{"id":95432,"date":"2020-09-29T07:42:38","date_gmt":"2020-09-29T05:42:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/razbor-samogo-demokratichnogo-iz-sd-wan-arhitektura-nastrojka-administrirovanie-i-podvodnye-kamni"},"modified":"2020-09-29T07:42:38","modified_gmt":"2020-09-29T05:42:38","slug":"razbor-samogo-demokratichnogo-iz-sd-wan-arhitektura-nastrojka-administrirovanie-i-podvodnye-kamni","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/razbor-samogo-demokratichnogo-iz-sd-wan-arhitektura-nastrojka-administrirovanie-i-podvodnye-kamni","title":{"rendered":"Anal\u00fdza nejv\u00edce demokratick\u00e9ho SD-WAN: architektura, nastaven\u00ed, spr\u00e1va a n\u00e1strahy","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Soud\u011b podle po\u010dtu dotaz\u016f, kter\u00e9 k n\u00e1m za\u010daly p\u0159ich\u00e1zet ohledn\u011b SD-WAN, se technologie kone\u010dn\u011b za\u010dala usazovat v Rusku. Dodavatel\u00e9, pochopiteln\u011b, nezah\u00e1lej\u00ed a nab\u00edzej\u00ed sv\u00e9 koncepty, a n\u011bkte\u0159\u00ed odv\u00e1\u017en\u00ed pr\u016fkopn\u00edci je ji\u017e zav\u00e1d\u011bj\u00ed ve sv\u00fdch s\u00edt\u00edch. <\/p>\n

Spolupracujeme t\u00e9m\u011b\u0159 se v\u0161emi dodavateli a za n\u011bkolik let jsem m\u011bl mo\u017enost pod\u00edvat se do architektury ka\u017ed\u00e9ho v\u00fdznamn\u00e9ho v\u00fdvoj\u00e1\u0159e softwarov\u011b definovan\u00fdch \u0159e\u0161en\u00ed. Trochu v\u00fdjime\u010dn\u00e9 je SD-WAN od Fortinet, kter\u00e9 prost\u011b integrovalo funkci vyva\u017eov\u00e1n\u00ed provozu mezi komunika\u010dn\u00edmi kan\u00e1ly do softwaru firewally. Toto \u0159e\u0161en\u00ed je sp\u00ed\u0161e demokratick\u00e9, proto se obvykle zva\u017euje v firn\u00e1ch, kter\u00e9 zat\u00edm nejsou p\u0159ipraveny na glob\u00e1ln\u00ed zm\u011bny, ale cht\u011bj\u00ed efektivn\u011bji vyu\u017e\u00edvat sv\u00e9 komunika\u010dn\u00ed kan\u00e1ly. <\/p>\n

V tomto \u010dl\u00e1nku chci \u0159\u00edci, jak nastavit a pracovat se SD-WAN od Fortinet, komu se toto \u0159e\u0161en\u00ed hod\u00ed a na jak\u00e9 n\u00e1strahy se zde d\u00e1 narazit. <\/a><\/noindex><\/p>\n

Nejv\u00fdrazn\u011bj\u0161\u00ed hr\u00e1\u010de na trhu SD-WAN m\u016f\u017eeme rozd\u011blit do dvou typ\u016f: <\/p>\n

1. Startupy, kter\u00e9 vytvo\u0159ily SD-WAN \u0159e\u0161en\u00ed od z\u00e1kladu. Nej\u00fasp\u011b\u0161n\u011bj\u0161\u00ed z nich z\u00edsk\u00e1vaj\u00ed obrovsk\u00fd impuls k rozvoji po koupi velk\u00fdmi firmami \u2013 to je p\u0159\u00edb\u011bh Cisco\/Viptela, VMware\/VeloCloud, Nuage\/Nokia.<\/p>\n

2. Velc\u00ed s\u00ed\u0165ov\u00ed dodavatel\u00e9, kte\u0159\u00ed vytvo\u0159ili SD-WAN \u0159e\u0161en\u00ed rozvojem programovatelnosti a spravovatelnosti sv\u00fdch tradi\u010dn\u00edch sm\u011brova\u010d\u016f \u2013 to je p\u0159\u00edb\u011bh Juniper, Huawei.<\/p>\n

Fortinet se poda\u0159ilo naj\u00edt svoji cestu. Do softwaru firewall\u016f byla integrov\u00e1na funkce umo\u017e\u0148uj\u00edc\u00ed spojov\u00e1n\u00ed jejich rozhran\u00ed do virtu\u00e1ln\u00edch kan\u00e1l\u016f a vyva\u017eov\u00e1n\u00ed z\u00e1t\u011b\u017ee mezi nimi pomoc\u00ed slo\u017eit\u011bj\u0161\u00edch algoritm\u016f ve srovn\u00e1n\u00ed s b\u011b\u017en\u00fdm sm\u011brov\u00e1n\u00edm. Tato funkce se naz\u00fdv\u00e1 SD-WAN. Lze to, co ud\u011blal Fortinet, nazvat SD-WAN? Na trhu se postupn\u011b ustaluje pochopen\u00ed, \u017ee Software-Defined znamen\u00e1 odd\u011blen\u00ed Control Plane od Data Plane, vyhrazen\u00e9 kontrolery a orchestr\u00e1tory. U Fortinet takov\u00e9 v\u011bci nejsou. Centralizovan\u00e9 \u0159\u00edzen\u00ed je voliteln\u00e9 a nab\u00edz\u00ed se pomoc\u00ed tradi\u010dn\u00edho n\u00e1stroje Fortimanager. Ale podle m\u00e9ho n\u00e1zoru bychom nem\u011bli hledat abstraktn\u00ed pravdu a ztr\u00e1cet \u010das spory o term\u00edny. V re\u00e1ln\u00e9m sv\u011bt\u011b m\u00e1 ka\u017ed\u00fd p\u0159\u00edstup sv\u00e9 v\u00fdhody a nev\u00fdhody. Nejlep\u0161\u00ed cesta je se v nich vyznat a um\u011bt vyb\u00edrat \u0159e\u0161en\u00ed, kter\u00e1 odpov\u00eddaj\u00ed \u00fakol\u016fm. <\/p>\n

Pokud m\u00e1m dva skandin\u00e1vsk\u00e9 \u00fa\u0159ady, kter\u00e9 jsou propojeny dv\u011bma datov\u00fdmi kan\u00e1ly, pokus\u00edm se v\u00e1m prost\u0159ednictv\u00edm screenshot\u016f uk\u00e1zat, jak vypad\u00e1 a co um\u00ed SD-WAN od Fortinet.<\/p>\n

