1nujeme podrobn\u011b ps\u00e1t v jednom z na\u0161ich dal\u0161\u00edch \u010dl\u00e1nk\u016f cyklu v\u011bnovan\u00e9ho bezdr\u00e1tov\u00fdm p\u0159ipojen\u00edm); slot pro SD kartu.\n<\/p>\n<p><\/p>\n<p>Podrobn\u011b o mo\u017enostech 1590 NGFW a o dal\u0161\u00edch nov\u00fdch modelech si m\u016f\u017eete p\u0159e\u010d\u00edst v <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/510342\/\">1. \u010d\u00e1sti<\/a><\/noindex> cyklu \u010dl\u00e1nk\u016f o \u0159e\u0161en\u00edch SMB CheckPoint. Nyn\u00ed se pust\u00edme do prvotn\u00ed inicializace za\u0159\u00edzen\u00ed. \n<\/p>\n<p><\/p>\n<h2>Prvotn\u00ed inicializace<\/h2>\n<p><\/p>\n<p>Na\u0161i st\u00e1l\u00ed \u010dten\u00e1\u0159i by m\u011bli ji\u017e v\u011bd\u011bt, \u017ee v \u0159ad\u011b 1500 s\u00e9rie SMB se pou\u017e\u00edv\u00e1 nov\u00fd OS 80.20 Embedded, kter\u00fd obsahuje aktualizovan\u00e9 rozhran\u00ed a vylep\u0161en\u00e9 mo\u017enosti.\n<\/p>\n<p><\/p>\n<p>Aby bylo mo\u017en\u00e9 za\u010d\u00edt inicializaci za\u0159\u00edzen\u00ed, je t\u0159eba:\n<\/p>\n<p><\/p>\n<ol>\n<li>Zajistit nap\u00e1jen\u00ed pro br\u00e1nu. <\/li>\n<li>P\u0159ipojit s\u00ed\u0165ov\u00fd kabel od va\u0161eho PC do LAN -1 na br\u00e1n\u011b.<\/li>\n<li>Voliteln\u011b m\u016f\u017eete za\u0159\u00edzen\u00ed hned p\u0159ipojit k internetu, pokud p\u0159ipoj\u00edte rozhran\u00ed do portu WAN.<\/li>\n<li>P\u0159ejd\u011bte na port\u00e1l Gaia Embedded: <noindex><a rel=\"nofollow\" href=\"https:\/\/192.168.1.1:4434\/\">https:\/\/192.168.1.1:4434\/<\/a><\/noindex><\/li>\n<\/ol>\n<p><\/p>\n<p>Pokud byly spln\u011bny d\u0159\u00edve uveden\u00e9 kroky, po p\u0159echodu na str\u00e1nku port\u00e1lu Gaia budete muset potvrdit otev\u0159en\u00ed str\u00e1nky s ned\u016fv\u011bryhodn\u00fdm certifik\u00e1tem, po \u010dem\u017e se spust\u00ed pr\u016fvodce nastaven\u00edm port\u00e1lu:\n<\/p>\n<p>\n<img decoding=\"async\" alt=\"2. NGFW pro mal\u00e9 firmy. Rozbalen\u00ed a nastaven\u00ed\" src=\"\/wp-content\/uploads\/2020\/07\/0f9c59f8aee0b0cb4e402ab6478ecb39.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>Budete uv\u00edt\u00e1ni str\u00e1nkou s n\u00e1zvem modelu va\u0161eho za\u0159\u00edzen\u00ed, je t\u0159eba p\u0159ej\u00edt do dal\u0161\u00ed sekce:\n<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pro mal\u00e9 firmy. Rozbalen\u00ed a nastaven\u00ed\" src=\"\/wp-content\/uploads\/2020\/07\/802a2d07d265f205ed7f4c289d7c83ac.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>Nab\u00eddnou n\u00e1m vytvo\u0159it \u00fa\u010det pro autentizaci, m\u00e1me mo\u017enost nastavit p\u0159\u00edsn\u00e9 po\u017eadavky na heslo pro administr\u00e1tora a uv\u00e9st zemi, v n\u00ed\u017e budeme pou\u017e\u00edvat br\u00e1nu.\n<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pro mal\u00e9 firmy. Rozbalen\u00ed a nastaven\u00ed\" src=\"\/wp-content\/uploads\/2020\/07\/7a1c641cb3425b35a403e97b3aca2d9c.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>Dal\u0161\u00ed okno se t\u00fdk\u00e1 nastaven\u00ed data a \u010dasu, m\u00e1me mo\u017enost nastavit ru\u010dn\u011b nebo pou\u017e\u00edt NTP server spole\u010dnosti.\n<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pro mal\u00e9 firmy. Rozbalen\u00ed a nastaven\u00ed\" src=\"\/wp-content\/uploads\/2020\/07\/b1162711e3f1e73e4bb7090eccbfde84.