{"id":91348,"date":"2020-08-12T07:42:24","date_gmt":"2020-08-12T05:42:24","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/otpilit-li-cisco-sd-wan-suk-na-kotorom-sidit-dmvpn"},"modified":"2020-08-12T07:42:24","modified_gmt":"2020-08-12T05:42:24","slug":"otpilit-li-cisco-sd-wan-suk-na-kotorom-sidit-dmvpn","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/otpilit-li-cisco-sd-wan-suk-na-kotorom-sidit-dmvpn","title":{"rendered":"O\u0159e\u017ee Cisco SD-WAN v\u011btev, na kter\u00e9 sed\u00ed DMVPN?","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Od srpna 2017, kdy spole\u010dnost Cisco z\u00edskala spole\u010dnost Viptela, se hlavn\u00ed technologi\u00ed pro budov\u00e1n\u00ed distribuovan\u00fdch podnikov\u00fdch s\u00edt\u00ed stala <b>Cisco SD-WAN<\/b>. V uplynul\u00fdch t\u0159ech letech technologie SD-WAN pro\u0161la mnoha zm\u011bnami, jak kvalitativn\u00edmi, tak kvantitativn\u00edmi. V\u00fdrazn\u011b se roz\u0161\u00ed\u0159ily funk\u010dn\u00ed mo\u017enosti a byla zavedena podpora pro klasick\u00e9 sm\u011brova\u010de s\u00e9ri\u00ed <b>Cisco ISR 1000, ISR 4000, ASR 1000 a virtu\u00e1ln\u00ed CSR 1000v<\/b>. Zat\u00edmco mnoho z\u00e1kazn\u00edk\u016f a partner\u016f Cisco se i nad\u00e1le pt\u00e1 \u2013 <i>v \u010dem se Cisco SD-WAN li\u0161\u00ed od ji\u017e zn\u00e1m\u00fdch p\u0159\u00edstup\u016f zalo\u017een\u00fdch na technologi\u00edch jako je <b>Cisco DMVPN<\/b> a <b>Cisco Performance Routing<\/b> a jak d\u016fle\u017eit\u00e9 tyto rozd\u00edly jsou?<\/i> <\/p>\n<p>Je t\u0159eba ihned poznamenat, \u017ee p\u0159ed p\u0159\u00edchodem SD-WAN do portfolia Cisco, DMVPN spole\u010dn\u011b s PfR tvo\u0159ily kl\u00ed\u010dovou \u010d\u00e1st architektury <b>Cisco IWAN (Intelligent WAN)<\/b>, kter\u00e1 byla sv\u00fdm zp\u016fsobem p\u0159edch\u016fdcem plnohodnotn\u00e9 technologie SD-WAN. P\u0159esto\u017ee existuj\u00ed podobnosti jak v \u0159e\u0161en\u00fdch \u00faloh\u00e1ch, tak ve zp\u016fsobech jejich \u0159e\u0161en\u00ed, IWAN nedos\u00e1hl pot\u0159ebn\u00e9 \u00farovn\u011b automatizace, flexibility a \u0161k\u00e1lovatelnosti pro SD-WAN, a v\u00fdvoj IWAN se v pr\u016fb\u011bhu \u010dasu v\u00fdrazn\u011b zpomalil. P\u0159esto samotn\u00e9 technologie, kter\u00e9 tvo\u0159\u00ed IWAN, nikam nezmizely a mnoho z\u00e1kazn\u00edk\u016f je st\u00e1le \u00fasp\u011b\u0161n\u011b pou\u017e\u00edv\u00e1, v\u010detn\u011b na modern\u00edm vybaven\u00ed. Vznikla tak zaj\u00edmav\u00e1 situace \u2013 stejn\u00e9 vybaven\u00ed Cisco umo\u017e\u0148uje vybrat tu nejvhodn\u011bj\u0161\u00ed technologii pro budov\u00e1n\u00ed WAN (tradi\u010dn\u00ed, DMVPN+PfR nebo SD-WAN) v souladu s po\u017eadavky a o\u010dek\u00e1v\u00e1n\u00edmi z\u00e1kazn\u00edk\u016f. <br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nTento \u010dl\u00e1nek nem\u00e1 v \u00famyslu podrobn\u011b rozeb\u00edrat v\u0161echny charakteristiky technologi\u00ed Cisco SD-WAN a DMVPN (spole\u010dn\u011b nebo bez Performance Routing) \u2013 pro to je k dispozici obrovsk\u00e9 mno\u017estv\u00ed dokument\u016f a materi\u00e1l\u016f. Hlavn\u00edm c\u00edlem je pokusit se zhodnotit kl\u00ed\u010dov\u00e9 rozd\u00edly t\u011bchto technologi\u00ed. Ne\u017e v\u0161ak p\u0159ejdeme k diskusi o t\u011bchto rozd\u00edlech, p\u0159ipome\u0148me si stru\u010dn\u011b samotn\u00e9 technologie.<\/p>\n<h2>Co je Cisco DMVPN a k \u010demu slou\u017e\u00ed?<\/h2>\n<p>\nCisco DMVPN \u0159e\u0161\u00ed probl\u00e9m dynamick\u00e9ho (= \u0161k\u00e1lovateln\u00e9ho) p\u0159ipojen\u00ed s\u00edt\u011b vzd\u00e1len\u00e9 pobo\u010dky k s\u00edti centr\u00e1ln\u00edho kancel\u00e1\u0159e firmy p\u0159i pou\u017eit\u00ed libovoln\u00fdch typ\u016f komunika\u010dn\u00edch kan\u00e1l\u016f, v\u010detn\u011b Internetu (= s \u0161ifrov\u00e1n\u00edm kan\u00e1lu). Technicky je to realizov\u00e1no vytvo\u0159en\u00edm virtualizovan\u00e9 p\u0159ekryvn\u00e9 s\u00edt\u011b t\u0159\u00eddy L3. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/cs\/vpn\/\"   title=\"VPN\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"124\">VPN<\/a> v re\u017eimu bod \u2014 v\u00edc bod\u016f (point-to-multipoint) s logickou topologi\u00ed typu \u201eHv\u011bzda\u201c (Hub-n-Spoke). K tomu DMVPN vyu\u017e\u00edv\u00e1 kombinaci n\u00e1sleduj\u00edc\u00edch technologi\u00ed:<\/p>\n<ul>\n<li>IP sm\u011brov\u00e1n\u00ed<\/li>\n<li>Multipoint GRE tunely (mGRE)<\/li>\n<li>Next Hop Resolution Protocol (NHRP)<\/li>\n<li>IPSec Crypto profily<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"O\u0159e\u017ee Cisco SD-WAN v\u011btev, na kter\u00e9 sed\u00ed DMVPN?\" src=\"\/wp-content\/uploads\/2020\/08\/a44d5ad8ed5dadd7fc9721002d8fa134.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJak\u00e9 jsou hlavn\u00ed v\u00fdhody Cisco DMVPN v porovn\u00e1n\u00ed s klasick\u00fdm sm\u011brov\u00e1n\u00edm pomoc\u00ed MPLS VPN kan\u00e1l\u016f?<\/p>\n<ul>\n<li>Pro vytvo\u0159en\u00ed mezi pobo\u010dkov\u00e9ho s\u00edt\u011b je mo\u017en\u00e9 vyu\u017e\u00edt jak\u00e9koli komunika\u010dn\u00ed kan\u00e1ly \u2013 vyhovuje v\u0161e, co je schopno zajistit IP konektivitu mezi pobo\u010dkami, p\u0159i\u010dem\u017e provoz bude \u0161ifrov\u00e1n (kde je to nutn\u00e9) a vyva\u017eov\u00e1n (kde je to mo\u017en\u00e9).<\/li>\n<li>Automaticky se vytv\u00e1\u0159\u00ed pln\u011b propojen\u00e1 topologie mezi pobo\u010dkami. P\u0159i\u010dem\u017e mezi centr\u00e1ln\u00ed a vzd\u00e1lenou pobo\u010dkou \u2013 statick\u00e9 tunely, a mezi vzd\u00e1len\u00fdmi pobo\u010dkami \u2013 dynamick\u00e9 tunely na vy\u017e\u00e1d\u00e1n\u00ed (p\u0159i p\u0159\u00edtomnosti provozu).<\/li>\n<li>Na sm\u011brova\u010d\u00edch centr\u00e1ln\u00ed a vzd\u00e1len\u00e9 pobo\u010dky se pou\u017e\u00edv\u00e1 jednotn\u00e1 konfigurace s p\u0159esnost\u00ed na <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/cs\/lir\/ipv4\/\"   title=\"IP adress\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"820\">IP adress<\/a> rozhran\u00ed. D\u00edky pou\u017eit\u00ed mGRE nen\u00ed pot\u0159eba individu\u00e1ln\u00ed konfigurace des\u00edtek, stovek nebo dokonce tis\u00edc\u016f tunel\u016f. To vede k dobr\u00e9 \u0161k\u00e1lovatelnosti p\u0159i spr\u00e1vn\u00e9m designu.<\/li>\n<\/ul>\n<p><\/p>\n<h2>Co je Cisco Performance Routing a pro\u010d je pot\u0159eba?<\/h2>\n<p>\nP\u0159i pou\u017eit\u00ed DMVPN na mezi pobo\u010dkov\u00e9 s\u00edti z\u016fst\u00e1v\u00e1 nevy\u0159e\u0161en\u00e1 jedna nesm\u00edrn\u011b d\u016fle\u017eit\u00e1 ot\u00e1zka \u2013 jak dynamicky vyhodnotit stav ka\u017ed\u00e9ho z DMVPN tunel\u016f z hlediska spln\u011bn\u00ed po\u017eadavk\u016f pro kritick\u00fd provoz na\u0161\u00ed organizace a op\u011bt na z\u00e1klad\u011b takov\u00e9ho hodnocen\u00ed dynamicky rozhodnout o p\u0159esm\u011brov\u00e1n\u00ed? Skute\u010dnost je takov\u00e1, \u017ee DMVPN se v t\u00e9to \u010d\u00e1sti od klasick\u00e9ho sm\u011brov\u00e1n\u00ed p\u0159\u00edli\u0161 neli\u0161\u00ed \u2013 nejlep\u0161\u00ed, co lze ud\u011blat, je nastavit mechanismy QoS, kter\u00e9 umo\u017en\u00ed prioritizovat provoz v odchoz\u00edm sm\u011bru, ale jak\u00fdmkoli zp\u016fsobem nezohled\u0148uj\u00ed stav cel\u00e9 cesty v dan\u00e9m okam\u017eiku.