Jak to v\u0161echno funguje <\/h3>\n

\nP\u0159edstavme si, \u017ee m\u00e1te dv\u011b pobo\u010dky propojen\u00e9 dv\u011bma datov\u00fdmi kan\u00e1ly. Tyto kan\u00e1ly se sdru\u017euj\u00ed do skupiny, podobn\u011b jako oby\u010dejn\u00e9 ethernetov\u00e9 rozhran\u00ed se spojuje v LACP-Port-Channel. Dlouhodob\u00ed u\u017eivatel\u00e9 si vzpomenou na PPP Multilink \u2013 to je tak\u00e9 vhodn\u00e1 analogie. Tyto kan\u00e1ly mohou b\u00fdt fyzick\u00e9 porty, VLAN SVI, nebo tak\u00e9 VPN<\/a> \u010di GRE tunely. <\/p>\n

VPN nebo GRE se obvykle pou\u017e\u00edvaj\u00ed p\u0159i propojen\u00ed m\u00edstn\u00edch s\u00edt\u00ed pobo\u010dek p\u0159es internet. Fyzick\u00e9 porty jsou vyu\u017e\u00edv\u00e1ny, pokud existuj\u00ed L2 spojen\u00ed mezi lokalitami, nebo pokud je spojen\u00ed p\u0159es dedikovan\u00e9 MPLS\/VPN p\u0159ijateln\u00e9, pokud jsme spokojeni s komunikac\u00ed bez overlay a \u0161ifrov\u00e1n\u00ed. Dal\u0161\u00edm sc\u00e9n\u00e1\u0159em, kde jsou v SD-WAN skupin\u011b pou\u017eity fyzick\u00e9 porty, je vyv\u00e1\u017een\u00ed lok\u00e1ln\u00edho p\u0159\u00edstupu u\u017eivatel\u016f na internet.<\/p>\n

Na na\u0161em st\u00e1nku m\u00e1me \u010dty\u0159i firewally a dva VPN tunely, kter\u00e9 funguj\u00ed p\u0159es dva \u201etelekomunika\u010dn\u00ed oper\u00e1tory\u201c. Sch\u00e9ma vypad\u00e1 takto:<\/p>\n

\"Anal\u00fdza
\n
\nVPN tunely jsou nastaveny v rozhran\u00ed, aby p\u0159ipom\u00ednaly spojen\u00ed typu Point-to-Point mezi za\u0159\u00edzen\u00edmi s IP adresami na P2P rozhran\u00edch, kter\u00e9 lze pingnout a ov\u011b\u0159it, \u017ee komunikace p\u0159es konkr\u00e9tn\u00ed tunel funguje. Aby se provoz za\u0161ifroval a ode\u0161el na druhou stranu, sta\u010d\u00ed ho sm\u011brovat do tunelu. Alternativa \u2013 v\u00fdb\u011br provozu pro \u0161ifrov\u00e1n\u00ed pomoc\u00ed seznam\u016f pods\u00edt\u00ed, siln\u011b komplikuje administraci, jak se konfigurace zkomplikuje. V rozs\u00e1hl\u00e9 s\u00edti lze pro v\u00fdstavbu VPN pou\u017e\u00edt technologii ADVPN, co\u017e je analogick\u00e9 DMVPN od Cisco nebo DVPN od Huawei, co\u017e usnad\u0148uje nastaven\u00ed.<\/p>\n

Konfigurace Site-to-Site VPN pro dv\u011b za\u0159\u00edzen\u00ed s BGP sm\u011brov\u00e1n\u00edm z obou stran<\/b>
\n <\/p>\n

\"DC\" (Data Center)
\n\"BRN\" (Pobo\u010dka)<\/p>\n

config system interface
\n\u2003edit \"WAN1\"
\n\u2003\u2003set vdom \"Internet\"
\n\u2003\u2003set ip 1.1.1.1 255.255.255.252
\n\u2003\u2003set allowaccess ping
\n\u2003\u2003set role wan
\n\u2003\u2003set interface \"DC-BRD\"
\n\u2003\u2003set vlanid 111
\n\u2003next
\n\u2003edit \"WAN2\"
\n\u2003\u2003set vdom \"Internet\"
\n\u2003\u2003set ip 3.3.3.1 255.255.255.252
\n\u2003\u2003set allowaccess ping
\n\u2003\u2003set role lan
\n\u2003\u2003set interface \"DC-BRD\"
\n\u2003\u2003set vlanid 112
\n\u2003next
\n\u2003edit \"BRN-Ph1-1\"
\n\u2003\u2003set vdom \"Internet\"
\n\u2003\u2003set ip 192.168.254.1 255.255.255.255
\n\u2003\u2003set allowaccess ping
\n\u2003\u2003set type tunnel
\n\u2003\u2003set remote-ip 192.168.254.2 255.255.255.255
\n\u2003\u2003set interface \"WAN1\"
\n\u2003next
\n\u2003edit \"BRN-Ph1-2\"
\n\u2003\u2003set vdom \"Internet\"
\n\u2003\u2003set ip 192.168.254.3 255.255.255.255
\n\u2003\u2003set allowaccess ping
\n\u2003\u2003set type tunnel
\n\u2003\u2003set remote-ip 192.168.254.4 255.255.255.255
\n\u2003\u2003set interface \"WAN2\"
\n\u2003next
\nend<\/p>\n

config vpn ipsec phase1-interface
\n\u2003edit \"BRN-Ph1-1\"
\n\u2003\u2003set interface \"WAN1\"
\n\u2003\u2003set local-gw 1.1.1.1
\n\u2003\u2003set peertype any
\n\u2003\u2003set net-device disable
\n\u2003\u2003set proposal aes128-sha1
\n\u2003\u2003set dhgrp 2
\n\u2003\u2003set remote-gw 2.2.2.1
\n\u2003\u2003set psksecret ***
\n\u2003next
\n\u2003edit \"BRN-Ph1-2\"
\n\u2003\u2003set interface \"WAN2\"
\n\u2003\u2003set local-gw 3.3.3.1
\n\u2003\u2003set peertype any
\n\u2003\u2003set net-device disable
\n\u2003\u2003set proposal aes128-sha1
\n\u2003\u2003set dhgrp 2
\n\u2003\u2003set remote-gw 4.4.4.1
\n\u2003\u2003set psksecret ***
\n\u2003next
\nend<\/p>\n

