{"id":29980,"date":"2019-10-31T21:32:59","date_gmt":"2019-10-31T18:32:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/optimizator-politik-bezopasnosti-palo-alto-networks-ngfw\/"},"modified":"2019-10-31T21:32:59","modified_gmt":"2019-10-31T18:32:59","slug":"optimizator-politik-bezopasnosti-palo-alto-networks-ngfw","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/optimizator-politik-bezopasnosti-palo-alto-networks-ngfw","title":{"rendered":"Palo Alto Networks NGFW turbe optimeerija","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<h1>Kuidas hinnata NGFW seadistamise efektiivsust<\/h1>\n<p>\nK\u00f5ige levinum \u00fclesanne on kontrollida, kui t\u00f5husalt on teie tulem\u00fc\u00fcr seadistatud. Selleks on tasuta utiliite ja teenuseid ettev\u00f5tete poolt, kes tegelevad NGFW-ga. <\/p>\n<p>N\u00e4iteks on allpool n\u00e4htav, et Palo Alto Networksil on v\u00f5imalus otse <noindex><a rel=\"nofollow\" href=\"https:\/\/support.paloaltonetworks.com\/\">toetuse portaalist<\/a><\/noindex> k\u00e4ivitada tulem\u00fc\u00fcri statistika anal\u00fc\u00fcs - SLR aruanne v\u00f5i parimate praktikate anal\u00fc\u00fcs - BPA aruanne. Need on tasuta veebiteenused, mida saab kasutada, ilma midagi installimata.<br \/>\n<img decoding=\"async\" alt=\"Palo Alto Networks NGFW turbe optimeerija\" src=\"\/wp-content\/uploads\/2019\/03\/86d2f4d5f28af9f744b1d1842e461309.png\" style=\"display:block;margin: 0 auto;\" \/> <noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>SISUKORD<\/h3>\n<p>\n<noindex><a rel=\"nofollow\" href=\"#Expedition\">Expedition (Migratsioonit\u00f6\u00f6riist)<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"#PolicyOptimizer\">Poliitika optimeerija<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"#ZeroTrust\">Zero Trust<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"#Unused\">Kl\u00f5psame Unused<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"#UnusedApp\">Kl\u00f5psame Unused App<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"#AppsSpecified\">Kl\u00f5psame No Apps Specified<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"#MachineLearning\">Aga kuidas on masin\u00f5ppega?<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"#UTD\">UTD<\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" name=\"Expedition\"><\/a><\/noindex><\/p>\n<h2>Expedition (Migratsioonit\u00f6\u00f6riist)<\/h2>\n<p>\n<img decoding=\"async\" alt=\"Palo Alto Networks NGFW turbe optimeerija\" src=\"\/wp-content\/uploads\/2019\/03\/1d568bbbd1480eda4de7b5cdcaaae90a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nT\u00e4psem variant oma seadete kontrollimiseks on alla laadida tasuta utiliit <noindex><a rel=\"nofollow\" href=\"https:\/\/live.paloaltonetworks.com\/t5\/Expedition-Migration-Tool\/ct-p\/migration_tool\">Expedition<\/a><\/noindex> (endine migratsioonit\u00f6\u00f6riist). See allalaaditakse VMware'i virtuaalse seadmena, seadistusi pole vaja - tuleb alla laadida pilt ja k\u00e4ivitada see VMware h\u00fcperviisoril, seej\u00e4rel avada veebiliides. Selle utiliidi jaoks on eraldi jutt, ainult kursus selle kohta kestab 5 p\u00e4eva, kuna seal on n\u00fc\u00fcd nii palju funktsioone, sealhulgas masin\u00f5pe ja erinevate konfiguratsioonide poliitikate, NAT-i ja objektide migreerimine erinevate tulem\u00fc\u00fcri tootjate jaoks. Masin\u00f5ppe kohta kirjutan ka allpool rohkem.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"Po\"><\/a><\/noindex><\/p>\n<h2>Poliitika optimeerija<\/h2>\n<p>\nJa k\u00f5ige mugavam variant (IMHO), millest r\u00e4\u00e4gin t\u00e4na p\u00f5hjalikumalt - poliitika optimeerija, mis on sisseehitatud Palo Alto Networks'i kasutajaliidesesse. Selle demonstreerimiseks seadistasin kodus tulem\u00fc\u00fcri ja kirjutasin lihtsa reegli: luba k\u00f5ike igale. Selliseid reegleid n\u00e4en m\u00f5nikord isegi ettev\u00f5tete v\u00f5rkudes. Loomulikult lubasin k\u00f5ik NGFW turbeprofiilid, nagu on n\u00e4ha ekraanipildilt:<br \/>\n<img decoding=\"async\" alt=\"Palo Alto Networks NGFW turbe optimeerija\" src=\"\/wp-content\/uploads\/2019\/03\/a53a1bff59708c7082bafb5b84634b11.