<\/p>\n<p>A co d\u011blat, pokud kan\u00e1l degraduje \u010d\u00e1ste\u010dn\u011b, a ne \u00fapln\u011b \u2013 jak to odhalit a zhodnotit? DMVPN to samo o sob\u011b neum\u00ed. Vzhledem k tomu, \u017ee kan\u00e1ly spojuj\u00edc\u00ed pobo\u010dky mohou proch\u00e1zet p\u0159es zcela r\u016fzn\u00e9 poskytovatele slu\u017eeb a pou\u017e\u00edvat zcela r\u016fzn\u00e9 technologie, st\u00e1v\u00e1 se tento \u00fakol velmi netradi\u010dn\u00edm. A tady p\u0159ich\u00e1z\u00ed na pomoc technologie Cisco Performance Routing, kter\u00e1 v t\u00e9 dob\u011b ji\u017e pro\u0161la n\u011bkolika f\u00e1zemi v\u00fdvoje.<\/p>\n<p><img decoding=\"async\" alt=\"O\u0159e\u017ee Cisco SD-WAN v\u011btev, na kter\u00e9 sed\u00ed DMVPN?\" src=\"\/wp-content\/uploads\/2020\/08\/be885ce87f36c143be1450c7e8587701.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u00dakolem Cisco Performance Routing (d\u00e1le PfR) je m\u011b\u0159en\u00ed stavu cest (tunel\u016f) proch\u00e1zen\u00ed provozu na z\u00e1klad\u011b kl\u00ed\u010dov\u00fdch metrik d\u016fle\u017eit\u00fdch pro s\u00ed\u0165ov\u00e9 aplikace \u2013 <b>zpo\u017ed\u011bn\u00ed, variabilita zpo\u017ed\u011bn\u00ed (jitter) a ztr\u00e1ty paket\u016f (v procentech)<\/b>. D\u00e1le m\u016f\u017ee b\u00fdt m\u011b\u0159ena pou\u017e\u00edvan\u00e1 \u0161\u00ed\u0159ka p\u00e1sma. Tato m\u011b\u0159en\u00ed prob\u00edhaj\u00ed co nejbl\u00ed\u017ee skute\u010dn\u00e9mu \u010dasu (pokud to je mo\u017en\u00e9 a opodstatn\u011bn\u00e9) a v\u00fdsledky t\u011bchto m\u011b\u0159en\u00ed umo\u017e\u0148uj\u00ed sm\u011brova\u010di vyu\u017e\u00edvaj\u00edc\u00edmu PfR dynamicky p\u0159ij\u00edmat rozhodnut\u00ed o nutnosti zm\u011bny sm\u011brov\u00e1n\u00ed ur\u010dit\u00e9ho typu provozu.<\/p>\n<p>T\u00edmto zp\u016fsobem lze \u00fakol kombinace DMVPN\/PfR stru\u010dn\u011b charakterizovat n\u00e1sleduj\u00edc\u00edm zp\u016fsobem:<\/p>\n<ul>\n<li>Umo\u017enit z\u00e1kazn\u00edkovi vyu\u017e\u00edvat v WAN s\u00edt\u00edch jak\u00e9koli komunika\u010dn\u00ed kan\u00e1ly<\/li>\n<li>Zajistit co nejlep\u0161\u00ed kvalitu d\u016fle\u017eit\u00fdch aplikac\u00ed na t\u011bchto kan\u00e1lech<\/li>\n<\/ul>\n<p><\/p>\n<h2>Co je to Cisco SD-WAN?<\/h2>\n<p>\nCisco SD-WAN je technologie, kter\u00e1 vyu\u017e\u00edv\u00e1 p\u0159\u00edstup SDN k vytv\u00e1\u0159en\u00ed a provozu WAN s\u00edt\u011b organizace. To mimo jin\u00e9 znamen\u00e1 vyu\u017eit\u00ed takzvan\u00fdch kontroler\u016f (softwarov\u00fdch prvk\u016f), kter\u00e9 zaji\u0161\u0165uj\u00ed centralizovanou orchestraci a automatizovanou konfiguraci v\u0161ech komponent\u016f \u0159e\u0161en\u00ed. Na rozd\u00edl od klasick\u00e9ho SDN (ve stylu Clean Slate) se v Cisco SD-WAN pou\u017e\u00edv\u00e1 v\u00edce typ\u016f kontroler\u016f, p\u0159i\u010dem\u017e ka\u017ed\u00fd z nich m\u00e1 svou roli \u2013 to bylo z\u00e1m\u011brn\u011b ud\u011bl\u00e1no s c\u00edlem zajistit lep\u0161\u00ed \u0161k\u00e1lovatelnost a geo-rezervaci.<\/p>\n<p><img decoding=\"async\" alt=\"O\u0159e\u017ee Cisco SD-WAN v\u011btev, na kter\u00e9 sed\u00ed DMVPN?\" src=\"\/wp-content\/uploads\/2020\/08\/555191e4b49b2b473bee72cdf118a328.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV p\u0159\u00edpad\u011b SD-WAN \u00fakol vyu\u017e\u00edvat jak\u00e9koli typy kan\u00e1l\u016f a zaji\u0161\u0165ovat provoz obchodn\u00edch aplikac\u00ed z\u016fst\u00e1v\u00e1, ale po\u017eadavky na automatizaci, \u0161k\u00e1lovatelnost, bezpe\u010dnost a flexibilitu takov\u00e9 s\u00edt\u011b se roz\u0161i\u0159uj\u00ed.<\/p>\n<h2>Diskuse o rozd\u00edlech<\/h2>\n<p>\nPokud nyn\u00ed za\u010dneme analyzovat rozd\u00edly mezi t\u011bmito technologiemi, budou pat\u0159it do jedn\u00e9 z kategori\u00ed:<\/p>\n<ul>\n<li>Architektonick\u00e9 rozd\u00edly \u2013 jak jsou funkce rozd\u011bleny mezi r\u016fzn\u00e9 komponenty \u0159e\u0161en\u00ed, jak je organizov\u00e1na interakce t\u011bchto komponent a jak to ovliv\u0148uje mo\u017enosti a flexibilitu technologie?<\/li>\n<li>Funk\u010dn\u00ed mo\u017enosti \u2013 co m\u016f\u017ee jedna technologie, co druh\u00e1 nem\u016f\u017ee? A je to skute\u010dn\u011b tak d\u016fle\u017eit\u00e9?<\/li>\n<\/ul>\n<p><\/p>\n<h3>V \u010dem se skr\u00fdvaj\u00ed architektonick\u00e9 rozd\u00edly a jsou skute\u010dn\u011b d\u016fle\u017eit\u00e9?<\/h3>\n<p>\nV ka\u017ed\u00e9 z uveden\u00fdch technologi\u00ed existuje \u0159ada \"hybn\u00fdch \u010d\u00e1st\u00ed\", kter\u00e9 maj\u00ed odli\u0161nou roli i principy vz\u00e1jemn\u00e9 interakce. Od toho, jak dob\u0159e jsou tyto principy promy\u0161leny, z\u00e1vis\u00ed p\u0159\u00edmo \u0161k\u00e1lovatelnost, odolnost v\u016f\u010di v\u00fdpadk\u016fm a celkov\u00e1 efektivita \u0159e\u0161en\u00ed. <\/p>\n<p>Poj\u010fme se pod\u00edvat na r\u016fzn\u00e9 aspekty architektury podrobn\u011bji:<\/p>\n<p><b>Data-plane<\/b> \u2013 \u010d\u00e1st \u0159e\u0161en\u00ed zodpov\u011bdn\u00e1 za p\u0159enos u\u017eivatelsk\u00e9ho provozu mezi zdrojem a p\u0159\u00edjemcem. V DMVPN a SD-WAN je realizov\u00e1na t\u00e9m\u011b\u0159 shodn\u011b na samotn\u00fdch sm\u011brova\u010d\u00edch na z\u00e1klad\u011b Multipoint GRE tunel\u016f. Rozd\u00edl spo\u010d\u00edv\u00e1 v tom, jak\u00fdm zp\u016fsobem se formuje pot\u0159ebn\u00e1 sada parametr\u016f t\u011bchto tunel\u016f:<\/p>\n<ul>\n<li>v <b>DMVPN\/PfR<\/b> \u2013 to je v\u00fdhradn\u011b dvoustup\u0148ov\u00e1 hierarchie uzl\u016f s topologi\u00ed typu \"Hv\u011bzda\" nebo Hub-n-Spoke. Je nutn\u00e1 statick\u00e1 konfigurace Hubu a statick\u00e9 propojen\u00ed Spoke s Hubem, stejn\u011b jako interakce protokolu NHRP pro vytvo\u0159en\u00ed data-plane konektivity. V d\u016fsledku toho <b>jsou zm\u011bny na Hubu<\/b>, spojen\u00e9 nap\u0159\u00edklad se zm\u011bnou\/p\u0159ipojen\u00edm nov\u00fdch WAN kan\u00e1l\u016f nebo zm\u011bny parametr\u016f st\u00e1vaj\u00edc\u00edch, v\u00fdrazn\u011b zt\u00ed\u017eeny.<\/li>\n<li>v <b>SD-WAN<\/b> \u2013 to je zcela dynamick\u00fd model detekce parametr\u016f vytv\u00e1\u0159en\u00fdch tunel\u016f s oporou na control-plane (protokol OMP) a orchestration-plane (interakce s kontrol\u00e9rem vBond pro \u00fakoly detekce kontrol\u00e9r\u016f a NAT traversal). P\u0159itom mohou b\u00fdt pou\u017eity jak\u00e9koli p\u0159ekryvn\u00e9 topologie, v\u010detn\u011b hierarchick\u00fdch. V r\u00e1mci nastaven\u00e9 p\u0159ekryvn\u00e9 topologie tunel\u016f je mo\u017en\u00e1 flexibiln\u00ed konfigurace logick\u00e9 topologie v ka\u017ed\u00e9m jednotliv\u00e9m VPN (VRF).<\/li>\n<\/ul>\n<p><img decoding=\"async\" alt=\"O\u0159e\u017ee Cisco SD-WAN v\u011btev, na kter\u00e9 sed\u00ed DMVPN?\" src=\"\/wp-content\/uploads\/2020\/08\/21c65d83989db5975ca87c90fed3b476.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Control-plane<\/b> \u2013 funkce v\u00fdm\u011bny, filtrov\u00e1n\u00ed a modifikace sm\u011brovac\u00ed a jin\u00e9 informace mezi komponentami \u0159e\u0161en\u00ed. <\/p>\n<ul>\n<li>v <b>DMVPN\/PfR<\/b> \u2013 prob\u00edh\u00e1 pouze mezi sm\u011brova\u010di Hub a Spoke. P\u0159\u00edm\u00e1 v\u00fdm\u011bna sm\u011brovac\u00edch informac\u00ed mezi Spoke nen\u00ed mo\u017en\u00e1. V d\u016fsledku toho <b>bez funk\u010dn\u00edho Hubu nen\u00ed mo\u017en\u00e9 fungov\u00e1n\u00ed control-plane a data-plane.<\/b>, co\u017e klade na Hub dodate\u010dn\u00e9 po\u017eadavky na vysokou dostupnost, kter\u00e9 nejsou v\u017edy splniteln\u00e9.