config vpn ipsec phase2-interface
\n\u2003edit \"BRN-Ph2-1\"
\n\u2003\u2003set phase1name \"BRN-Ph1-1\"
\n\u2003\u2003nastavit n\u00e1vrh aes256-sha256
\n\u2003\u2003set dhgrp 2
\n\u2003next
\n\u2003edit \"BRN-Ph2-2\"
\n\u2003\u2003set phase1name \"BRN-Ph1-2\"
\n\u2003\u2003nastavit n\u00e1vrh aes256-sha256
\n\u2003\u2003set dhgrp 2
\n\u2003next
\nend<\/p>\n

konfigurace routeru static
\n\u2003uprav 1
\n\u2003\u2003nastavit br\u00e1nu 1.1.1.2
\n\u2003\u2003set device \"WAN1\"
\n\u2003next
\n\u2003uprav 3
\n\u2003\u2003nastavit br\u00e1nu 3.3.3.2
\n\u2003\u2003set device \"WAN2\"
\n\u2003next
\nend<\/p>\n

konfigurace routeru bgp
\n\u2003nastavit as 65002
\n\u2003nastavit router-id 10.1.7.1
\n\u2003nastavit ebgp-multipath zapnout
\n\u2003konfigurace souseda
\n\u2003\u2003edit \"192.168.254.2\"
\n\u2003\u2003\u2003nastavit remote-as 65003
\n\u2003\u2003dal\u0161\u00ed
\n\u2003\u2003edit \"192.168.254.4\"
\n\u2003\u2003\u2003nastavit remote-as 65003
\n\u2003\u2003dal\u0161\u00ed
\n\u2003konec<\/p>\n

\u2003konfigurace s\u00edt\u011b
\n\u2003\u2003uprav 1
\n\u2003\u2003\u2003nastavit prefix 10.1.0.0 255.255.0.0
\n\u2003\u2003dal\u0161\u00ed
\nend <\/p>\n

config system interface
\n\u2003edit \"WAN1\"
\n\u2003\u2003set vdom \"Internet\"
\n\u2003\u2003nastavit ip 2.2.2.1 255.255.255.252
\n\u2003\u2003set allowaccess ping
\n\u2003\u2003set role wan
\n\u2003\u2003set interface \"BRN-BRD\"
\n\u2003\u2003set vlanid 111
\n\u2003next
\n\u2003edit \"WAN2\"
\n\u2003\u2003set vdom \"Internet\"
\n\u2003\u2003nastavit ip 4.4.4.1 255.255.255.252
\n\u2003\u2003set allowaccess ping
\n\u2003\u2003set role wan
\n\u2003\u2003set interface \"BRN-BRD\"
\n\u2003\u2003nastavit vlanid 114
\n\u2003next
\n\u2003edit \"DC-Ph1-1\"
\n\u2003\u2003set vdom \"Internet\"
\n\u2003\u2003nastavit ip 192.168.254.2 255.255.255.255
\n\u2003\u2003set allowaccess ping
\n\u2003\u2003set type tunnel
\n\u2003\u2003nastavit remote-ip 192.168.254.1 255.255.255.255
\n\u2003\u2003set interface \"WAN1\"
\n\u2003next
\n\u2003edit \"DC-Ph1-2\"
\n\u2003\u2003set vdom \"Internet\"
\n\u2003\u2003nastavit ip 192.168.254.4 255.255.255.255
\n\u2003\u2003set allowaccess ping
\n\u2003\u2003set type tunnel
\n\u2003\u2003nastavit remote-ip 192.168.254.3 255.255.255.255
\n\u2003\u2003set interface \"WAN2\"
\n\u2003next
\nend<\/p>\n

config vpn ipsec phase1-interface
\n\u2003 edit \"DC-Ph1-1\"
\n\u2003\u2003 set interface \"WAN1\"
\n\u2003\u2003nastavit m\u00edstn\u00ed-gw 2.2.2.1
\n\u2003\u2003nastavit peertype jak\u00fdkoli
\n\u2003\u2003nastavit net-device zak\u00e1zat
\n\u2003\u2003nastavit n\u00e1vrh aes128-sha1
\n\u2003\u2003nastavit dhgrp 2
\n\u2003\u2003nastavit remote-gw 1.1.1.1
\n\u2003\u2003nastavit psksecret ***
\n\u2003dal\u0161\u00ed
\n\u2003 edit \"DC-Ph1-2\"
\n\u2003\u2003 set interface \"WAN2\"
\n\u2003\u2003nastavit m\u00edstn\u00ed-gw 4.4.4.1
\n\u2003\u2003nastavit peertype jak\u00fdkoli
\n\u2003\u2003nastavit net-device zak\u00e1zat
\n\u2003\u2003nastavit n\u00e1vrh aes128-sha1
\n\u2003\u2003nastavit dhgrp 2
\n\u2003\u2003nastavit remote-gw 3.3.3.1
\n\u2003\u2003nastavit psksecret ***
\n\u2003dal\u0161\u00ed
\nend<\/p>\n

config vpn ipsec phase2-interface
\n\u2003 edit \"DC-Ph2-1\"
\n\u2003\u2003 set phase1name \"DC-Ph1-1\"
\n\u2003\u2003nastavit n\u00e1vrh aes128-sha1
\n\u2003\u2003nastavit dhgrp 2
\n\u2003dal\u0161\u00ed
\n\u2003 edit \"DC2-Ph2-2\"
\n\u2003\u2003 set phase1name \"DC-Ph1-2\"
\n\u2003\u2003nastavit n\u00e1vrh aes128-sha1
\n\u2003\u2003nastavit dhgrp 2
\n\u2003dal\u0161\u00ed
\nend<\/p>\n

konfigurace routeru static
\n\u2003uprav 1
\n\u2003\u2003nastavit br\u00e1nu 2.2.2.2
\n\u2003\u2003et device \"WAN1\"
\n\u2003next
\n\u2003uprav 3
\n\u2003\u2003nastavit br\u00e1nu 4.4.4.2
\n\u2003\u2003set device \"WAN2\"
\n\u2003next
\nend<\/p>\n

konfigurace routeru bgp
\n\u2003nastavit as 65003
\n\u2003nastavit router-id 10.200.7.1
\n\u2003nastavit ebgp-multipath zapnout
\n\u2003konfigurace souseda
\n\u2003\u2003 edit \"192.168.254.1\"
\n\u2003\u2003\u2003nastavit remote-as 65002
\n\u2003\u2003dal\u0161\u00ed
\n\u2003\u2003edit \"192.168.254.3\"
\n\u2003\u2003\u2003nastavit remote-as 65002
\n\u2003\u2003dal\u0161\u00ed
\n\u2003konec<\/p>\n