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAlloleval ekraanipildil on n\u00e4idatud n\u00e4ide minu kodusest mitteseadistatud tulem\u00fc\u00fcrist, kus peaaegu k\u00f5ik \u00fchendused satuvad viimasesse reeglisse: AllowAll, mida n\u00e4itab statistika Hit Count kolonis.<br \/>\n<img decoding=\"async\" alt=\"Palo Alto Networks NGFW turbe optimeerija\" src=\"\/wp-content\/uploads\/2019\/03\/8b4e004f5488e6faa3109c956fb78c31.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<noindex><a rel=\"nofollow\" name=\"ZeroTrust\"><\/a><\/noindex><\/p>\n<h2>Zero Trust<\/h2>\n<p>\nOn olemas l\u00e4henemine turvalisusele, mida nimetatakse <noindex><a rel=\"nofollow\" href=\"https:\/\/www.paloaltonetworks.com\/cyberpedia\/what-is-a-zero-trust-architecture\">Zero Trust<\/a><\/noindex>. Mida see t\u00e4hendab: me peame lubama inimestele v\u00f5rgus t\u00e4pselt need \u00fchendused, mis neile on vajalikud, ja keelama k\u00f5ik muu. See t\u00e4hendab, et peame lisama selged reeglid rakenduste, kasutajate, URL-kategooriate ja failit\u00fc\u00fcpide jaoks; kaasama k\u00f5ik IPS ja viiruset\u00f5rje allkirjad, kasutama liivakasti, DNS-kaitset, ja kasutama IoC-d saadaval olevatest Threat Intelligence andmebaasidest. \u00dcldiselt on tulem\u00fc\u00fcri seadistamisel piisavalt \u00fclesandeid. <\/p>\n<p>Muide, Palo Alto Networks NGFW jaoks vajalik minimaalne seadistuste komplekt on kirjeldatud \u00fches SANSi dokumendis: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.sans.org\/reading-room\/whitepapers\/auditing\/paper\/35777\">Palo Alto Networks Security Configuration Benchmark<\/a><\/noindex> \u2014 soovitan alustada sellest. Ja muidugi on tootja poolt olemas parimate praktikate kogum tulem\u00fc\u00fcri seadistamiseks: <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.paloaltonetworks.com\/best-practices\">Best Practice<\/a><\/noindex>.<\/p>\n<p>Nii et mul oli tulem\u00fc\u00fcr kodus \u00fcle n\u00e4dala. Vaadakem, milline liiklus minu v\u00f5rgus on: <br \/>\n<img decoding=\"async\" alt=\"Palo Alto Networks NGFW turbe optimeerija\" src=\"\/wp-content\/uploads\/2019\/03\/b3b773f46e892b688f65cc83c7a5ef05.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKui sorteerida \u00fchenduste arvu j\u00e4rgi, siis k\u00f5ige rohkem genereerib neid bittorrent, seej\u00e4rel tuleb SSL ja siis QUIC. See on statistika nii sissetuleva kui ka v\u00e4ljuva liikluse kohta: minu ruuteri skaneeringute hulka on palju sisenevat liiklust. Minu v\u00f5rgus on erinevaid rakendusi \u2014 150. <\/p>\n<p>Nii et k\u00f5ik see l\u00e4ks l\u00e4bi \u00fche reegli. Vaadakem n\u00fc\u00fcd, mida Policy Optimizer sellega seoses \u00fctleb. Kui te vaatasite \u00fcleval olevat ekraanipilti turvareeglitest, siis n\u00e4gite vasakus alumises nurgas v\u00e4ikest akent, mis vihjab, et on olemas reegleid, mida saab optimeerida. Kl\u00f5psame sellele.<\/p>\n<p>Mida Policy Optimizer n\u00e4itab:<\/p>\n<ul>\n<li>Milliseid poliitikaid ei ole \u00fcldse kasutatud, 30 p\u00e4eva, 90 p\u00e4eva. See aitab otsustada, kas need t\u00e4ielikult eemaldada.<\/li>\n<li>Milliseid rakendusi poliitikates on n\u00e4idatud, kuid neid rakendusi ei ole liikluses leitud. See v\u00f5imaldab eemaldada liigseid rakendusi lubavatest reeglitest.<\/li>\n<li>Millised poliitikad lubasid k\u00f5ike, kuid seal k\u00e4isid rakendused, mida oleks hea Zero Trust meetodi kohaselt selgelt m\u00e4\u00e4ratleda.<\/li>\n<\/ul>\n<p><img decoding=\"async\" alt=\"Palo Alto Networks NGFW turbe optimeerija\" src=\"\/wp-content\/uploads\/2019\/03\/538a51166003e154430c16ff8cd01607.