<\/li>\n<li>v <b>SD-WAN<\/b> \u2013 control-plane nen\u00ed nikdy realizov\u00e1no p\u0159\u00edmo mezi sm\u011brova\u010di \u2013 interakce prob\u00edh\u00e1 na z\u00e1klad\u011b protokolu OMP a nutn\u011b je realizov\u00e1na prost\u0159ednictv\u00edm specifick\u00e9ho typu \u0159\u00eddic\u00edho prvku vSmart, co\u017e zaji\u0161\u0165uje mo\u017enost vyv\u00e1\u017een\u00ed, geo-rezervace a centralizovan\u00e9ho \u0159\u00edzen\u00ed sign\u00e1ln\u00ed z\u00e1t\u011b\u017ee. Dal\u0161\u00ed zvl\u00e1\u0161tnost\u00ed protokolu OMP je jeho zna\u010dn\u00e1 odolnost v\u016f\u010di ztr\u00e1t\u00e1m a nez\u00e1vislost na rychlosti spojen\u00ed s \u0159\u00eddic\u00edmi prvky (v rozumn\u00fdch mez\u00edch, samoz\u0159ejm\u011b). To stejn\u011b \u00fasp\u011b\u0161n\u011b umo\u017e\u0148uje um\u00edstit \u0159\u00eddic\u00ed prvky SD-WAN do ve\u0159ejn\u00fdch nebo soukrom\u00fdch cloud\u016f s p\u0159\u00edstupem p\u0159es Internet.<\/li>\n<\/ul>\n<p><img decoding=\"async\" alt=\"O\u0159e\u017ee Cisco SD-WAN v\u011btev, na kter\u00e9 sed\u00ed DMVPN?\" src=\"\/wp-content\/uploads\/2020\/08\/fd77c23b005705a9f8857d23a430ca7d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Policy-plane<\/b> \u2013 \u010d\u00e1st \u0159e\u0161en\u00ed odpov\u00eddaj\u00edc\u00ed za definov\u00e1n\u00ed, \u0161\u00ed\u0159en\u00ed a aplikaci politik \u0159\u00edzen\u00ed provozu v distribuovan\u00e9 s\u00edti.<\/p>\n<ul>\n<li><b>DMVPN <\/b>\u2013 je fakticky omezeno politikami kvality slu\u017eeb (QoS), kter\u00e9 jsou nastavov\u00e1ny individu\u00e1ln\u011b na ka\u017ed\u00e9m sm\u011brova\u010di prost\u0159ednictv\u00edm CLI nebo \u0161ablon Prime Infrastructure.<\/li>\n<li><b>DMVPN\/PfR<\/b> \u2013 politiky PfR jsou utv\u00e1\u0159eny na centralizovan\u00e9m sm\u011brova\u010di Master Controller (MC) prost\u0159ednictv\u00edm CLI a n\u00e1sledn\u011b jsou automaticky distribuov\u00e1ny do pobo\u010dkov\u00fdch MC. P\u0159itom se pou\u017e\u00edvaj\u00ed stejn\u00e9 cesty pro p\u0159enos politik, jak\u00e9 jsou pro data-plane. Nen\u00ed mo\u017en\u00e9 odd\u011blit v\u00fdm\u011bnu politik, sm\u011brovac\u00edch informac\u00ed a u\u017eivatelsk\u00fdch dat. Distribuce politik zahrnuje povinnou IP konektivitu mezi Hub a Spoke. P\u0159i\u010dem\u017e funkce MC m\u016f\u017ee b\u00fdt v p\u0159\u00edpad\u011b pot\u0159eby spojena se sm\u011brova\u010dem DMVPN. Je mo\u017en\u00e9 (ale ne nutn\u00e9) pou\u017e\u00edvat \u0161ablony Prime Infrastructure pro centralizovan\u00e9 utv\u00e1\u0159en\u00ed politik. D\u016fle\u017eitou zvl\u00e1\u0161tnost\u00ed je, \u017ee politika je utv\u00e1\u0159ena glob\u00e1ln\u011b pro celou s\u00ed\u0165 stejn\u011b \u2013 <b>individu\u00e1ln\u00ed politiky pro jednotliv\u00e9 segmenty nejsou podporov\u00e1ny.<\/b>.<\/li>\n<li><b>SD-WAN<\/b> \u2013 Politiky spr\u00e1vy provozu a kvality slu\u017eeb jsou centralizovan\u011b \u0159\u00edzeny prost\u0159ednictv\u00edm grafick\u00e9ho rozhran\u00ed Cisco vManage, kter\u00e9 je dostupn\u00e9 tak\u00e9 p\u0159es Internet (pokud je to pot\u0159eba). Roz\u0161i\u0159uj\u00ed se po sign\u00e1ln\u00edch kan\u00e1lech p\u0159\u00edmo nebo zprost\u0159edkovan\u011b prost\u0159ednictv\u00edm \u0159adi\u010d\u016f vSmart (z\u00e1vis\u00ed na typu politiky). Nez\u00e1vis\u00ed na datov\u00e9 konektivit\u011b mezi sm\u011brova\u010di, proto\u017ee vyu\u017e\u00edvaj\u00ed v\u0161echny dostupn\u00e9 cesty p\u0159enosu provozu mezi \u0159adi\u010dem a sm\u011brova\u010dem.\n<p>Pro r\u016fzn\u00e9 segmenty s\u00edt\u011b je mo\u017en\u00e9 flexibiln\u011b vytv\u00e1\u0159et r\u016fzn\u00e9 politiky \u2013 rozsah pou\u017eit\u00ed politiky je definov\u00e1n mnoha jedine\u010dn\u00fdmi identifik\u00e1tory, kter\u00e9 jsou v \u0159e\u0161en\u00ed p\u0159edpokl\u00e1d\u00e1ny \u2013 \u010d\u00edslo pobo\u010dky, typ aplikace, sm\u011br pohybu provozu atd.\n<\/li>\n<\/ul>\n<p><img decoding=\"async\" alt=\"O\u0159e\u017ee Cisco SD-WAN v\u011btev, na kter\u00e9 sed\u00ed DMVPN?\" src=\"\/wp-content\/uploads\/2020\/08\/ae897e83bf8a8be876af767f847d5cde.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Orchestration-plane<\/b> \u2013 Mechanismy, kter\u00e9 umo\u017e\u0148uj\u00ed komponent\u016fm dynamicky se navz\u00e1jem objevit, nakonfigurovat a koordinovat n\u00e1slednou interakci.<\/p>\n<ul>\n<li>v <b>DMVPN\/PfR<\/b> Vz\u00e1jemn\u00e9 objevov\u00e1n\u00ed sm\u011brova\u010di je zalo\u017eeno na statick\u00e9 konfiguraci Hub za\u0159\u00edzen\u00ed a odpov\u00eddaj\u00edc\u00ed konfiguraci Spoke za\u0159\u00edzen\u00ed. Dynamick\u00e9 objevov\u00e1n\u00ed prob\u00edh\u00e1 pouze pro Spoke, kter\u00fd hl\u00e1s\u00ed sv\u00e9 spojovac\u00ed parametry Hub za\u0159\u00edzen\u00ed, kter\u00e9 je p\u0159edt\u00edm vlo\u017eeno do konfigurace Spoke. <b>Bez IP konektivity Spoke s alespo\u0148 jedn\u00edm Hubem nen\u00ed mo\u017en\u00e9 vytvo\u0159it ani datovou, ani \u0159\u00eddic\u00ed rovinu.<\/b><\/li>\n<li>v <b>SD-WAN<\/b> Orkestrace komponent \u0159e\u0161en\u00ed prob\u00edh\u00e1 s vyu\u017eit\u00edm \u0159adi\u010de vBond, se kter\u00fdm mus\u00ed m\u00edt ka\u017ed\u00fd komponent (sm\u011brova\u010de a \u0159adi\u010de vManage\/vSmart) p\u0159edem nastavenou IP konektivitu.\n<p>Zpo\u010d\u00e1tku komponenty nev\u011bd\u00ed o parametrech p\u0159ipojen\u00ed k sob\u011b navz\u00e1jem \u2013 pro to pot\u0159ebuj\u00ed zprost\u0159edkovatele-orkestr\u00e1tora vBond. Obecn\u00fd princip je n\u00e1sleduj\u00edc\u00ed \u2013 ka\u017ed\u00fd komponent v po\u010d\u00e1te\u010dn\u00ed f\u00e1zi zjist\u00ed (automaticky nebo staticky) pouze parametry p\u0159ipojen\u00ed k vBond, pot\u00e9 vBond informuje sm\u011brova\u010d o \u0159adi\u010d\u00edch vManage a vSmart (d\u0159\u00edve objeven\u00fdch), co\u017e umo\u017e\u0148uje automatick\u00e9 vytvo\u0159en\u00ed v\u0161ech pot\u0159ebn\u00fdch sign\u00e1ln\u00edch spojen\u00ed. <\/p>\n<p>Dal\u0161\u00edm krokem je, \u017ee nov\u00fd sm\u011brova\u010d zjist\u00ed informace o ostatn\u00edch sm\u011brova\u010d\u00edch v s\u00edti prost\u0159ednictv\u00edm OMP v\u00fdm\u011bny s \u0159\u00eddic\u00edm syst\u00e9mem vSmart. Takto sm\u011brova\u010d, kter\u00fd ze za\u010d\u00e1tku nev\u00ed nic o parametrech s\u00edt\u011b, dok\u00e1\u017ee automaticky objevit a p\u0159ipojit se k \u0159\u00eddic\u00edm syst\u00e9m\u016fm a pot\u00e9 tak\u00e9 automaticky zjistit a vytvo\u0159it konektivitu s ostatn\u00edmi sm\u011brova\u010di. P\u0159itom parametry p\u0159ipojen\u00ed v\u0161ech komponent\u016f jsou na za\u010d\u00e1tku nezn\u00e1m\u00e9 a mohou se m\u011bnit b\u011bhem provozu.\n<\/li>\n<\/ul>\n<p><img decoding=\"async\" alt=\"O\u0159e\u017ee Cisco SD-WAN v\u011btev, na kter\u00e9 sed\u00ed DMVPN?\" src=\"\/wp-content\/uploads\/2020\/08\/19cae5336892c6fa9140b09c124123a7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Spr\u00e1vn\u00ed vrstva<\/b> \u2013 \u010d\u00e1st \u0159e\u0161en\u00ed, kter\u00e1 zaji\u0161\u0165uje centralizovan\u00e9 \u0159\u00edzen\u00ed a monitoring.<\/p>\n<ul>\n<li><b>DMVPN\/PfR<\/b> \u2013 specializovan\u00e9 \u0159e\u0161en\u00ed pro spr\u00e1vn\u00ed vrstvu nen\u00ed ur\u010deno. Pro z\u00e1kladn\u00ed automatizaci a monitoring je mo\u017en\u00e9 pou\u017e\u00edt produkty, jako je Cisco Prime Infrastructure. Ka\u017ed\u00fd sm\u011brova\u010d m\u00e1 mo\u017enost spr\u00e1vy prost\u0159ednictv\u00edm p\u0159\u00edkazov\u00e9ho \u0159\u00e1dku CLI. <b>Integrace s extern\u00edmi syst\u00e9my p\u0159es API nen\u00ed pl\u00e1nov\u00e1na.