\u2003konfigurace s\u00edt\u011b
\n\u2003\u2003uprav 1
\n\u2003\u2003\u2003nastavit prefix 10.200.0.0 255.255.0.0
\n\u2003\u2003dal\u0161\u00ed
\n end <\/p>\n

<\/code><\/p>\n

P\u0159edstav\u00edm konfiguraci v textov\u00e9m form\u00e1tu, proto\u017ee podle m\u00e9ho n\u00e1zoru je tak konfigurace VPN pohodln\u011bj\u0161\u00ed. V\u0161echny nastaven\u00ed na obou stran\u00e1ch jsou t\u00e9m\u011b\u0159 stejn\u00e9, v textov\u00e9m form\u00e1tu je lze ud\u011blat kop\u00edrovat-a-vlo\u017eit. Pokud to ud\u011bl\u00e1te stejn\u011b v webov\u00e9m rozhran\u00ed, snadno se m\u016f\u017eete dopustit chyby \u2014 zapomenout na n\u011bjakou mo\u017enost, zadat nespr\u00e1vnou hodnotu. <\/p>\n

Jakmile p\u0159id\u00e1me rozhran\u00ed do bal\u00ed\u010dku<\/p>\n

\"Anal\u00fdza
\n
\nv\u0161echny trasy a bezpe\u010dnostn\u00ed politiky se na n\u011bj mohou odvol\u00e1vat, a ne na rozhran\u00ed, kter\u00e9 do n\u011bj pat\u0159\u00ed. Minim\u00e1ln\u011b je t\u0159eba povolit provoz z intern\u00edch s\u00edt\u00ed do SD-WAN. P\u0159i vytv\u00e1\u0159en\u00ed pravidel pro n\u011b lze pou\u017e\u00edt ochrann\u00e1 opat\u0159en\u00ed, jako je IPS, antivirov\u00fd software a roz\u0161\u00ed\u0159en\u00e9 HTTPS.<\/p>\n

\"Anal\u00fdza
\n
\nPro bal\u00ed\u010dek se nastavuj\u00ed SD-WAN pravidla. Tato pravidla ur\u010duj\u00ed algoritmus vyva\u017eov\u00e1n\u00ed pro konkr\u00e9tn\u00ed provoz. Jsou podobn\u00e1 politik\u00e1m sm\u011brov\u00e1n\u00ed v Policy-Based Routing, pouze jako v\u00fdsledek za\u0159azen\u00ed provozu do politiky se nenastavuje next-hop nebo b\u011b\u017en\u00e9 v\u00fdstupn\u00ed rozhran\u00ed, ale rozhran\u00ed p\u0159idan\u00e1 do bal\u00ed\u010dku SD-WAN spolu s algoritmem vyva\u017eov\u00e1n\u00ed provozu mezi t\u011bmito rozhran\u00edmi. <\/p>\n

Provoz lze odd\u011blit z celkov\u00e9ho proudu na z\u00e1klad\u011b informac\u00ed L3-L4, na rozpoznan\u00fdch aplikac\u00edch, internetov\u00fdch slu\u017eb\u00e1ch (URL a IP), stejn\u011b jako na rozpoznan\u00fdch u\u017eivatel\u00edch pracovn\u00edch stanic a notebook\u016f. Pot\u00e9 lze pro odd\u011blen\u00fd provoz p\u0159i\u0159adit jeden z n\u00e1sleduj\u00edc\u00edch algoritm\u016f vyva\u017eov\u00e1n\u00ed:<\/p>\n

\"Anal\u00fdza
\n
\nV seznamu Preference rozhran\u00ed se vyb\u00edraj\u00ed ta rozhran\u00ed z ji\u017e p\u0159idan\u00fdch do bal\u00ed\u010dku, kter\u00e1 budou obsluhovat tento typ provozu. P\u0159id\u00e1n\u00edm ne v\u0161ech rozhran\u00ed m\u016f\u017eete omezit, po jak\u00fdch konkr\u00e9tn\u00edch kan\u00e1lech v\u00e1m nap\u0159\u00edklad prob\u00edh\u00e1 elektronick\u00e1 po\u0161ta, pokud nechcete zat\u011b\u017eovat drah\u00e9 kan\u00e1ly s vysok\u00fdm SLA. Ve FortiOS 6.4.1 se objevila mo\u017enost seskupovat rozhran\u00ed p\u0159idan\u00e1 do SD-WAN bal\u00ed\u010dku do z\u00f3n, \u010d\u00edm\u017e m\u016f\u017eete nap\u0159\u00edklad vytvo\u0159it jednu z\u00f3nu pro spojen\u00ed s vzd\u00e1len\u00fdmi lokalitami a druhou pro m\u00edstn\u00ed p\u0159\u00edstup k internetu s vyu\u017eit\u00edm NAT. Ano, provoz, kter\u00fd jde na oby\u010dejn\u00fd internet, tak\u00e9 lze vyva\u017eovat.<\/p>\n

O algoritmech vyva\u017eov\u00e1n\u00ed
\n<\/h3>\n

\nPokud jde o to, jak Fortigate (firewall od Fortinet) um\u00ed rozd\u011blovat provoz mezi kan\u00e1ly, existuj\u00ed dv\u011b zaj\u00edmav\u00e9 mo\u017enosti, kter\u00e9 nejsou na trhu p\u0159\u00edli\u0161 roz\u0161\u00ed\u0159en\u00e9:<\/p>\n

Nejni\u017e\u0161\u00ed cena (SLA)<\/b> \u2013 ze v\u0161ech rozhran\u00ed, kter\u00e1 v danou chv\u00edli spl\u0148uj\u00ed SLA, se vyb\u00edr\u00e1 to, kter\u00e9 m\u00e1 ni\u017e\u0161\u00ed v\u00e1hu (cost), zadanou administr\u00e1torem ru\u010dn\u011b; tento re\u017eim je vhodn\u00fd pro 'objemov\u00fd' provoz, jako je z\u00e1lohov\u00e1n\u00ed a p\u0159enos soubor\u016f. <\/p>\n