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>Dal\u0161\u00edm krokem je nastaven\u00ed n\u00e1zvu za\u0159\u00edzen\u00ed a uveden\u00ed dom\u00e9ny spole\u010dnosti pro spr\u00e1vnou funk\u010dnost slu\u017eeb br\u00e1ny na internetu.\n<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pro mal\u00e9 firmy. Rozbalen\u00ed a nastaven\u00ed\" src=\"\/wp-content\/uploads\/2020\/07\/5bc4e62401fa71b6e2f42550f3c88965.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>Dal\u0161\u00ed krok se t\u00fdk\u00e1 volby typu spr\u00e1vy NGFW, zde je t\u0159eba poznamenat:<\/p>\n<p><\/p>\n<ol>\n<li>Lok\u00e1ln\u00ed spr\u00e1va. Tento dostupn\u00fd zp\u016fsob lok\u00e1ln\u00ed spr\u00e1vy br\u00e1ny pomoc\u00ed webov\u00e9 str\u00e1nky Gaia Portal.<\/li>\n<li>Centr\u00e1ln\u00ed spr\u00e1va. Tento typ spr\u00e1vy zahrnuje synchronizaci s dedikovan\u00fdm management serverem CheckPoint, synchronizaci s cloudem Smart1-Cloud nebo se SMP (slu\u017eba spr\u00e1vy pro SMB).<\/li>\n<\/ol>\n<p><\/p>\n<p>V r\u00e1mci tohoto \u010dl\u00e1nku se zam\u011b\u0159\u00edme na zp\u016fsob spr\u00e1vy Lok\u00e1ln\u00ed spr\u00e1vy, m\u016f\u017eete zvolit metodu, kter\u00e1 je pot\u0159ebn\u00e1. Pro sezn\u00e1men\u00ed se s procesem synchronizace s dedikovan\u00fdm Management Serverem je navr\u017eeno <noindex><a rel=\"nofollow\" href=\"https:\/\/www.youtube.com\/watch?v=v5SugzYFBhE&amp;list=PLqio-3dnMW5_2cStMfIezwcAzzDCjX86C&amp;index=7\"> odkaz<\/a><\/noindex> z v\u00fdukov\u00e9ho cyklu CheckPoint Getting Started, p\u0159ipraven\u00e9ho spole\u010dnost\u00ed TS Solution. \n<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pro mal\u00e9 firmy. Rozbalen\u00ed a nastaven\u00ed\" src=\"\/wp-content\/uploads\/2020\/07\/c39e8ede7b45aecc40adf83dc32f0bc6.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>N\u00e1sledn\u011b se objev\u00ed okno s definic\u00ed re\u017eimu provozu rozhran\u00ed na br\u00e1n\u011b:\n<\/p>\n<p><\/p>\n<ul>\n<li>Re\u017eim Switch zahrnuje dostupnost pods\u00edt\u011b z jednoho rozhran\u00ed do pods\u00edt\u011b druh\u00e9ho rozhran\u00ed. <\/li>\n<li>Re\u017eim Disable Switch odpov\u00edd\u00e1 vypnut\u00ed re\u017eimu Switch, ka\u017ed\u00fd port sm\u011bruje provoz jako pro jednotliv\u00fd fragment s\u00edt\u011b.<\/li>\n<\/ul>\n<p><\/p>\n<p>Je tak\u00e9 navr\u017eeno nastavit pool DHCP adres, kter\u00e9 budou pou\u017e\u00edv\u00e1ny p\u0159i p\u0159ipojen\u00ed k m\u00edstn\u00edm rozhran\u00edm br\u00e1ny.\n<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pro mal\u00e9 firmy. Rozbalen\u00ed a nastaven\u00ed\" src=\"\/wp-content\/uploads\/2020\/07\/d0a03e50f8b138e0518af07d9f6671a2.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>Dal\u0161\u00edm krokem je nastaven\u00ed provozu br\u00e1ny v bezdr\u00e1tov\u00e9m re\u017eimu, tento aspekt podrobn\u011bji probereme v jednom \u010dl\u00e1nku cyklu, proto jsme konfiguraci nastaven\u00ed odlo\u017eili. M\u016f\u017eete v\u0161ak vytvo\u0159it nov\u00fd bezdr\u00e1tov\u00fd p\u0159\u00edstupov\u00fd bod, nastavit heslo pro p\u0159ipojen\u00ed k n\u011bmu a ur\u010dit re\u017eim provozu bezdr\u00e1tov\u00e9ho kan\u00e1lu (2,4 GHz nebo 5 GHz).