<\/b><\/li>\n<li><b>SD-WAN<\/b> \u2013 ve\u0161ker\u00e1 standardn\u00ed interakce a monitoring se prov\u00e1d\u00ed centralizovan\u011b p\u0159es grafick\u00e9 rozhran\u00ed \u0159\u00eddic\u00edho syst\u00e9mu vManage. V\u0161echny funkce \u0159e\u0161en\u00ed, bez v\u00fdjimky, jsou dostupn\u00e9 k nastaven\u00ed prost\u0159ednictv\u00edm vManage, jako\u017e i prost\u0159ednictv\u00edm pln\u011b zdokumentovan\u00e9 knihovny rozhran\u00ed REST API.\n<p>Ve\u0161ker\u00e1 nastaven\u00ed s\u00edt\u011b SD-WAN ve vManage se soust\u0159ed\u00ed na dv\u011b hlavn\u00ed konstrukce \u2013 tvorbu \u0161ablon za\u0159\u00edzen\u00ed (Device Template) a tvorbu politiky, kter\u00e1 ur\u010duje logiku fungov\u00e1n\u00ed s\u00edt\u011b a zpracov\u00e1n\u00ed provozu. P\u0159itom vManage, p\u0159en\u00e1\u0161ej\u00edc\u00ed politiky formulovan\u00e9 administr\u00e1torem, automaticky vyb\u00edr\u00e1, jak\u00e9 zm\u011bny a na jak\u00fdch jednotliv\u00fdch za\u0159\u00edzen\u00edch\/\u0159\u00eddic\u00edch syst\u00e9mech je t\u0159eba prov\u00e9st, co\u017e v\u00fdrazn\u011b zvy\u0161uje efektivitu a \u0161k\u00e1lovatelnost \u0159e\u0161en\u00ed.<\/p>\n<p>P\u0159es rozhran\u00ed vManage je dostupn\u00e9 nejen nastaven\u00ed \u0159e\u0161en\u00ed Cisco SD-WAN, ale tak\u00e9 plnohodnotn\u00fd monitoring stavu v\u0161ech komponent\u016f \u0159e\u0161en\u00ed, a\u017e po aktu\u00e1ln\u00ed stav metrik jednotliv\u00fdch tunel\u016f a statistiku vyu\u017eit\u00ed r\u016fzn\u00fdch aplikac\u00ed na z\u00e1klad\u011b anal\u00fdzy DPI.<\/p>\n<p>I kdy\u017e je interakce centralizov\u00e1na, v\u0161echny komponenty (kontrol\u00e9ry a sm\u011brova\u010de) maj\u00ed tak\u00e9 pln\u011b funk\u010dn\u00ed p\u0159\u00edkazovou \u0159\u00e1dku CLI, kter\u00e1 je nezbytn\u00e1 v pr\u016fb\u011bhu implementace nebo v p\u0159\u00edpad\u011b nouzov\u00fdch situac\u00ed pro m\u00edstn\u00ed diagnostiku. V b\u011b\u017en\u00e9m re\u017eimu (p\u0159i dostupnosti sign\u00e1ln\u00edho kan\u00e1lu mezi komponenty) je p\u0159\u00edkazov\u00e1 \u0159\u00e1dka na sm\u011brova\u010d\u00edch dostupn\u00e1 pouze pro diagnostiku a nen\u00ed p\u0159\u00edstupn\u00e1 pro prov\u00e1d\u011bn\u00ed m\u00edstn\u00edch zm\u011bn, co\u017e zaru\u010duje m\u00edstn\u00ed bezpe\u010dnost a jedin\u00fd zdroj zm\u011bn v takov\u00e9 s\u00edti \u2013 vManage.<\/li>\n<\/ul>\n<p>\n<b>Integrovan\u00e1 bezpe\u010dnost<\/b> \u2013 toto by m\u011blo zahrnovat nejen ochranu u\u017eivatelsk\u00fdch dat p\u0159i p\u0159enosu p\u0159es ve\u0159ejn\u00e9 kan\u00e1ly, ale tak\u00e9 celkovou bezpe\u010dnost WAN s\u00edt\u011b postaven\u00e9 na vybran\u00e9 technologii.<\/p>\n<ul>\n<li>v <b>DMVPN\/PfR<\/b> je stanovena mo\u017enost \u0161ifrov\u00e1n\u00ed u\u017eivatelsk\u00fdch dat a sign\u00e1ln\u00edch protokol\u016f. P\u0159i pou\u017e\u00edv\u00e1n\u00ed ur\u010dit\u00fdch model\u016f sm\u011brova\u010d\u016f jsou nav\u00edc k dispozici funkce firewallu s inspekc\u00ed provozu, IPS\/IDS. Existuje mo\u017enost segmentace pobo\u010dkov\u00fdch s\u00edt\u00ed s vyu\u017eit\u00edm VRF. Je k dispozici autentizace (jednofaktorov\u00e1) kontroln\u00edch protokol\u016f.\n<p>P\u0159itom je vzd\u00e1len\u00fd sm\u011brova\u010d standardn\u011b pova\u017eov\u00e1n za d\u016fv\u011bryhodn\u00fd prvek s\u00edt\u011b \u2013 t.j. nep\u0159edpokl\u00e1daj\u00ed se a nezohled\u0148uj\u00ed se p\u0159\u00edpady fyzick\u00e9 kompromitace jednotliv\u00fdch za\u0159\u00edzen\u00ed a mo\u017enost neopr\u00e1vn\u011bn\u00e9ho p\u0159\u00edstupu k nim, neexistuje dvoufaktorov\u00e1 autentizace komponent \u0159e\u0161en\u00ed, co\u017e v p\u0159\u00edpad\u011b geograficky rozpt\u00fdlen\u00e9 s\u00edt\u011b <b>m\u016f\u017ee p\u0159edstavovat v\u00e1\u017en\u00e1 dodate\u010dn\u00e1 rizika.<\/b> <\/li>\n<li>v <b>SD-WAN<\/b> podobn\u011b jako u DMVPN je stanovena mo\u017enost \u0161ifrov\u00e1n\u00ed u\u017eivatelsk\u00fdch dat, ale s v\u00fdrazn\u011b roz\u0161\u00ed\u0159en\u00fdmi funkcemi s\u00ed\u0165ov\u00e9 bezpe\u010dnosti a L3\/VRF segmentace (MAC, IPS\/IDS, filtrov\u00e1n\u00ed URL, filtrov\u00e1n\u00ed DNS, AMP\/TG, SASE, TLS\/SSL proxy atd.). P\u0159i tom je v\u00fdm\u011bna \u0161ifrovac\u00edch kl\u00ed\u010d\u016f prov\u00e1d\u011bna efektivn\u011bji prost\u0159ednictv\u00edm vSmart kontrol\u00e9r\u016f (a ne p\u0159\u00edmo), po p\u0159edem stanoven\u00fdch sign\u00e1ln\u00edch kan\u00e1lech zabezpe\u010den\u00fdch DTLS\/TLS \u0161ifrov\u00e1n\u00edm na z\u00e1klad\u011b bezpe\u010dnostn\u00edch certifik\u00e1t\u016f. Co\u017e na opl\u00e1tku zaru\u010duje bezpe\u010dnost takov\u00e9 v\u00fdm\u011bny a zaji\u0161\u0165uje lep\u0161\u00ed \u0161k\u00e1lovatelnost \u0159e\u0161en\u00ed a\u017e do des\u00edtek tis\u00edc za\u0159\u00edzen\u00ed v jedn\u00e9 s\u00edti.\n<p>V\u0161echna sign\u00e1ln\u00ed spojen\u00ed (\u0159adi\u010d-\u0159adi\u010d, \u0159adi\u010d-router) jsou tak\u00e9 zabezpe\u010dena na z\u00e1klad\u011b DTLS\/TLS. Routery jsou vybaveny bezpe\u010dnostn\u00edmi certifik\u00e1ty p\u0159i v\u00fdrob\u011b s mo\u017enost\u00ed v\u00fdm\u011bny\/prodlou\u017een\u00ed. Dvoufaktorov\u00e1 autentizace je dosa\u017eena spln\u011bn\u00edm dvou podm\u00ednek sou\u010dasn\u011b pro mo\u017enost fungov\u00e1n\u00ed routeru\/\u0159adi\u010de v s\u00edti SD-WAN:<\/p>\n<ul>\n<li>Platn\u00fd bezpe\u010dnostn\u00ed certifik\u00e1t<\/li>\n<li>V\u00fdslovn\u00e9 a uv\u011bdom\u011bl\u00e9 za\u0159azen\u00ed ka\u017ed\u00e9ho komponentu administr\u00e1torem do \"b\u00edl\u00e9ho\" seznamu povolen\u00fdch za\u0159\u00edzen\u00ed.<\/li>\n<\/ul>\n<p>\n<\/li>\n<\/ul>\n<p><img decoding=\"async\" alt=\"O\u0159e\u017ee Cisco SD-WAN v\u011btev, na kter\u00e9 sed\u00ed DMVPN?\" src=\"\/wp-content\/uploads\/2020\/08\/13191eb92f25094112471a0ff3855cac.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Funk\u010dn\u00ed rozd\u00edly mezi SD-WAN a DMVPN\/PfR<\/h2>\n<p>\nP\u0159i p\u0159echodu k diskuzi o funk\u010dn\u00edch rozd\u00edlech je t\u0159eba poznamenat, \u017ee mnoh\u00e9 z nich vypl\u00fdvaj\u00ed z architektonick\u00fdch \u2014 nen\u00ed tajemstv\u00edm, \u017ee p\u0159i vytv\u00e1\u0159en\u00ed architektury \u0159e\u0161en\u00ed se v\u00fdvoj\u00e1\u0159i odv\u00edjej\u00ed od t\u011bch mo\u017enost\u00ed, kter\u00e9 cht\u011bj\u00ed na konci z\u00edskat. Poj\u010fme se pod\u00edvat na nejv\u00fdznamn\u011bj\u0161\u00ed rozd\u00edly dvou technologi\u00ed.<\/p>\n<h3>AppQ (Kvalita aplikace) \u2013 funkce zaji\u0161t\u011bn\u00ed kvality p\u0159enosu dat obchodn\u00edch aplikac\u00ed<\/h3>\n<p>\nKl\u00ed\u010dov\u00e9 funkce zva\u017eovan\u00fdch technologi\u00ed jsou zam\u011b\u0159eny na to, aby co nejv\u00edce zlep\u0161ily u\u017eivatelsk\u00fd z\u00e1\u017eitek p\u0159i pou\u017e\u00edv\u00e1n\u00ed obchodn\u011b kritick\u00fdch aplikac\u00ed v distribuovan\u00e9 s\u00edti. To je zvl\u00e1\u0161\u0165 d\u016fle\u017eit\u00e9 v podm\u00ednk\u00e1ch, kdy \u010d\u00e1st infrastruktury nen\u00ed pod kontrolou IT nebo dokonce nezaru\u010duje \u00fasp\u011b\u0161n\u00fd p\u0159enos dat.