Nejlep\u0161\u00ed kvalita (SLA)<\/b> \u2013 tento algoritmus, krom\u011b obvykl\u00fdch latenc\u00ed, jitteru a ztr\u00e1ty paket\u016f, Fortigate pro hodnocen\u00ed kvality kan\u00e1l\u016f m\u016f\u017ee vyu\u017e\u00edvat tak\u00e9 aktu\u00e1ln\u00ed zat\u00ed\u017een\u00ed kan\u00e1lu; tento re\u017eim je vhodn\u00fd pro 'citliv\u00fd' provoz, jako je IP telefonie (VoIP) a videokonferen\u010dn\u00ed spojen\u00ed.<\/p>\n

Pro tyto algoritmy je vy\u017eadov\u00e1no nastaven\u00ed m\u011b\u0159i\u010de v\u00fdkonnosti kan\u00e1lu \u2013 Performance SLA. Tento m\u011b\u0159i\u010d pravideln\u011b (check interval) kontroluje informace o dodr\u017eov\u00e1n\u00ed SLA: ztr\u00e1t\u00e1ch (packet loss), latenci (latency) a jitteru (jitter) v kan\u00e1lu, a m\u016f\u017ee \"zam\u00edtnout\" ty kan\u00e1ly, kter\u00e9 v sou\u010dasnosti nespl\u0148uj\u00ed prahov\u00e9 hodnoty kvality \u2013 ztr\u00e1cej\u00ed p\u0159\u00edli\u0161 mnoho paket\u016f nebo vykazuj\u00ed p\u0159\u00edli\u0161 vysokou latenci. Krom\u011b toho m\u011b\u0159i\u010d sleduje stav kan\u00e1lu a m\u016f\u017ee jej do\u010dasn\u011b odstranit z bal\u00edku v p\u0159\u00edpad\u011b opakovan\u00fdch ztr\u00e1t odpov\u011bd\u00ed (failures before inactive). Po obnoven\u00ed, po n\u011bkolika po sob\u011b jdouc\u00edch p\u0159ijat\u00fdch odpov\u011bd\u00edch (restore link after), se m\u011b\u0159i\u010d automaticky vr\u00e1t\u00ed kan\u00e1l zp\u011bt do bal\u00edku a p\u0159es n\u011bj se op\u011bt za\u010dnou p\u0159en\u00e1\u0161et data.<\/p>\n

Takto vypad\u00e1 nastaven\u00ed \"m\u011b\u0159i\u010de\": <\/p>\n

\"Anal\u00fdza
\n
\nVe webov\u00e9m rozhran\u00ed jsou jako protokoly pro testov\u00e1n\u00ed dostupn\u00e9 ICMP-Echo-request, HTTP-GET a DNS request. V p\u0159\u00edkazov\u00e9m \u0159\u00e1dku je dostupn\u00fdch o n\u011bco v\u00edce mo\u017enost\u00ed: jsou k dispozici mo\u017enosti TCP-echo a UDP-echo, stejn\u011b jako specializovan\u00fd protokol pro m\u011b\u0159en\u00ed kvality \u2013 TWAMP.<\/p>\n

\"Anal\u00fdza
\n
\nV\u00fdsledky m\u011b\u0159en\u00ed lze vid\u011bt i ve webov\u00e9m rozhran\u00ed: <\/p>\n

\"Anal\u00fdza
\n
\nA v p\u0159\u00edkazov\u00e9m \u0159\u00e1dku: <\/p>\n

\"Anal\u00fdza
\n<\/p>\n

Troubleshooting<\/h3>\n

\nPokud jste vytvo\u0159ili pravidlo, ale funguje to jinak, ne\u017e jste o\u010dek\u00e1vali, je dobr\u00e9 se pod\u00edvat na hodnotu Hit Count v seznamu SD-WAN Rules. Ta uk\u00e1\u017ee, zda v\u016fbec proud\u00ed provoz do dan\u00e9ho pravidla:<\/p>\n

\"Anal\u00fdza
\n
\nNa str\u00e1nce nastaven\u00ed samotn\u00e9ho m\u011b\u0159i\u010de lze vid\u011bt zm\u011bnu parametr\u016f kan\u00e1lu v \u010dase. P\u0159eru\u0161ovan\u011b je vyzna\u010deno prahov\u00e9 hodnoty parametru.<\/p>\n

\"Anal\u00fdza
\n
\nVe webov\u00e9m rozhran\u00ed lze sledovat, jak se distribuuje provoz podle objemu p\u0159en\u00e1\u0161en\u00fdch\/p\u0159ijat\u00fdch dat a po\u010dtu relac\u00ed:<\/p>\n

\"Anal\u00fdza
\n
\nKrom\u011b toho existuje skv\u011bl\u00e1 p\u0159\u00edle\u017eitost sledovat pr\u016fchod paket\u016f s maxim\u00e1ln\u00edmi detaily. P\u0159i pr\u00e1ci v re\u00e1ln\u00e9 s\u00edti se v konfiguraci za\u0159\u00edzen\u00ed hromad\u00ed mno\u017estv\u00ed politik sm\u011brov\u00e1n\u00ed, firewallu a distribuce provozu p\u0159es SD-WAN porty. To v\u0161e slo\u017eit\u011b vz\u00e1jemn\u011b interaguje a i kdy\u017e dodavatel uv\u00e1d\u00ed podrobn\u00e9 blokov\u00e9 diagramy algoritm\u016f zpracov\u00e1n\u00ed paket\u016f, je velmi d\u016fle\u017eit\u00e9 m\u00edt mo\u017enost nep\u0159edpokl\u00e1dat a neov\u011b\u0159ovat teorie, ale vid\u011bt, kam se provoz skute\u010dn\u011b dost\u00e1v\u00e1.<\/p>\n

Nap\u0159\u00edklad n\u00e1sleduj\u00edc\u00ed sada p\u0159\u00edkaz\u016f<\/p>\n

diagnostikovat ladic\u00ed tok filtr saddr 10.200.64.15
\ndiagnostikovat ladic\u00ed tok filtr daddr 10.1.7.2
\ndiagnostikovat ladic\u00ed tok zobrazit n\u00e1zev-funkce
\ndiagnostikovat ladic\u00ed zapnout
\ndiagnostikovat ladic\u00ed stopa 2<\/code><\/p>\n