\n<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pro mal\u00e9 firmy. Rozbalen\u00ed a nastaven\u00ed\" src=\"\/wp-content\/uploads\/2020\/07\/5039a036b3645b1d02d39835c6c107c4.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>N\u00e1sleduj\u00edc\u00ed krok se t\u00fdk\u00e1 nastaven\u00ed p\u0159\u00edstupu k br\u00e1n\u011b pro administr\u00e1tory spole\u010dnosti. P\u0159\u00edstupov\u00e1 pr\u00e1va jsou ve v\u00fdchoz\u00edm nastaven\u00ed povolena, pokud je p\u0159ipojen\u00ed prov\u00e1d\u011bno z:<\/p>\n<p><\/p>\n<ol>\n<li>Intern\u00ed s\u00edt\u011b spole\u010dnosti <\/li>\n<li>D\u016fv\u011bryhodn\u00e9 bezdr\u00e1tov\u00e9 s\u00edt\u011b <\/li>\n<li>VPN tunelu<\/li>\n<\/ol>\n<p><\/p>\n<p>Mo\u017enost p\u0159ipojen\u00ed k br\u00e1n\u011b p\u0159es Internet je ve v\u00fdchoz\u00edm nastaven\u00ed vypnuta, nese to velk\u00e1 rizika a m\u011blo by b\u00fdt od\u016fvodn\u011bno jej\u00ed zapnut\u00ed, jinak se doporu\u010duje ponechat to jako v na\u0161em p\u0159\u00edkladu. Je tak\u00e9 mo\u017en\u00e9 specifikovat, kter\u00e9 konkr\u00e9tn\u00ed IP adresy budou povoleny pro p\u0159ipojen\u00ed k br\u00e1n\u011b.<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pro mal\u00e9 firmy. Rozbalen\u00ed a nastaven\u00ed\" src=\"\/wp-content\/uploads\/2020\/07\/b3bd7f25aeb71b75392595f7efad22b6.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>Dal\u0161\u00ed okno se t\u00fdk\u00e1 aktivace licenc\u00ed, p\u0159i prvotn\u00ed inicializaci za\u0159\u00edzen\u00ed v\u00e1m bude nab\u00eddnuto 30denn\u00ed zku\u0161ebn\u00ed obdob\u00ed. Existuj\u00ed dva dostupn\u00e9 zp\u016fsoby aktivace: <\/p>\n<p><\/p>\n<ol>\n<li> Pokud je k dispozici p\u0159ipojen\u00ed k Internetu, licence se aktivuje automaticky.<\/li>\n<li> Pokud aktivujete licenci offline, je nutn\u00e9 prov\u00e9st n\u00e1sleduj\u00edc\u00ed: st\u00e1hnout licenci z UserCenter a zaregistrovat va\u0161e za\u0159\u00edzen\u00ed na speci\u00e1ln\u00edm <noindex><a rel=\"nofollow\" href=\"https:\/\/smbregistration.checkpoint.com\">port\u00e1lu<\/a><\/noindex>. Pot\u00e9 budete v obou p\u0159\u00edpadech muset manu\u00e1ln\u011b importovat sta\u017eenou licenci.<\/li>\n<\/ol>\n<p><img decoding=\"async\" alt=\"2. NGFW pro mal\u00e9 firmy. Rozbalen\u00ed a nastaven\u00ed\" src=\"\/wp-content\/uploads\/2020\/07\/e0eb47e8dab7d4ece07e0e44a6e4bd35.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>Nakonec posledn\u00ed okno v pr\u016fvodci nastaven\u00edm nab\u00edz\u00ed vybrat aktivovan\u00e9 bledy, p\u0159i\u010dem\u017e bled QOS se aktivuje pouze po prvotn\u00ed inicializaci. V z\u00e1v\u011bru byste m\u011bli obdr\u017eet okno s dokon\u010den\u00edm, kter\u00e9 shrnuje va\u0161e nastaven\u00ed.<\/p>\n<h2>Prvn\u00ed nastaven\u00ed<\/h2>\n<p><\/p>\n<p> Nejprve doporu\u010dujeme zkontrolovat stav licenc\u00ed, od toho bude z\u00e1viset dal\u0161\u00ed nastaven\u00ed. P\u0159ejd\u011bte na kartu \"HOME\" \u2192 \"License\":<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pro mal\u00e9 firmy. Rozbalen\u00ed a nastaven\u00ed\" src=\"\/wp-content\/uploads\/2020\/07\/ffafde17f0545d500176d8ba8a82ec65.