<\/p>\n<p>DMVPN sama o sob\u011b neposkytuje takov\u00e9 mechanismy. Nejlep\u0161\u00ed, co lze ud\u011blat v klasick\u00e9 DMVPN s\u00edti, je klasifikovat odchoz\u00ed provoz podle aplikac\u00ed a up\u0159ednostnit ho p\u0159i p\u0159enosu sm\u011brem k WAN kan\u00e1lu. V\u00fdb\u011br DMVPN tunelu je v tomto p\u0159\u00edpad\u011b ur\u010den pouze jeho dostupnost\u00ed a v\u00fdsledkem fungov\u00e1n\u00ed sm\u011brovac\u00edch protokol\u016f. P\u0159itom se nijak nezohled\u0148uje pr\u016fchoz\u00ed stav cesty\/tunelu a jeho mo\u017en\u00e1 \u010d\u00e1ste\u010dn\u00e1 degradace z hlediska kl\u00ed\u010dov\u00fdch metrik d\u016fle\u017eit\u00fdch pro s\u00ed\u0165ov\u00e9 aplikace \u2013 latence, variace latence (jitter) a ztr\u00e1ty (%). V t\u00e9to souvislosti ztr\u00e1c\u00ed p\u0159\u00edm\u00e9 srovn\u00e1n\u00ed klasick\u00e9ho DMVPN se SD-WAN v oblasti \u0159e\u0161en\u00ed \u00faloh AppQ jak\u00fdkoliv smysl \u2013 DMVPN tuto \u00falohu nem\u016f\u017ee vy\u0159e\u0161it. P\u0159id\u00e1n\u00edm technologie Cisco Performance Routing (PfR) do t\u00e9to souvislosti se situace m\u011bn\u00ed a srovn\u00e1n\u00ed s Cisco SD-WAN se st\u00e1v\u00e1 smyslupln\u011bj\u0161\u00edm. <\/p>\n<p>Ne\u017e p\u0159ejdeme k diskusi o rozd\u00edlech, kr\u00e1tce o tom, v \u010dem si technologie jsou podobn\u00e9. Tak\u017ee ob\u011b technologie:<\/p>\n<ul>\n<li>maj\u00ed mechanismus, kter\u00fd umo\u017e\u0148uje dynamicky posoudit stav ka\u017ed\u00e9ho nainstalovan\u00e9ho tunelu na z\u00e1klad\u011b ur\u010dit\u00fdch metrik \u2013 minim\u00e1ln\u011b zpo\u017ed\u011bn\u00ed, variabilita zpo\u017ed\u011bn\u00ed a ztr\u00e1ty paket\u016f (%)<\/li>\n<li>pou\u017e\u00edvaj\u00ed ur\u010dit\u00fd soubor n\u00e1stroj\u016f na vytv\u00e1\u0159en\u00ed, distribuci a aplikaci pravidel (politik) spr\u00e1vy provozu s ohledem na v\u00fdsledky m\u011b\u0159en\u00ed stavu kl\u00ed\u010dov\u00fdch metrik tunel\u016f.<\/li>\n<li>k lasifikuj\u00ed aplikac\u00ed provoz na \u00farovn\u00edch L3-L4 (DSCP) modelu OSI nebo podle L7 signatur aplikac\u00ed na z\u00e1klad\u011b mechanism\u016f DPI integrovan\u00fdch v routeru.<\/li>\n<li>umo\u017e\u0148uj\u00ed pro v\u00fdznamn\u00e9 aplikace definovat p\u0159\u00edpustn\u00e9 prahov\u00e9 hodnoty metrik, v\u00fdchoz\u00ed pravidla pro p\u0159enos dat a pravidla pro p\u0159esm\u011brov\u00e1n\u00ed dat p\u0159i p\u0159ekro\u010den\u00ed prahov\u00fdch hodnot.<\/li>\n<li>p\u0159i enkapsulaci provozu v GRE\/IPSec vyu\u017e\u00edvaj\u00ed ji\u017e zaveden\u00fd pr\u016fmyslov\u00fd mechanismus p\u0159enosu intern\u00edho DSCP ozna\u010den\u00ed do extern\u00edho GRE\/IPSec hlavi\u010dky paket\u016f, co\u017e umo\u017e\u0148uje synchronizaci politik QoS organizace a telekomunika\u010dn\u00edho oper\u00e1tora (za p\u0159edpokladu odpov\u00eddaj\u00edc\u00ed SLA).<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"O\u0159e\u017ee Cisco SD-WAN v\u011btev, na kter\u00e9 sed\u00ed DMVPN?\" src=\"\/wp-content\/uploads\/2020\/08\/df997d02f9a2832a22d6f71e67b2b962.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Jak se li\u0161\u00ed mechanismy hodnocen\u00ed pr\u016fchodn\u00fdch metrik SD-WAN a DMVPN\/PfR?<\/h3>\n<p>\n<b>DMVPN\/PfR <\/b><\/p>\n<ul>\n<li>Pro hodnocen\u00ed standardn\u00edch metrik stavu tunel\u016f se pou\u017e\u00edvaj\u00ed jak aktivn\u00ed, tak pasivn\u00ed softwarov\u00e9 senzory (Probes). Aktivn\u00ed \u2013 na z\u00e1klad\u011b u\u017eivatelsk\u00e9ho provozu, pasivn\u00ed emuluj\u00ed takov\u00fd provoz (p\u0159i jeho nep\u0159\u00edtomnosti). <\/li>\n<li>Jemn\u00e9 nastaven\u00ed \u010dasova\u010d\u016f a podm\u00ednek detekce degradace nen\u00ed k dispozici \u2013 algoritmus je pevn\u011b stanoven.<\/li>\n<li>D\u00e1le je k dispozici m\u011b\u0159en\u00ed vyu\u017eit\u00e9 \u0161\u00ed\u0159ky p\u00e1sma v odchoz\u00edm sm\u011bru. Co dod\u00e1v\u00e1 DMVPN\/PfR dodate\u010dnou flexibilitu pro \u0159\u00edzen\u00ed provozu.<\/li>\n<li>P\u0159itom n\u011bkter\u00e9 mechanismy PfR se p\u0159i p\u0159ekro\u010den\u00ed metrik spol\u00e9haj\u00ed na zp\u011btnou sign\u00e1ln\u00ed vazbu ve form\u011b speci\u00e1ln\u00edch TCA (Threshold Crossing Alert) zpr\u00e1v, kter\u00e9 mus\u00ed vych\u00e1zet od p\u0159\u00edjemce dat sm\u011brem k zdroji, co\u017e na druhou stranu p\u0159edpokl\u00e1d\u00e1, \u017ee stavy m\u011b\u0159en\u00fdch kan\u00e1l\u016f mus\u00ed b\u00fdt alespo\u0148 dostate\u010dn\u00e9 k p\u0159enosu takov\u00fdch TCA zpr\u00e1v. Co\u017e ve v\u011bt\u0161in\u011b p\u0159\u00edpad\u016f nen\u00ed probl\u00e9m, ale zjevn\u011b to nelze zaru\u010dit. <\/li>\n<\/ul>\n<p>\n<b>SD-WAN <\/b><\/p>\n<ul>\n<li>Pro pr\u016fb\u011b\u017en\u00e9 hodnocen\u00ed standardn\u00edch metrik stavu tunelu se pou\u017e\u00edv\u00e1 protokol BFD v re\u017eimu echo. V tomto p\u0159\u00edpad\u011b nen\u00ed vy\u017eadov\u00e1na speci\u00e1ln\u00ed zp\u011btn\u00e1 vazba ve form\u011b TCA nebo podobn\u00fdch zpr\u00e1v \u2013 doch\u00e1z\u00ed k udr\u017een\u00ed izolace dom\u00e9n selh\u00e1n\u00ed. Tak\u00e9 nen\u00ed t\u0159eba p\u0159\u00edtomnost u\u017eivatelsk\u00e9ho provozu pro hodnocen\u00ed stavu tunelu.<\/li>\n<li>Existuje mo\u017enost podrobn\u00e9ho nastaven\u00ed \u010dasova\u010d\u016f BFD pro regulaci rychlosti akce a citlivosti algoritmu na degradaci komunika\u010dn\u00edho kan\u00e1lu od n\u011bkolika sekund po minuty.\n<p><img decoding=\"async\" alt=\"O\u0159e\u017ee Cisco SD-WAN v\u011btev, na kter\u00e9 sed\u00ed DMVPN?\" src=\"\/wp-content\/uploads\/2020\/08\/cd7fe1fa4f23a9d0695874bc5c6fa985.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<li>K datu psan\u00ed \u010dl\u00e1nku je v ka\u017ed\u00e9m z tunel\u016f navr\u017eena pouze jedna BFD relace. To potenci\u00e1ln\u011b vytv\u00e1\u0159\u00ed men\u0161\u00ed granularitu p\u0159i anal\u00fdze stavu tunelu. Ve skute\u010dnosti se to m\u016f\u017ee st\u00e1t omezen\u00edm pouze v p\u0159\u00edpad\u011b pou\u017eit\u00ed WAN p\u0159ipojen\u00ed na b\u00e1zi MPLS L2\/L3 VPN se sjednan\u00fdm QoS SLA \u2014 pokud bude DSCP ozna\u010den\u00ed BFD provozu (po zapouzd\u0159en\u00ed v IPSec\/GRE) shodovat s vysoce prioritn\u00ed frontou v s\u00edti provozovatele telekomunikac\u00ed, m\u016f\u017ee to ovlivnit p\u0159esnost a rychlost detekce degradace pro n\u00edzkoprioritn\u00ed provoz. Sou\u010dasn\u011b existuje mo\u017enost zm\u011bny v\u00fdchoz\u00edho ozna\u010den\u00ed BFD pro sn\u00ed\u017een\u00ed rizika vzniku takov\u00fdch situac\u00ed. V n\u00e1sleduj\u00edc\u00edch verz\u00edch softwaru Cisco SD-WAN se o\u010dek\u00e1v\u00e1 zaveden\u00ed podrobn\u011bj\u0161\u00edho nastaven\u00ed BFD a tak\u00e9 mo\u017enost spu\u0161t\u011bn\u00ed n\u011bkolika BFD relac\u00ed v r\u00e1mci jednoho tunelu s individu\u00e1ln\u00edmi DSCP hodnotami (pro r\u016fzn\u00e9 aplikace).<\/li>\n<li>BFD rovn\u011b\u017e umo\u017e\u0148uje posoudit maxim\u00e1ln\u00ed velikost paketu, kter\u00fd je mo\u017en\u00e9 p\u0159en\u00e1\u0161et dan\u00fdm tunelem bez fragmentace. To umo\u017e\u0148uje SD-WAN dynamicky nastavovat takov\u00e9 parametry, jako je MTU a TCP MSS Adjust, aby co nejefektivn\u011bji vyu\u017e\u00edvalo dostupnou \u0161\u00ed\u0159ku p\u00e1sma na ka\u017ed\u00e9m kan\u00e1lu.<\/li>\n<li>V SD-WAN je tak\u00e9 k dispozici mo\u017enost synchronizace QoS s oper\u00e1tory telekomunikac\u00ed nejen na z\u00e1klad\u011b pole L3 DSCP, ale tak\u00e9 na z\u00e1klad\u011b hodnot L2 CoS, kter\u00e9 mohou b\u00fdt automaticky vytv\u00e1\u0159eny ve firemn\u00ed s\u00edti specializovan\u00fdmi za\u0159\u00edzen\u00edmi \u2014 nap\u0159\u00edklad IP telefony.<\/li>\n<\/ul>\n<p><\/p>\n<h3>Jak se li\u0161\u00ed mo\u017enosti, zp\u016fsoby ur\u010den\u00ed a aplikace politik AppQ?