Umo\u017en\u00ed sledovat dva pakety s adresou zdroje 10.200.64.15 a adresou p\u0159\u00edjemce 10.1.7.2.
\nPingujieme 10.7.1.2 z 10.200.64.15 dvakr\u00e1t a sledujeme v\u00fdstup na konzoli.<\/p>\n

Prvn\u00ed paket:<\/p>\n

\"Anal\u00fdza
\n
\nDruh\u00fd paket:<\/p>\n

\"Anal\u00fdza
\n
\nTady je prvn\u00ed paket, kter\u00fd byl p\u0159ijat firewallem:
\nid=20085 trace_id=475 func=print_pkt_detail line=5605 msg=\"vd-Internet:0 received a packet(proto=1, 10.200.64.15:42->10.1.7.2:2048) from DMZ-Office. type=8, code=0, id=42, seq=0.\"
\nVDOM \u2013 Internet, Proto=1 (ICMP), DMZ-Office \u2013 n\u00e1zev L3 rozhran\u00ed. <\/b>Typ=8 \u2013 Echo.<\/code><\/p>\n

Pro n\u011bj byla vytvo\u0159ena nov\u00e1 relace:
\nmsg=\"alokovat novou relaci-0006a627\"<\/code><\/p>\n

A zjistilo se, \u017ee nastaven\u00ed pravidel sm\u011brov\u00e1n\u00ed se shoduje
\nmsg=\"Shoda sm\u011brovac\u00ed politiky id=2136539137: na 10.1.7.2 p\u0159es ifindex-110\"<\/code><\/p>\n

Zji\u0161\u0165uje se, \u017ee paket je t\u0159eba poslat do jednoho z VPN tunel\u016f:
\n\"naj\u00edt trasu: vlajka=04000000 gw-192.168.254.1 p\u0159es DC-Ph1-1\"<\/code><\/p>\n

V pravidlech firewallu se nach\u00e1z\u00ed povoluj\u00edc\u00ed pravidlo:
\nmsg=\"Povolen\u00e9 politikou-3:\"<\/code><\/p>\n

Paket je \u0161ifrov\u00e1n a odes\u00edl\u00e1n do VPN tunelu:
\nfunc=ipsecdev_hard_start_xmit line=789 msg=\"vstup do IPsec interface-DC-Ph1-1\"
\nfunc=_ipsecdev_hard_start_xmit line=666 msg=\"IPsec tunel-DC-Ph1-1\"
\nfunc=esp_output4 line=905 msg=\"IPsec \u0161ifrov\u00e1n\u00ed\/autentizace\"<\/code><\/p>\n

\u0160ifrovan\u00fd paket je odes\u00edl\u00e1n na adresu br\u00e1ny pro toto WAN rozhran\u00ed:
\nmsg=\"odeslat na 2.2.2.2 p\u0159es intf-WAN1\"<\/code><\/p>\n

Druh\u00fd paket proch\u00e1z\u00ed stejn\u00fdm procesem, ale je posl\u00e1n do jin\u00e9ho VPN tunelu a proch\u00e1z\u00ed jin\u00fdm portem firewallem:
\nfunc=ipsecdev_hard_start_xmit line=789 msg=\"vstup do IPsec rozhran\u00ed-DC-Ph1-2\"
\nfunc=_ipsecdev_hard_start_xmit line=666 msg=\"IPsec tunel-DC-Ph1-2\"
\nfunc=esp_output4 line=905 msg=\"IPsec \u0161ifrov\u00e1n\u00ed\/autentizace\"
\nfunc=ipsec_output_finish line=622 msg=\"odeslat na 4.4.4.2 p\u0159es intf-WAN2\"<\/code><\/p>\n

V\u00fdhody \u0159e\u0161en\u00ed
\n<\/h3>\n

\nSpolehliv\u00e1 funk\u010dnost a u\u017eivatelsky p\u0159\u00edv\u011btiv\u00e9 rozhran\u00ed. <\/b>Soubor funkc\u00ed, kter\u00fd byl k dispozici ve FortiOS p\u0159ed p\u0159\u00edchodem SD-WAN, z\u016fstal zcela zachov\u00e1n. To znamen\u00e1, \u017ee m\u00e1me zral\u00fd syst\u00e9m od osv\u011bd\u010den\u00e9ho dodavatele firewall\u016f, ne znovu vyvinut\u00fd software. S tradi\u010dn\u00edm souborem s\u00ed\u0165ov\u00fdch funkc\u00ed a pohodln\u00fdm, snadno ovladateln\u00fdm webov\u00fdm rozhran\u00edm. Mnoh\u00e9 dodavatele SD-WAN maj\u00ed na koncov\u00fdch za\u0159\u00edzen\u00edch, \u0159ekn\u011bme, funkci Remote-Access VPN?<\/p>\n

Bezpe\u010dnost 80. \u00farovn\u011b. <\/b>FortiGate pat\u0159\u00ed mezi nejlep\u0161\u00ed \u0159e\u0161en\u00ed pro firewall. Na internetu je mnoho materi\u00e1l\u016f o konfiguraci a spr\u00e1v\u011b firewall\u016f a na trhu je dost specialist\u016f na bezpe\u010dnost, kte\u0159\u00ed ji\u017e ovl\u00e1dli \u0159e\u0161en\u00ed tohoto dodavatele.<\/p>\n

Nulov\u00e1 cena za funk\u010dnost SD-WAN. <\/b>Vytvo\u0159en\u00ed SD-WAN s\u00edt\u011b na FortiGate stoj\u00ed stejn\u011b jako vytvo\u0159en\u00ed tradi\u010dn\u00ed WAN s\u00edt\u011b, proto\u017ee nejsou pot\u0159eba \u017e\u00e1dn\u00e9 dal\u0161\u00ed licence pro realizaci funkce SD-WAN. <\/p>\n

N\u00edzk\u00fd cenov\u00fd pr\u00e1h vstupu. <\/b>Fortigate m\u00e1 dobrou gradaci za\u0159\u00edzen\u00ed pro r\u016fzn\u00e9 \u00farovn\u011b v\u00fdkonu. Nejlevn\u011bj\u0161\u00ed a nejmen\u0161\u00ed modely jsou zcela vhodn\u00e9 pro rozjezd kancel\u00e1\u0159e nebo prodejn\u00edho m\u00edsta, \u0159ekn\u011bme, pro 3-5 zam\u011bstnanc\u016f. Mnoho dodavatel\u016f takov\u00e9 n\u00edzkov\u00fdkonnostn\u00ed a dostupn\u00e9 modely jednodu\u0161e nem\u00e1. <\/p>\n