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>Pokud jsou licence aktivovan\u00e9, doporu\u010dujeme ihned prov\u00e9st aktualizaci na nejnov\u011bj\u0161\u00ed aktu\u00e1ln\u00ed firmware. K tomu p\u0159ejd\u011bte na kartu \"DEVICE\" \u2192 \"System Operations\":<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pro mal\u00e9 firmy. Rozbalen\u00ed a nastaven\u00ed\" src=\"\/wp-content\/uploads\/2020\/07\/ba7484d0e39800db7a122c3dda5db6b1.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>Aktualizace syst\u00e9mu se nach\u00e1z\u00ed v polo\u017ece Firmware Upgrade. V na\u0161em p\u0159\u00edpad\u011b je nainstalov\u00e1na aktu\u00e1ln\u00ed a posledn\u00ed verze firmwaru.\n<\/p>\n<p><\/p>\n<p>N\u00e1sledn\u011b bych r\u00e1d stru\u010dn\u011b hovo\u0159il o mo\u017enostech a nastaven\u00edch bled\u016f syst\u00e9mu. Logicky je mo\u017en\u00e9 je rozd\u011blit na politiky \u00farovn\u011b Access (Firewall, Application Control, URL Filtering) a Threat Prevention (IPS, Antivirus, Anti-Bot, Threat Emulation).<\/p>\n<p><\/p>\n<p>P\u0159ejdeme na kartu Access Policy \u2192 Blade Control:<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pro mal\u00e9 firmy. Rozbalen\u00ed a nastaven\u00ed\" src=\"\/wp-content\/uploads\/2020\/07\/381db11e773c4a61d30df502f6a0abb0.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>Ve v\u00fdchoz\u00edm nastaven\u00ed je pou\u017eit re\u017eim STANDARD, kter\u00fd povoluje: odchoz\u00ed provoz na Internet, provoz v r\u00e1mci lok\u00e1ln\u00ed s\u00edt\u011b, ale blokuje p\u0159\u00edchoz\u00ed provoz z Internetu.\n<\/p>\n<p><\/p>\n<p>Pokud jde o blade APPLICATIONS &amp; URL FILTERING, je v\u00fdchoz\u00ed nastaven\u00ed zablokov\u00e1n\u00ed web\u016f s vysokou \u00farovn\u00ed nebezpe\u010d\u00ed a zablokov\u00e1n\u00ed aplikac\u00ed pro sd\u00edlen\u00ed (Torrent, File Storage atd.). D\u00e1le je mo\u017en\u00e9 manu\u00e1ln\u011b blokovat kategorie web\u016f.<\/p>\n<p><\/p>\n<p>Upozor\u0148ujeme na mo\u017enost pro u\u017eivatelsk\u00fd provoz \u201eOmezit aplikace spot\u0159ebov\u00e1vaj\u00edc\u00ed \u0161\u00ed\u0159ku p\u00e1sma\u201c s mo\u017enost\u00ed omezit rychlost odchoz\u00edho\/p\u0159ich\u00e1zej\u00edc\u00edho provozu pro skupiny aplikac\u00ed. \n<\/p>\n<p><\/p>\n<p>D\u00e1le otev\u0159eme pod\u010d\u00e1st Policy, kde jsou pravidla automaticky generov\u00e1na na z\u00e1klad\u011b d\u0159\u00edve popsan\u00fdch nastaven\u00ed. \n<\/p>\n<p><\/p>\n<p>Pod\u010d\u00e1st NAT ve v\u00fdchoz\u00edm nastaven\u00ed funguje v re\u017eimu Global Hide Nat Automatic, tj. v\u0161echny intern\u00ed hosty budou m\u00edt p\u0159\u00edstup na Internet p\u0159es ve\u0159ejnou IP adresu. Je mo\u017en\u00e9 manu\u00e1ln\u011b nastavit pravidla NAT pro publikov\u00e1n\u00ed va\u0161ich webov\u00fdch aplikac\u00ed nebo slu\u017eeb. \n<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pro mal\u00e9 firmy. Rozbalen\u00ed a nastaven\u00ed\" src=\"\/wp-content\/uploads\/2020\/07\/3c7f69f0ac7c34358cc2f3561d0f31e3.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>D\u00e1le n\u00e1s zaj\u00edm\u00e1 t\u00e9ma autentizace u\u017eivatel\u016f v s\u00edti, jsou nab\u00edzeny dv\u011b varianty: Active Directory Queries (integrace s va\u0161\u00edm AD), Browser-Based-Authentication (u\u017eivatel zad\u00e1v\u00e1 dom\u00e9nov\u00e9 p\u0159ihla\u0161ovac\u00ed \u00fadaje na port\u00e1lu).