<\/h3>\n<p><\/p>\n<h4>Politiky DMVPN\/PfR:<\/h4>\n<p><\/p>\n<ul>\n<li>Jsou ur\u010dov\u00e1ny na routeru(-ech) centr\u00e1ln\u00ed pobo\u010dky (CP) prost\u0159ednictv\u00edm p\u0159\u00edkazov\u00e9ho \u0159\u00e1dku CLI nebo konfigurac\u00ed na b\u00e1zi CLI \u0161ablon. Tvorba CLI \u0161ablon vy\u017eaduje p\u0159\u00edpravu a znalost syntaxe politik.\n<p><img decoding=\"async\" alt=\"O\u0159e\u017ee Cisco SD-WAN v\u011btev, na kter\u00e9 sed\u00ed DMVPN?\" src=\"\/wp-content\/uploads\/2020\/08\/5869bd7ff365cb4c810580d4b68392d1.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<li>Ur\u010duj\u00ed se glob\u00e1ln\u011b <b>bez mo\u017enosti individu\u00e1ln\u00edho nastaven\u00ed \/ zm\u011bny podle po\u017eadavk\u016f jednotliv\u00fdch segment\u016f s\u00edt\u011b.<\/b><\/li>\n<li>Interaktivn\u00ed vytv\u00e1\u0159en\u00ed politik v grafick\u00e9m rozhran\u00ed nen\u00ed zaji\u0161t\u011bno.<\/li>\n<li>Sledov\u00e1n\u00ed zm\u011bn, d\u011bd\u011bn\u00ed, vytv\u00e1\u0159en\u00ed v\u00edce verz\u00ed politik pro rychl\u00e9 p\u0159ep\u00edn\u00e1n\u00ed nen\u00ed zaji\u0161t\u011bno.<\/li>\n<li>Roz\u0161i\u0159uj\u00ed se automaticky na routery vzd\u00e1len\u00fdch pobo\u010dek. P\u0159itom se pou\u017e\u00edvaj\u00ed ty sam\u00e9 komunika\u010dn\u00ed kan\u00e1ly, kter\u00e9 slou\u017e\u00ed k p\u0159enosu u\u017eivatelsk\u00fdch dat. V p\u0159\u00edpad\u011b absence komunika\u010dn\u00edho kan\u00e1lu mezi centr\u00e1ln\u00ed a vzd\u00e1lenou pobo\u010dkou nen\u00ed mo\u017en\u00e9 roz\u0161\u00ed\u0159en\u00ed \/ zm\u011bna politik.<\/li>\n<li>Pou\u017e\u00edvaj\u00ed se na ka\u017ed\u00e9m routeru a v p\u0159\u00edpad\u011b pot\u0159eby modifikuj\u00ed v\u00fdsledek standardn\u00edch sm\u011brovac\u00edch protokol\u016f, p\u0159i\u010dem\u017e maj\u00ed vy\u0161\u0161\u00ed prioritu. <\/li>\n<li>Pro p\u0159\u00edpady, kdy v\u0161echny WAN kan\u00e1ly pobo\u010dky trp\u00ed v\u00fdrazn\u00fdmi ztr\u00e1tami provozu, <b>mechanismy kompenzace nejsou zaji\u0161t\u011bny.<\/b>.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Politiky SD-WAN:<\/h4>\n<p><\/p>\n<ul>\n<li>Definuj\u00ed se v grafick\u00e9m rozhran\u00ed vManage prost\u0159ednictv\u00edm interaktivn\u00edho \u0161ablonov\u00e9ho pr\u016fvodce.<\/li>\n<li>Podporuj\u00ed vytv\u00e1\u0159en\u00ed v\u00edce politik, kop\u00edrov\u00e1n\u00ed, d\u011bd\u011bn\u00ed, p\u0159ep\u00edn\u00e1n\u00ed mezi politikami v re\u00e1ln\u00e9m \u010dase.<\/li>\n<li>Podporuj\u00ed individu\u00e1ln\u00ed nastaven\u00ed politiky pro r\u016fzn\u00e9 segmenty (pobo\u010dky) s\u00edt\u011b.<\/li>\n<li>Distribuuj\u00ed se pomoc\u00ed jak\u00e9hokoli dostupn\u00e9ho sign\u00e1ln\u00edho kan\u00e1lu mezi kontrol\u00e9rem a routerem a\/nebo vSmart \u2013 nejsou p\u0159\u00edmo z\u00e1visl\u00e9 na datov\u00e9 konektivit\u011b mezi routery. Je v\u0161ak samoz\u0159ejm\u011b vy\u017eadov\u00e1na IP konektivita mezi samotn\u00fdmi routery a kontrol\u00e9ry.\n<p><img decoding=\"async\" alt=\"O\u0159e\u017ee Cisco SD-WAN v\u011btev, na kter\u00e9 sed\u00ed DMVPN?\" src=\"\/wp-content\/uploads\/2020\/08\/9ed48b430fd39ec69af4c9d16efa3d32.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/li>\n<li>Pro p\u0159\u00edpady, kdy v\u0161echny dostupn\u00e9 kan\u00e1ly pobo\u010dky za\u017e\u00edvaj\u00ed v\u00fdrazn\u00e9 ztr\u00e1ty dat, kter\u00e9 p\u0159ekra\u010duj\u00ed povolen\u00e9 prahov\u00e9 hodnoty pro kritick\u00e9 aplikace, je mo\u017en\u00e9 pou\u017e\u00edt dal\u0161\u00ed mechanismy zvy\u0161uj\u00edc\u00ed spolehlivost p\u0159enosu:\n<ul>\n<li><b>FEC (Forward Error Correction)<\/b> \u2013 pou\u017e\u00edv\u00e1 speci\u00e1ln\u00ed algoritmus redundatn\u00edho k\u00f3dov\u00e1n\u00ed. P\u0159i p\u0159enosu kritick\u00e9ho provozu po kan\u00e1lech se zna\u010dn\u00fdm procentem ztr\u00e1t m\u016f\u017ee b\u00fdt FEC automaticky aktivov\u00e1n a umo\u017e\u0148uje v p\u0159\u00edpad\u011b pot\u0159eby obnovit ztracenou \u010d\u00e1st dat. P\u0159itom se m\u00edrn\u011b zvy\u0161uje pou\u017eit\u00e9 p\u00e1smo, ale v\u00fdrazn\u011b se zvy\u0161uje spolehlivost.\n<p><img decoding=\"async\" alt=\"O\u0159e\u017ee Cisco SD-WAN v\u011btev, na kter\u00e9 sed\u00ed DMVPN?\" src=\"\/wp-content\/uploads\/2020\/08\/9b2deecf42b334b682c293ca92a52562.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/li>\n<li><b>Duplikace datov\u00fdch tok\u016f<\/b> \u2013 nav\u00edc k politice FEC m\u016f\u017ee existovat automatick\u00e9 duplikov\u00e1n\u00ed provozu vybran\u00fdch aplikac\u00ed v p\u0159\u00edpad\u011b je\u0161t\u011b z\u00e1va\u017en\u011bj\u0161\u00edch ztr\u00e1t, kter\u00e9 nelze kompenzovat pomoc\u00ed FEC. V tomto p\u0159\u00edpad\u011b budou vybran\u00e1 data odes\u00edl\u00e1na ve v\u0161ech tunelech sm\u011brem k pobo\u010dn\u00e9 stran\u011b p\u0159\u00edjemce s n\u00e1slednou de-duplicitou (odstran\u011bn\u00ed nadbyte\u010dn\u00fdch kopi\u00ed paket\u016f). Tento mechanismus v\u00fdrazn\u011b zvy\u0161uje vyu\u017eit\u00ed kan\u00e1l\u016f, ale tak\u00e9 v\u00fdrazn\u011b zvy\u0161uje spolehlivost p\u0159enosu.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><\/p>\n<h3>Mo\u017enosti Cisco SD-WAN, bez p\u0159\u00edm\u00fdch analog\u016f v DMVPN\/PfR<\/h3>\n<p>\nArchitektura \u0159e\u0161en\u00ed Cisco SD-WAN v n\u011bkter\u00fdch p\u0159\u00edpadech umo\u017e\u0148uje z\u00edskat mo\u017enosti, jejich\u017e realizace v r\u00e1mci DMVPN\/PfR je bu\u010f extr\u00e9mn\u011b slo\u017eit\u00e1, nebo neefektivn\u00ed kv\u016fli nezbytn\u00fdm n\u00e1klad\u016fm na pr\u00e1ci, nebo dokonce zcela nemo\u017en\u00e1. Pod\u00edvejme se na nejzaj\u00edmav\u011bj\u0161\u00ed z nich:<\/p>\n<h4>Traffic-Engineering (TE)<\/h4>\n<p>\nTE zahrnuje mechanismy, kter\u00e9 umo\u017e\u0148uj\u00ed odklonit provoz od standardn\u00ed cesty, kterou vytv\u00e1\u0159ej\u00ed sm\u011brovac\u00ed protokoly. TE se \u010dasto pou\u017e\u00edv\u00e1 k zaji\u0161t\u011bn\u00ed vysok\u00e9 dostupnosti s\u00edtov\u00fdch slu\u017eeb, d\u00edky schopnosti rychle a\/nebo p\u0159edem p\u0159esm\u011brovat d\u016fle\u017eit\u00fd provoz na alternativn\u00ed (neprol\u00ednaj\u00edc\u00ed) cestu p\u0159enosu, za \u00fa\u010delem zaji\u0161t\u011bn\u00ed lep\u0161\u00ed kvality slu\u017eby nebo rychlosti jej\u00ed obnovy v p\u0159\u00edpad\u011b selh\u00e1n\u00ed hlavn\u00ed cesty. <\/p>\n<p>Slo\u017eitost implementace TE spo\u010d\u00edv\u00e1 v nutnosti p\u0159edem vypo\u010d\u00edtat a rezervovat (zkontrolovat) alternativn\u00ed cestu. V MPLS s\u00edt\u00edch telekomunika\u010dn\u00edch oper\u00e1tor\u016f se tento \u00fakol \u0159e\u0161\u00ed pomoc\u00ed technologi\u00ed, jako je MPLS Traffic-Engineering s roz\u0161\u00ed\u0159en\u00edmi IGP protokol\u016f a RSVP protokolu. V posledn\u00ed dob\u011b tak\u00e9 z\u00edsk\u00e1v\u00e1 na popularit\u011b technologie Segment Routing, kter\u00e1 je l\u00e9pe optimalizov\u00e1na pro centralizovan\u00e9 nastaven\u00ed a orchestrace. V klasick\u00fdch WAN s\u00edt\u00edch tyto technologie obvykle nejsou p\u0159\u00edtomny nebo jsou omezeny na pou\u017eit\u00ed mechanism\u016f hop-by-hop, jako je Policy-Based Routing (PBR), kter\u00e9 dok\u00e1\u017eou odklonit provoz, ale realizuj\u00ed to na ka\u017ed\u00e9m routeru zvl\u00e1\u0161\u0165 \u2013 bez ohledu na celkov\u00fd stav s\u00edt\u011b nebo v\u00fdsledky PBR na p\u0159edchoz\u00edch \u010di n\u00e1sleduj\u00edc\u00edch kroc\u00edch. V\u00fdsledek pou\u017eit\u00ed t\u011bchto variant TE je neuspokojiv\u00fd \u2013 MPLS TE vzhledem k slo\u017eitosti nastaven\u00ed a provozu se obvykle pou\u017e\u00edv\u00e1 pouze v nejkriti\u010dt\u011bj\u0161\u00ed \u010d\u00e1sti s\u00edt\u011b (j\u00e1dro), zat\u00edmco PBR se vyu\u017e\u00edv\u00e1 na jednotliv\u00fdch routerech bez mo\u017enosti vytvo\u0159it n\u011bjakou jednotnou PBR politiku v cel\u00e9 s\u00edti. To se samoz\u0159ejm\u011b t\u00fdk\u00e1 i s\u00edt\u00ed zalo\u017een\u00fdch na DMVPN.