Vysok\u00fd v\u00fdkon. <\/b>Sn\u00ed\u017een\u00ed funk\u010dnosti SD-WAN na vyva\u017eov\u00e1n\u00ed provozu umo\u017enilo spole\u010dnosti vydat specializovan\u00fd SD-WAN ASIC, d\u00edky kter\u00e9mu pr\u00e1ce SD-WAN neovliv\u0148uje v\u00fdkon firewallu jako celku. <\/p>\n

Mo\u017enost realizovat cel\u00fd \u00fa\u0159ad na za\u0159\u00edzen\u00ed Fortinet. <\/b>Toto je p\u00e1r firewall\u016f, p\u0159ep\u00edna\u010d\u016f a Wi-Fi p\u0159\u00edstupov\u00fdch bod\u016f. Takovou kancel\u00e1\u0159 je snadn\u00e9 a pohodln\u00e9 spravovat - p\u0159ep\u00edna\u010de a p\u0159\u00edstupov\u00e9 body jsou registrov\u00e1ny na firewallech a spravuj\u00ed se z nich. Takto m\u016f\u017ee vypadat port p\u0159ep\u00edna\u010de na rozhran\u00ed firewallu, kter\u00fdm je tento p\u0159ep\u00edna\u010d \u0159\u00edzen:<\/p>\n

\"Anal\u00fdza
\n
\nNedostatek ovlada\u010d\u016f jako jednotn\u00e9ho bodu selh\u00e1n\u00ed. <\/b>Na to upozor\u0148uje s\u00e1m dodavatel, ale toto lze nazvat v\u00fdhodou pouze \u010d\u00e1ste\u010dn\u011b, proto\u017ee u t\u011bch dodavatel\u016f, kte\u0159\u00ed ovlada\u010de maj\u00ed, zaji\u0161t\u011bn\u00ed jejich odolnosti v\u016f\u010di selh\u00e1n\u00ed p\u0159ich\u00e1z\u00ed na n\u00edzk\u00e9 n\u00e1klady, v\u011bt\u0161inou v cen\u011b mal\u00e9ho mno\u017estv\u00ed v\u00fdpo\u010detn\u00edch zdroj\u016f ve virtu\u00e1ln\u00edm prost\u0159ed\u00ed.<\/p>\n

Na co si d\u00e1t pozor
\n<\/h3>\n

\nNedostatek odd\u011blen\u00ed Control Plane a Data Plane<\/b>. To znamen\u00e1, \u017ee s\u00ed\u0165 je t\u0159eba nastavovat bu\u010f ru\u010dn\u011b, nebo pomoc\u00ed ji\u017e existuj\u00edc\u00edch tradi\u010dn\u00edch n\u00e1stroj\u016f spr\u00e1vy - FortiManager. U dodavatel\u016f, kte\u0159\u00ed maj\u00ed toto odd\u011blen\u00ed realizov\u00e1no, se s\u00ed\u0165 skl\u00e1d\u00e1 sama. Spr\u00e1vci m\u016f\u017ee b\u00fdt pot\u0159eba pouze upravit jej\u00ed topologii, n\u011bco n\u011bkde zak\u00e1zat, nic v\u00edc. Nicm\u00e9n\u011b, v\u00fdhodou FortiManageru je to, \u017ee um\u00ed spravovat nejen firewally, ale tak\u00e9 p\u0159ep\u00edna\u010de a Wi-Fi p\u0159\u00edstupov\u00e9 body, co\u017e pokr\u00fdv\u00e1 prakticky celou s\u00ed\u0165. <\/p>\n

Podm\u00edn\u011bn\u00fd r\u016fst spravovatelnosti. <\/b>Vzhledem k tomu, \u017ee pro automatizaci nastaven\u00ed s\u00edt\u011b se pou\u017e\u00edvaj\u00ed tradi\u010dn\u00ed n\u00e1stroje, zvy\u0161uje se spravovatelnost s\u00edt\u011b s implementac\u00ed SD-WAN jen minim\u00e1ln\u011b. Na druh\u00e9 stran\u011b, nov\u00e1 funk\u010dnost se st\u00e1v\u00e1 dostupnou rychleji, proto\u017ee dodavatel ji nejprve uv\u00e1d\u00ed pouze pro opera\u010dn\u00ed syst\u00e9m firewall\u016f (co\u017e okam\u017eit\u011b poskytuje mo\u017enost ji pou\u017e\u00edvat), a teprve pot\u00e9 dopl\u0148uje pot\u0159ebn\u00e9 rozhran\u00ed pro \u0159\u00edzen\u00ed.<\/p>\n

\u010c\u00e1st funk\u010dnosti m\u016f\u017ee b\u00fdt dostupn\u00e1 z p\u0159\u00edkazov\u00e9ho \u0159\u00e1dku, ale nen\u00ed dostupn\u00e1 z webov\u00e9ho rozhran\u00ed. <\/b>Nen\u00ed to tak stra\u0161n\u00e9 ob\u010das vstoupit do p\u0159\u00edkazov\u00e9ho \u0159\u00e1dku, aby bylo n\u011bco nastaveno, jako je stra\u0161n\u00e9 nevid\u011bt na webov\u00e9m rozhran\u00ed, \u017ee n\u011bco bylo ji\u017e nastaveno p\u0159\u00edkazov\u00fdm \u0159\u00e1dkem. To se obvykle t\u00fdk\u00e1 nejnov\u011bj\u0161\u00edch funkc\u00ed a postupn\u011b, se aktualizacemi FortiOS, se mo\u017enosti webov\u00e9ho rozhran\u00ed dost\u00e1vaj\u00ed na \u00farove\u0148.<\/p>\n

Komu se to hod\u00ed<\/h3>\n

\nT\u011bm, kte\u0159\u00ed nemaj\u00ed p\u0159\u00edli\u0161 mnoho pobo\u010dek.<\/b> Nasazen\u00ed \u0159e\u0161en\u00ed SD-WAN se slo\u017eit\u00fdmi centr\u00e1ln\u00edmi komponenty v s\u00edt\u00edch s 8\u201310 pobo\u010dkami si mo\u017en\u00e1 nezaslou\u017e\u00ed investice \u2013 budete muset vynalo\u017eit pen\u00edze na licence pro SD-WAN za\u0159\u00edzen\u00ed a na zdroje virtualiza\u010dn\u00edho syst\u00e9mu pro um\u00edst\u011bn\u00ed centr\u00e1ln\u00edch komponent. Mal\u00e9 firmy obvykle nemaj\u00ed dostatek voln\u00fdch v\u00fdpo\u010detn\u00edch zdroj\u016f. V p\u0159\u00edpad\u011b spole\u010dnosti Fortinet sta\u010d\u00ed jednodu\u0161e zakoupit firewall. <\/p>\n