\n<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pro mal\u00e9 firmy. Rozbalen\u00ed a nastaven\u00ed\" src=\"\/wp-content\/uploads\/2020\/07\/123734ef6cde261992e6e369271c797f.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>Zvl\u00e1\u0161tn\u00ed pozornost si zaslou\u017e\u00ed SSL inspekce, pod\u00edl celkov\u00e9ho HTTPS provozu ve sv\u011btov\u00e9 s\u00edti aktivn\u011b roste. Pod\u00edvejme se, jak\u00e9 mo\u017enosti nab\u00edz\u00ed CheckPoint pro \u0159e\u0161en\u00ed SMB, k tomu p\u0159ejdeme do sekce SSL-Inspection \u2192 Policy:\n<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pro mal\u00e9 firmy. Rozbalen\u00ed a nastaven\u00ed\" src=\"\/wp-content\/uploads\/2020\/07\/a3da719f47a7aee7ca98e3f6e043282c.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>V nastaven\u00edch je mo\u017enost inspekce HTTPS provozu, je pot\u0159eba importovat certifik\u00e1t a nainstalovat jej do centra d\u016fv\u011bryhodn\u00fdch certifik\u00e1t\u016f na koncov\u00fdch u\u017eivatelsk\u00fdch stroj\u00edch. \n<\/p>\n<p><\/p>\n<p>Pova\u017eujeme za u\u017eite\u010dnou mo\u017enost re\u017eim BYPASS pro p\u0159ednastaven\u00e9 kategorie, co\u017e v\u00fdrazn\u011b \u0161et\u0159\u00ed \u010das p\u0159i zapnut\u00ed inspekce. \n<\/p>\n<p><\/p>\n<p>Po nastaven\u00ed pravidel na \u00farovni Firewall \/ Application byste m\u011bli pokra\u010dovat lad\u011bn\u00edm bezpe\u010dnostn\u00edch politik (Threat Prevention), k tomu p\u0159ejdeme do p\u0159\u00edslu\u0161n\u00e9 sekce:\n<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pro mal\u00e9 firmy. Rozbalen\u00ed a nastaven\u00ed\" src=\"\/wp-content\/uploads\/2020\/07\/30b4cbd037f8517e81c2557dbdc5fd98.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>Na otev\u0159en\u00e9 str\u00e1nce vid\u00edme povolen\u00e9 bledy, stavy aktualizac\u00ed signatur a datab\u00e1z\u00ed. N\u00e1sledn\u011b n\u00e1m nab\u00eddne v\u00fdb\u011br profilu pro ochranu perimetru s\u00edt\u011b, zobraz\u00ed se odpov\u00eddaj\u00edc\u00ed nastaven\u00ed.\n<\/p>\n<p><\/p>\n<p>Samostatn\u00e1 sekce \u201eIPS Protections\u201c umo\u017e\u0148uje konfigurovat akce pro konkr\u00e9tn\u00ed bezpe\u010dnostn\u00ed signatury.\n<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pro mal\u00e9 firmy. Rozbalen\u00ed a nastaven\u00ed\" src=\"\/wp-content\/uploads\/2020\/07\/9718b22b843742b6916dceb342e24a8d.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>Ned\u00e1vno jsme na na\u0161ich str\u00e1nk\u00e1ch psali <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/511012\/\">o glob\u00e1ln\u00ed zranitelnosti<\/a><\/noindex> pro Windows Server \u2014 SigRed. Zkontrolujeme jej\u00ed p\u0159\u00edtomnost v Gaia Embedded 80.20 zad\u00e1n\u00edm dotazu \u201eCVE-2020-1350\u201c<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pro mal\u00e9 firmy. Rozbalen\u00ed a nastaven\u00ed\" src=\"\/wp-content\/uploads\/2020\/07\/7af359b881b41e382b98ddb7fda53403.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nByla nalezena z\u00e1pis k t\u00e9to signatu\u0159e, na kterou lze aplikovat jednu z akc\u00ed. (v\u00fdchoz\u00ed Prevent pro \u00farove\u0148 nebezpe\u010dnosti \u2014 Kritick\u00e1). S \u0159e\u0161en\u00edm SMB nebudete ochuzeni o aktualizace a podporu; je to plnohodnotn\u00e9 NGFW \u0159e\u0161en\u00ed pro pobo\u010dky do 200 osob od CheckPoint.