<\/p>\n<p><img decoding=\"async\" alt=\"O\u0159e\u017ee Cisco SD-WAN v\u011btev, na kter\u00e9 sed\u00ed DMVPN?\" src=\"\/wp-content\/uploads\/2020\/08\/85e0bc4dc068f4e5db4fec330c7ed78d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSD-WAN v tomto ohledu nab\u00edz\u00ed mnohem elegantn\u011bj\u0161\u00ed \u0159e\u0161en\u00ed, kter\u00e9 nen\u00ed jen snadno nastaviteln\u00e9, ale tak\u00e9 v\u00fdrazn\u011b l\u00e9pe \u0161k\u00e1lovateln\u00e9. To je v\u00fdsledkem pou\u017eit\u00fdch architektur control-plane a policy-plane. Implementace policy-plane v SD-WAN umo\u017e\u0148uje centralizovan\u011b definovat politiku TE \u2013 kter\u00fd provoz je zaj\u00edmav\u00fd? pro jak\u00e9 VPN? p\u0159es kter\u00e9 uzly\/tunely je nutn\u00e9 nebo naopak zak\u00e1z\u00e1no vytv\u00e1\u0159et alternativn\u00ed trasu? Z\u00e1rove\u0148 centralizace \u0159\u00edzen\u00ed control-plane na b\u00e1zi vSmart kontrol\u00e9r\u016f umo\u017e\u0148uje modifikovat v\u00fdsledky routingu, ani\u017e by bylo nutn\u00e9 m\u011bnit nastaven\u00ed jednotliv\u00fdch za\u0159\u00edzen\u00ed \u2013 routery ji\u017e vid\u00ed pouze v\u00fdsledek t\u00e9 logiky, kter\u00e1 byla vytvo\u0159ena v rozhran\u00ed vManage a p\u0159ed\u00e1na k pou\u017eit\u00ed na vSmart.<\/p>\n<h4>Slu\u017eebn\u00ed \u0159et\u011bzen\u00ed <\/h4>\n<p>\nVytv\u00e1\u0159en\u00ed servisn\u00edch \u0159et\u011bzc\u016f je je\u0161t\u011b n\u00e1ro\u010dn\u011bj\u0161\u00ed \u00fakol v klasick\u00e9 routingu ne\u017e ji\u017e popsan\u00fd mechanismus Traffic-Engineering. V tomto p\u0159\u00edpad\u011b je toti\u017e t\u0159eba nejen vytvo\u0159it specifickou trasu pro ur\u010ditou s\u00ed\u0165ovou aplikaci, ale tak\u00e9 zajistit mo\u017enost v\u00fdstupu provozu ze s\u00edt\u011b na ur\u010dit\u00fdch (nebo na v\u0161ech) uzlech SD-WAN s\u00edt\u011b pro zpracov\u00e1n\u00ed specializovanou aplikac\u00ed nebo slu\u017ebou (MPLS, vyva\u017eov\u00e1n\u00ed z\u00e1t\u011b\u017ee, cachov\u00e1n\u00ed, inspekce provozu atd.). Je tak\u00e9 nutn\u00e9 m\u00edt mo\u017enost kontrolovat stav t\u011bchto extern\u00edch slu\u017eeb, aby se p\u0159ede\u0161lo situac\u00edm black-holing, a rovn\u011b\u017e pot\u0159ebn\u00e9 mechanismy pro um\u00edst\u011bn\u00ed t\u011bchto homogenn\u00edch extern\u00edch slu\u017eeb na r\u016fzn\u00e9 geografick\u00e9 lokace s mo\u017enost\u00ed, aby s\u00ed\u0165 automaticky vyb\u00edrala nejoptim\u00e1ln\u011bj\u0161\u00ed servisn\u00ed uzel pro zpracov\u00e1n\u00ed provozu dan\u00e9 pobo\u010dky. V p\u0159\u00edpad\u011b Cisco SD-WAN lze tohoto c\u00edle snadno dos\u00e1hnout vytvo\u0159en\u00edm odpov\u00eddaj\u00edc\u00ed centralizovan\u00e9 politiky, kter\u00e1 \u201esespojuje\u201c v\u0161echny aspekty c\u00edlen\u00e9ho servisn\u00edho \u0159et\u011bzce do jednoho celku a automaticky m\u011bn\u00ed logiku data-plane a control-plane pouze tam a tehdy, kde je to nezbytn\u00e9.<\/p>\n<p><img decoding=\"async\" alt=\"O\u0159e\u017ee Cisco SD-WAN v\u011btev, na kter\u00e9 sed\u00ed DMVPN?\" src=\"\/wp-content\/uploads\/2020\/08\/84bd6eba2de33a90baeb77697b844eec.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSchopnost vytvo\u0159it geo-distribuovan\u00e9 zpracov\u00e1n\u00ed provozu vybran\u00fdch typ\u016f aplikac\u00ed v ur\u010dit\u00e9 sekvenci na specializovan\u00e9m (ale nesouvisej\u00edc\u00edm se samotnou s\u00edt\u00ed SD-WAN) vybaven\u00ed \u2013 to je pravd\u011bpodobn\u011b nejv\u00fdsti\u017en\u011bj\u0161\u00ed uk\u00e1zka v\u00fdhod Cisco SD-WAN oproti klasick\u00fdm technologi\u00edm a dokonce n\u011bkter\u00fdm alternativn\u00edm \u0159e\u0161en\u00edm SD-WAN od jin\u00fdch v\u00fdrobc\u016f.<\/p>\n<h2>Jak\u00fd je v\u00fdsledek?<\/h2>\n<p>\nJe z\u0159ejm\u00e9, \u017ee DMVPN (samostatn\u011b nebo v kombinaci se Performance Routing) a Cisco SD-WAN <b>\u0159e\u0161\u00ed nakonec velmi podobn\u00e9 \u00fakoly<\/b> ve vztahu k distribuovan\u00e9 WAN s\u00edti organizace. Z\u00e1rove\u0148 v\u0161ak z\u00e1sadn\u00ed architektonick\u00e9 a funk\u010dn\u00ed rozd\u00edly technologie Cisco SD-WAN posouvaj\u00ed proces \u0159e\u0161en\u00ed t\u011bchto \u00fakol\u016f <b>na jinou kvalitativn\u00ed \u00farove\u0148<\/b>. Shrnut\u00ed ukazuje n\u00e1sleduj\u00edc\u00ed v\u00fdznamn\u00e9 rozd\u00edly mezi technologiemi SD-WAN a DMVPN\/PfR:<\/p>\n<ul>\n<li>DMVPN\/PfR v z\u00e1sad\u011b vyu\u017e\u00edvaj\u00ed osv\u011bd\u010den\u00e9 technologie pro budov\u00e1n\u00ed p\u0159ekryvn\u00fdch VPN s\u00edt\u00ed a co se t\u00fd\u010de data-plane, jsou podobn\u00e9 modern\u011bj\u0161\u00ed technologii SD-WAN. Nicm\u00e9n\u011b existuje \u0159ada omezen\u00ed, jako je povinn\u00e1 statick\u00e1 konfigurace sm\u011brova\u010d\u016f a v\u00fdb\u011br topologi\u00ed je omezen na Hub-n-Spoke. Na druh\u00e9 stran\u011b DMVPN\/PfR nab\u00edz\u00ed n\u011bkter\u00e9 funk\u010dn\u00ed mo\u017enosti, kter\u00e9 zat\u00edm nejsou v r\u00e1mci SD-WAN dostupn\u00e9 (my\u0161leno per-application BFD).<\/li>\n<li>V r\u00e1mci control-plane technologie se z\u00e1sadn\u011b li\u0161\u00ed. D\u00edky centralizovan\u00e9mu zpracov\u00e1n\u00ed sign\u00e1ln\u00edch protokol\u016f SD-WAN umo\u017e\u0148uje v\u00fdrazn\u011b z\u00fa\u017eit dom\u00e9ny selh\u00e1n\u00ed a \"odpojit\" proces p\u0159enosu u\u017eivatelsk\u00e9ho provozu od sign\u00e1ln\u00ed komunikace \u2013 do\u010dasn\u00e1 nedostupnost kontrol\u00e9r\u016f nem\u00e1 vliv na schopnost p\u0159en\u00e1\u0161et u\u017eivatelsk\u00fd provoz. Z\u00e1rove\u0148 do\u010dasn\u00e1 nedostupnost n\u011bkter\u00e9 pobo\u010dky (v\u010detn\u011b centr\u00e1ly) nijak neovliv\u0148uje mo\u017enost ostatn\u00edch pobo\u010dek spolupracovat mezi sebou a s kontrol\u00e9ry.<\/li>\n<li>Architektura vytv\u00e1\u0159en\u00ed a uplat\u0148ov\u00e1n\u00ed politik pro \u0159\u00edzen\u00ed provozu v p\u0159\u00edpad\u011b SD-WAN tak\u00e9 p\u0159ekon\u00e1v\u00e1 tu v DMVPN\/PfR \u2013 geo-redundance je realizov\u00e1na v\u00fdrazn\u011b l\u00e9pe, nen\u00ed v\u00e1z\u00e1na na Hub, je tu v\u00edce mo\u017enost\u00ed pro jemn\u00e9 dolad\u011bn\u00ed politik a seznam realizovan\u00fdch sc\u00e9n\u00e1\u0159\u016f \u0159\u00edzen\u00ed provozu je tak\u00e9 v\u00fdrazn\u011b rozs\u00e1hlej\u0161\u00ed.<\/li>\n<li>Proces orchestrace \u0159e\u0161en\u00ed se tak\u00e9 v\u00fdrazn\u011b li\u0161\u00ed. DMVPN p\u0159edpokl\u00e1d\u00e1 existenci p\u0159edem zn\u00e1m\u00fdch parametr\u016f, kter\u00e9 mus\u00ed b\u00fdt n\u011bjak\u00fdm zp\u016fsobem odra\u017eeny v konfiguraci, co\u017e pon\u011bkud omezuje flexibilitu \u0159e\u0161en\u00ed a mo\u017enost dynamick\u00fdch zm\u011bn. Naopak SD-WAN vych\u00e1z\u00ed z p\u0159edpokladu, \u017ee v po\u010d\u00e1te\u010dn\u00edm okam\u017eiku p\u0159ipojen\u00ed sm\u011brova\u010d \"nev\u00ed nic\" o sv\u00fdch kontrol\u00e9rech, ale v\u00ed \"kde se zeptat\" \u2013 to je dostate\u010dn\u00e9 nejen pro automatick\u00e9 nav\u00e1z\u00e1n\u00ed spojen\u00ed s kontrol\u00e9ry, ale i pro automatick\u00e9 vytvo\u0159en\u00ed pln\u011b propojen\u00e9 data-plane topologie, kterou lze n\u00e1sledn\u011b flexibiln\u011b nastavit\/zm\u011bnit pomoc\u00ed politik.