Pro ty, kte\u0159\u00ed maj\u00ed velmi mnoho mal\u00fdch pobo\u010dek. <\/b>U mnoha dodavatel\u016f je minim\u00e1ln\u00ed cena \u0159e\u0161en\u00ed za pobo\u010dku pom\u011brn\u011b vysok\u00e1 a m\u016f\u017ee se uk\u00e1zat jako nezaj\u00edmav\u00e1 z pohledu koncov\u00e9ho z\u00e1kazn\u00edka. Fortinet nab\u00edz\u00ed mal\u00e1 za\u0159\u00edzen\u00ed za velmi atraktivn\u00ed cenu. <\/p>\n

Pro ty, kte\u0159\u00ed nejsou zat\u00edm p\u0159ipraveni ud\u011blat p\u0159\u00edli\u0161 velk\u00fd krok. <\/b>Nasazen\u00ed SD-WAN s kontrol\u00e9ry, propriet\u00e1rn\u00edmi sm\u011brovac\u00edmi protokoly, nov\u00fdm p\u0159\u00edstupem k pl\u00e1nov\u00e1n\u00ed a spr\u00e1v\u011b s\u00edt\u011b m\u016f\u017ee b\u00fdt pro n\u011bkter\u00e9 z\u00e1kazn\u00edky p\u0159\u00edli\u0161 v\u00e1\u017en\u00fdm krokem. Ano, takov\u00e9 nasazen\u00ed nakonec pom\u016f\u017ee optimalizovat vyu\u017eit\u00ed komunika\u010dn\u00edch kan\u00e1l\u016f a pr\u00e1ci administr\u00e1tor\u016f, ale nejprve se budete muset nau\u010dit mnoho nov\u00e9ho. Pro ty, kdo nejsou p\u0159ipraveni na zm\u011bnu paradigmatu, ale cht\u011bj\u00ed vyt\u011b\u017eit co nejv\u00edce ze sv\u00fdch komunika\u010dn\u00edch kan\u00e1l\u016f, je ide\u00e1ln\u00edm \u0159e\u0161en\u00edm nab\u00eddka spole\u010dnosti Fortinet.
\n
Zdroj: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0421\u0443\u0434\u044f \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u0432\u043e\u043f\u0440\u043e\u0441\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0430\u043c \u0441\u0442\u0430\u043b\u0438 \u043f\u0440\u0438\u043b\u0435\u0442\u0430\u0442\u044c \u043f\u043e SD-WAN, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f \u043d\u0430\u0447\u0430\u043b\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u0440\u0438\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0432 \u0420\u043e\u0441\u0441\u0438\u0438. \u0412\u0435\u043d\u0434\u043e\u0440\u044b, \u0435\u0441\u0442\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e, \u043d\u0435 \u0434\u0440\u0435\u043c\u043b\u044e\u0442 \u0438 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0442 \u0441\u0432\u043e\u0438 \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438, \u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u043c\u0435\u043b\u044c\u0447\u0430\u043a\u0438 \u043f\u0435\u0440\u0432\u043e\u043f\u0440\u043e\u0445\u043e\u0434\u0446\u044b \u0443\u0436\u0435 \u0432\u043d\u0435\u0434\u0440\u044f\u044e\u0442 \u0438\u0445 \u0443 \u0441\u0435\u0431\u044f \u043d\u0430 \u0441\u0435\u0442\u0438. \u041c\u044b \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u043c \u043f\u043e\u0447\u0442\u0438 \u0441\u043e \u0432\u0441\u0435\u043c\u0438 \u0432\u0435\u043d\u0434\u043e\u0440\u0430\u043c\u0438, \u0438 \u0437\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043b\u0435\u0442 \u0432 \u043d\u0430\u0448\u0435\u0439 \u043b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u044f \u0443\u0441\u043f\u0435\u043b \u043f\u043e\u043a\u043e\u043f\u0430\u0442\u044c\u0441\u044f \u0432 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0435 \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u043a\u0440\u0443\u043f\u043d\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":95433,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-95432","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Anal\u00fdza nejdostupn\u011bj\u0161\u00edho SD-WAN: architektura, nastaven\u00ed, spr\u00e1va a skryt\u00e9 probl\u00e9my | ProHoster","description":"Soud\u011b podle po\u010dtu dotaz\u016f, kter\u00e9 k n\u00e1m za\u010daly proudit ohledn\u011b SD-WAN, se technologie za\u010dala v Rusku v\u00fdrazn\u011b etablovat.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/razbor-samogo-demokratichnogo-iz-sd-wan-arhitektura-nastrojka-administrirovanie-i-podvodnye-kamni","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0430\u0437\u0431\u043e\u0440 \u0441\u0430\u043c\u043e\u0433\u043e \u0434\u0435\u043c\u043e\u043a\u0440\u0430\u0442\u0438\u0447\u043d\u043e\u0433\u043e \u0438\u0437 SD-WAN: \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0430, \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430, \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0438 \u043f\u043e\u0434\u0432\u043e\u0434\u043d\u044b\u0435 \u043a\u0430\u043c\u043d\u0438 | ProHoster","og:description":"\u0421\u0443\u0434\u044f \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u0432\u043e\u043f\u0440\u043e\u0441\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0430\u043c \u0441\u0442\u0430\u043b\u0438 \u043f\u0440\u0438\u043b\u0435\u0442\u0430\u0442\u044c \u043f\u043e SD-WAN, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f \u043d\u0430\u0447\u0430\u043b\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u0440\u0438\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0432 \u0420\u043e\u0441\u0441\u0438\u0438.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/razbor-samogo-demokratichnogo-iz-sd-wan-arhitektura-nastrojka-administrirovanie-i-podvodnye-kamni","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-29T05:42:38+00:00","article:modified_time":"2020-09-29T05:42:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"95432","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:05:30","updated":"2026-02-04 14:42:07","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/95432","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=95432"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/95432\/revisions"}],"predecessor-version":[{"id":156763,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/95432\/revisions\/156763"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/95433"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=95432"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=95432"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=95432"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}