Every businessman aims to reduce costs. The same goes for IT infrastructure.
Opening a new office can make some people uneasy. You need to organize:
- a local network;
- internet access, preferably with redundancy through a second provider;
- VPN to the central office (or to all branches);
- HotSpot for clients with SMS authorization;
- traffic filtering to ensure employees are not spending time on social media or chatting on Skype;
- network protection from viruses and attacks. Establish intrusion protection (IDS/IPS);
- an email server (if you don't trust services like pdd.yandex.ru) with antivirus and anti-spam;
- a file storage solution;
- You might need telephony, meaning you should set up a PBX, connect to a SIP provider, and other perksā¦
But setting up a network with such demands isn't something an inexperienced technician can handleā¦ Hire an expensive sysadmin?
This presents a significant, upcoming financial figure.
However, you can significantly reduce these expenses by focusing on UTM solutions, of which there are a huge number currently available. As I follow the strategy of 'the simpler, the better' in my solutions, I focused on UTM (ICS).
I will explain how this system can help save the company's budget and why it doesn't require an expensive sysadmin to maintain.
But to give you a heads-up, this is a specific product and has its limitations. You can evaluate the capabilities of the gateway in more detail .
I configured it for the article 'in Russian,' which means without looking into manuals, to see how intuitive everything is.
Initial Installation
ICS can be installed on real hardware as well as on a hypervisor. You can use a fanless PC.For example, something like this.
The system is based on and should run smoothly on most hardware.
Installation is performed on a clean disk. More precisely, if there was something there, you can safely say goodbye to it.Unfortunately, the installer supports only English. But after installation, the main interface can be in Russian.
They haven't forgotten about fault tolerance either.If the system has several disks, they can be combined into a RAID using ZFS.
Select the network interface and assign an IP from the chosen network.
Specify a real domain name if you plan to set up, for example, a mail server. If there's no immediate need, you can just make something up. You can adjust it in the interface later.
That's it! You can access the web interface via the IP you specified in the settings, and use port 81. DHCP is not turned on at this stage, so you will need to assign an IP from the same network manually on your PC.
Connect to the internet and link the offices.
Upon first login, a wizard starts which requires you to set a strong password.
The wizard
Next, we dive into the network settings
and configure the connection to our provider and the roles of all network interfaces.
You can configure multiple providers and organize load balancing.
By the way, if you find the interface in English inconvenient, you can easily change it here.
If you need to connect an office, for example, to the head office, then we create a new connection
and set up routes to resources in the remote network.
Just forget about dynamic routing ā itās not available here.
I may be nitpicking, but IMHO this is a significant drawbackā¦
Internet access for employees
Most often, the main task of the gateway is to control employee access to the internet.
You can identify employees either by IP/MAC or by username/password through an agent or captive portal.
Also, if your organization uses Active Directory, you can integrate it with ICS as well.
The filtering settings (what employees can and cannot access) are very extensive.
A huge number of ready-made rule templates:
You can allow YouTube, but block uploading videos.
However, you can also leave it unrestricted, and ICS will still report who visited where with its comprehensive reports:
What about guest Wi-Fi?
Guest Wi-Fi can also be organized in compliance with Russian laws requiring mandatory user identification.
ICS supports SMS sending via the SMPP protocol through any SMS provider.
Telephony.
Yes, yes! There's no need to set up a separate Asterisk server. It's already included in ICS.
I successfully connected SIP from MegaFon (emotion, Multiphone).
You can read about how to get SIP from MegaFon on cellular tariffs for individuals in the article .
Security.
IKS has many tools that will allow you to customize the security level according to your requirements: from free antivirus solutions like ClamAV and to products , configuring everything through an intuitive web interface.
Even the indispensable fail2Ban can be configured in just a few clicks.
IKS can also monitor traffic using the NetFlow protocol on network equipment without routing traffic through itself.
Communication advantages
Employee communication can be organized not only through telephony and email
but also via Jabber. Although few people remember such a protocol now.
Web server:
IKS even has a web server with PHP support. You can use your own HTTPS certificate if you have purchased one, or specify that IKS should obtain a free Letās Encrypt certificate.
This is sufficient for hosting a business card website or a promotional landing page. However, you wonāt be able to deploy a heavy portal with custom modules. In my opinion, thatās foolish. After all, a gateway should remain a gateway.
Flexible monitoring and notification settings.
Alerts can be sent even via Telegram. In Russia, thereās even an option to send messages through a proxy.
In conclusion,
the Internet gateway 'IKS' contains almost all the components necessary for the operation of a small office.
Meanwhile, everything can be set up by a novice system administrator.
Although the system is built on FreeBSD, there is no ssh access to it. So, without workarounds, you won't be able to install PHP modules. You'll have to make do with what's presentā¦ Or ask support to enhance it.
In any case, at the beginning, and check how well this gateway meets your needs.
The license has no expiration date, but despite this, the cost is quite
In synthetic tests on the stand, the system showed adequate performance.
If the client approves and you are interested in how this system will perform in 'combat', I will write a review in about 3-6 months detailing any tasks and challenges encountered. If possible, we will also evaluate the quality of technical support.
I look forward to your questions in the comments, which we should pay close attention to during practical application.
Source: habr.com