<\/li>\n<li>V oblasti centralizovan\u00e9ho \u0159\u00edzen\u00ed, automatizace a monitorov\u00e1n\u00ed SD-WAN o\u010dek\u00e1van\u011b p\u0159evy\u0161uje mo\u017enosti DMVPN\/PfR, kter\u00e9 jsou v\u00fdsledkem v\u00fdvoje klasick\u00fdch technologi\u00ed a do zna\u010dn\u00e9 m\u00edry spol\u00e9haj\u00ed na p\u0159\u00edkazov\u00fd \u0159\u00e1dek CLI a pou\u017e\u00edv\u00e1n\u00ed syst\u00e9m\u016f NMS zalo\u017een\u00fdch na \u0161ablon\u00e1ch. <\/li>\n<li>V SD-WAN v porovn\u00e1n\u00ed s DMVPN se po\u017eadavky na bezpe\u010dnost dostaly na jinou kvalitativn\u00ed \u00farove\u0148. Hlavn\u00edmi principy jsou nulov\u00e1 d\u016fv\u011bra, \u0161k\u00e1lovatelnost a dvoufaktorov\u00e1 autentizace.<\/li>\n<\/ul>\n<p>\nZ t\u011bchto jednoduch\u00fdch z\u00e1v\u011br\u016f m\u016f\u017ee vzniknout myln\u00fd dojem, \u017ee vytvo\u0159en\u00ed s\u00edt\u011b na b\u00e1zi DMVPN\/PfR dnes ztratilo jak\u00fdkoli v\u00fdznam. To samoz\u0159ejm\u011b nen\u00ed \u00fapln\u011b pravda. Nap\u0159\u00edklad v p\u0159\u00edpadech, kdy se v s\u00edti pou\u017e\u00edv\u00e1 mnoho zastaral\u00e9ho za\u0159\u00edzen\u00ed a nen\u00ed mo\u017en\u00e9 je nahradit, m\u016f\u017ee DMVPN umo\u017enit spojen\u00ed \u201estar\u00fdch\u201c a \u201enov\u00fdch\u201c za\u0159\u00edzen\u00ed do jedn\u00e9 geograficky distribovan\u00e9 s\u00edt\u011b s mnoha v\u00fd\u0161e uveden\u00fdmi v\u00fdhodami.<\/p>\n<p>Na druh\u00e9 stran\u011b je t\u0159eba m\u00edt na pam\u011bti, \u017ee v\u0161echny aktu\u00e1ln\u00ed podnikov\u00e9 sm\u011brova\u010de Cisco na b\u00e1zi IOS XE (ISR 1000, ISR 4000, ASR 1000, CSR 1000v) dnes podporuj\u00ed jak\u00fdkoli pracovn\u00ed re\u017eim \u2013 tedy jak klasick\u00e9 sm\u011brov\u00e1n\u00ed, tak DMVPN i SD-WAN. <b>V\u00fdb\u011br je ur\u010den aktu\u00e1ln\u00edmi pot\u0159ebami a ch\u00e1p\u00e1n\u00edm, \u017ee kdykoli na tomt\u00e9\u017e za\u0159\u00edzen\u00ed lze za\u010d\u00edt sm\u011b\u0159ovat k pokro\u010dilej\u0161\u00ed technologii.<\/b><br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/514616\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0421 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 2017 \u0433\u043e\u0434\u0430, \u043a\u043e\u0433\u0434\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cisco \u043f\u0440\u0438\u043e\u0431\u0440\u0435\u043b\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044e Viptela, \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u043c\u043e\u0439 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 \u0441\u0442\u0430\u043b\u0430 Cisco SD-WAN. \u0417\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0438\u0435 3 \u0433\u043e\u0434\u0430 SD-WAN \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f \u043f\u0440\u043e\u0448\u043b\u0430 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439, \u043a\u0430\u043a \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e, \u0442\u0430\u043a \u0438 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u0430. \u0422\u0430\u043a \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0430\u0441\u0448\u0438\u0440\u0438\u043b\u0438\u0441\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0435 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438 \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 \u043d\u0430 \u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445 \u0441\u0435\u0440\u0438\u0439 Cisco ISR 1000, ISR 4000, ASR 1000 \u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":91349,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-91348","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0421 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 2017 \u0433\u043e\u0434\u0430, \u043a\u043e\u0433\u0434\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cisco \u043f\u0440\u0438\u043e\u0431\u0440\u0435\u043b\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044e Viptela, \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u043c\u043e\u0439 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 \u0441\u0442\u0430\u043b\u0430 Cisco SD-WAN.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/otpilit-li-cisco-sd-wan-suk-na-kotorom-sidit-dmvpn\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u0442\u043f\u0438\u043b\u0438\u0442 \u043b\u0438 Cisco SD-WAN \u0441\u0443\u043a, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0441\u0438\u0434\u0438\u0442 DMVPN? | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0421 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 2017 \u0433\u043e\u0434\u0430, \u043a\u043e\u0433\u0434\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cisco \u043f\u0440\u0438\u043e\u0431\u0440\u0435\u043b\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044e Viptela, \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u043c\u043e\u0439 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 \u0441\u0442\u0430\u043b\u0430 Cisco SD-WAN.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/otpilit-li-cisco-sd-wan-suk-na-kotorom-sidit-dmvpn\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-08-12T05:42:24+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-08-12T05:42:24+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47U\u0159\u00edzne Cisco SD-WAN v\u011btev, na kter\u00e9 sed\u00ed DMVPN? | ProHoster","description":"Od srpna 2017, kdy spole\u010dnost Cisco z\u00edskala spole\u010dnost Viptela, se hlavn\u00ed nab\u00edzenou technologi\u00ed pro organizaci distribuovan\u00fdch podnikov\u00fdch s\u00edt\u00ed stalo Cisco SD-WAN.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/otpilit-li-cisco-sd-wan-suk-na-kotorom-sidit-dmvpn","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0442\u043f\u0438\u043b\u0438\u0442 \u043b\u0438 Cisco SD-WAN \u0441\u0443\u043a, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0441\u0438\u0434\u0438\u0442 DMVPN? | ProHoster","og:description":"\u0421 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 2017 \u0433\u043e\u0434\u0430, \u043a\u043e\u0433\u0434\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cisco \u043f\u0440\u0438\u043e\u0431\u0440\u0435\u043b\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044e Viptela, \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u043c\u043e\u0439 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 \u0441\u0442\u0430\u043b\u0430 Cisco SD-WAN.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/otpilit-li-cisco-sd-wan-suk-na-kotorom-sidit-dmvpn","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-12T05:42:24+00:00","article:modified_time":"2020-08-12T05:42:24+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91348","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:29:22","updated":"2026-02-08 20:40:12","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/91348","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=91348"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/91348\/revisions"}],"predecessor-version":[{"id":158011,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/91348\/revisions\/158011"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/91349"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=91348"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=91348"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=91348"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}