<\/p>\n<h2>Hodnocen\u00ed funk\u010dnosti<\/h2>\n<p>\nNa z\u00e1v\u011br \u010dl\u00e1nku bych cht\u011bl zd\u016fraznit dostupnost n\u00e1stroj\u016f pro odstra\u0148ov\u00e1n\u00ed probl\u00e9m\u016f po po\u010d\u00e1te\u010dn\u00edm uveden\u00ed a nastaven\u00ed SMB \u0159e\u0161en\u00ed. M\u016f\u017eete p\u0159ej\u00edt do sekce \u201cHOME\u201d \u2192 \u201cTools\u201d. Mo\u017en\u00e9 mo\u017enosti:<\/p>\n<ul>\n<li>monitorov\u00e1n\u00ed syst\u00e9mov\u00fdch zdroj\u016f;<\/li>\n<li>tabulka sm\u011brov\u00e1n\u00ed;<\/li>\n<li>kontrola dostupnosti cloudov\u00fdch slu\u017eeb CheckPoint;<\/li>\n<li>generov\u00e1n\u00ed CPinfo;<\/li>\n<\/ul>\n<p><\/p>\n<p>Jsou tak\u00e9 k dispozici integrovan\u00e9 s\u00ed\u0165ov\u00e9 p\u0159\u00edkazy: Ping, Traceroute, Traffic Capture.\n<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pro mal\u00e9 firmy. Rozbalen\u00ed a nastaven\u00ed\" src=\"\/wp-content\/uploads\/2020\/07\/d3f2b1c24bd7f9f882ad78f8838ac8e0.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>Dnes jsme se pod\u00edvali na po\u010d\u00e1te\u010dn\u00ed p\u0159ipojen\u00ed a nastaven\u00ed NGFW 1590; podobn\u00e9 akce provedete pro celou \u0159adu s\u00e9rie 1500 SMB CheckPoint. Dostupn\u00e9 mo\u017enosti n\u00e1m uk\u00e1zaly vysokou variabilitu pro nastaven\u00ed, podporu modern\u00edch metod ochrany provozu na perimetru s\u00edt\u011b. <\/p>\n<p>\nV sou\u010dasnosti \u0159e\u0161en\u00ed CheckPoint pro ochranu mal\u00fdch kancel\u00e1\u0159\u00ed a pobo\u010dek (do 200 osob) disponuj\u00ed \u0161irok\u00fdm souborem prost\u0159edk\u016f a pou\u017e\u00edvaj\u00ed nejnov\u011bj\u0161\u00ed technologie (cloudov\u00e9 \u0159\u00edzen\u00ed, podpora SIM karet, roz\u0161\u00ed\u0159en\u00ed pam\u011bti pomoc\u00ed SD karet atd.). Pokra\u010dujte ve sledov\u00e1n\u00ed a \u010dten\u00ed \u010dl\u00e1nk\u016f od TS Solution; pl\u00e1nujeme dal\u0161\u00ed vyd\u00e1n\u00ed \u010d\u00e1st\u00ed o NGFW CheckPoint rodiny SMB. Na shledanou!<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/358508\/\">Velk\u00e1 sb\u00edrka materi\u00e1l\u016f o Check Point od TS Solution<\/a><\/noindex>. Sledujte novinky (<noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/tssolution\">Telegram<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.facebook.com\/groups\/tssolution.info\/\">Facebook<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/vk.com\/ts_solution\">VK<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/blog\">TS Solution Blog<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/zen.yandex.ru\/id\/5c7d2162fa818600ae386a52\">Yandex.Zen<\/a><\/noindex>).<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/511462\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u0446\u0438\u043a\u043b \u0441\u0442\u0430\u0442\u0435\u0439 \u043f\u043e \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u043d\u043e\u0432\u044b\u043c \u043c\u043e\u0434\u0435\u043b\u044c\u043d\u044b\u043c \u0440\u044f\u0434\u043e\u043c SMB CheckPoint, \u043d\u0430\u043f\u043e\u043c\u043d\u0438\u043c \u0447\u0442\u043e \u0432 \u043f\u0435\u0440\u0432\u043e\u0439 \u0447\u0430\u0441\u0442\u0438 \u043c\u044b \u043e\u043f\u0438\u0441\u0430\u043b\u0438 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u0438\u0441\u0442\u0438\u043a\u0438 \u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043d\u043e\u0432\u044b\u0445 \u043c\u043e\u0434\u0435\u043b\u0435\u0439, \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0441\u0442\u0430\u0440\u0448\u0435\u0439 \u043c\u043e\u0434\u0435\u043b\u0438 \u0441\u0435\u0440\u0438\u0438: CheckPoint 1590 NGFW. \u041f\u0440\u0438\u043b\u043e\u0436\u0438\u043c \u043a\u0440\u0430\u0442\u043a\u043e\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u043e\u0439 \u0447\u0430\u0441\u0442\u0438: \u0420\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0430 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f (\u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0442\u0443\u044e\u0449\u0438\u0445, \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u0438 \u0441\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435). \u041f\u0435\u0440\u0432\u0438\u0447\u043d\u0430\u044f \u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430. \u041f\u0435\u0440\u0432\u0438\u0447\u043d\u0430\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430. [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":89740,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-89739","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/2-ngfw-dlya-malogo-biznesa-raspakovka-i-nastrojka\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd472. NGFW \u0434\u043b\u044f \u043c\u0430\u043b\u043e\u0433\u043e \u0431\u0438\u0437\u043d\u0435\u0441\u0430. \u0420\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0430 \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/2-ngfw-dlya-malogo-biznesa-raspakovka-i-nastrojka\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-07-25T23:42:18+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-07-25T23:42:18+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd472. NGFW pro mal\u00e9 podniky. Rozbalen\u00ed a nastaven\u00ed | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/2-ngfw-dlya-malogo-biznesa-raspakovka-i-nastrojka","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd472. NGFW \u0434\u043b\u044f \u043c\u0430\u043b\u043e\u0433\u043e \u0431\u0438\u0437\u043d\u0435\u0441\u0430. \u0420\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0430 \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 | ProHoster","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/2-ngfw-dlya-malogo-biznesa-raspakovka-i-nastrojka","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-07-25T23:42:18+00:00","article:modified_time":"2020-07-25T23:42:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"89739","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:05:27","updated":"2022-10-01 11:43:06","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/89739","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=89739"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/89739\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/89740"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=89739"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=89739"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=89739"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}