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<noindex><a rel=\"nofollow\" name=\"Unused\"><\/a><\/noindex><\/p>\n<h3>Kl\u00f5psime Unused.<\/h3>\n<p>\nKuna n\u00e4idata, kuidas see t\u00f6\u00f6tab, lisasin m\u00f5ned reeglid ja need ei ole t\u00e4na veel \u00fchtegi paketti l\u00e4bi lasknud. Siin on nende nimekiri:<br \/>\n<img decoding=\"async\" alt=\"Palo Alto Networks NGFW turbe optimeerija\" src=\"\/wp-content\/uploads\/2019\/03\/227bc8339ce96a45370f2e07089eea03.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nV\u00f5ib-olla l\u00e4bib liiklus aja jooksul ja siis nad kaovad sellest nimekirjast. Ja kui nad on selles nimekirjas 90 p\u00e4eva \u2014 siis saate otsustada need reeglid eemaldada. Iga reegel loob v\u00f5imaluse h\u00e4kkerile.<\/p>\n<p>On the configuration of the firewall, there's a real problem: a new employee looks at the firewall rules, and if there are no comments and they don't know why a rule was created, whether it's really necessary, or if it can be deleted, suddenly the person might be on vacation and after 30 days traffic will again be coming from the service they needed. This function helps them make a decision \u2014 if no one uses it \u2014 delete! <\/p>\n<p><noindex><a rel=\"nofollow\" name=\"UnusedApp\"><\/a><\/noindex><\/p>\n<h3>\n<h3>Let's click on Unused App.<\/h3>\n<p>\nWe click on Unused App in the optimizer and see that interesting information appears in the main window. <\/p>\n<p>We see that there are three rules where the number of allowed applications and the number of applications that actually passed under this rule differ. <br \/>\n<img decoding=\"async\" alt=\"Palo Alto Networks NGFW turbe optimeerija\" src=\"\/wp-content\/uploads\/2019\/03\/423bfe9cd60e5236d0edd014eb8dbecd.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nWe can click and view the list of these applications and compare these lists.<br \/>\nFor example, let's click the Compare button for the Max rule.<br \/>\n<img decoding=\"async\" alt=\"Palo Alto Networks NGFW turbe optimeerija\" src=\"\/wp-content\/uploads\/2019\/03\/1bf1659825811e1478a0d1441e9f5b58.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nIt's visible that applications facebook, instagram, telegram, vkontakte were allowed. But in reality, traffic went only through part of the sub-applications. It should be understood that the facebook application contains several sub-applications. <\/p>\n<p>The entire list of NGFW applications can be seen on the portal <noindex><a rel=\"nofollow\" href=\"https:\/\/applipedia.paloaltonetworks.com\/\">applipedia.paloaltonetworks.com<\/a><\/noindex> and in the firewall's interface in the Objects-&gt;Applications section; type the name of the application: facebook, and you will get a result like this:<br \/>\n<img decoding=\"async\" alt=\"Palo Alto Networks NGFW turbe optimeerija\" src=\"\/wp-content\/uploads\/2019\/03\/2259b709f372944508dd05343a33deae.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nSo, some of these NGFW sub-applications were seen, while some were not. In fact, you can separately block and allow different functionalities of Facebook. For example, allow reading messages but block chat or file transfer. Accordingly, the Policy Optimizer indicates this, and you can make a decision: allow not all Facebook applications, but only the main ones.<\/p>\n<p>Thus, we understood that the lists are different. You can configure the rules to allow exactly those applications that actually went through the network. For this, you click the MatchUsage button. It looks like this:<br \/>\n<img decoding=\"async\" alt=\"Palo Alto Networks NGFW turbe optimeerija\" src=\"\/wp-content\/uploads\/2019\/03\/85137129471774d242f5d7fe1874c9b0.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nYou can also add applications that you consider necessary \u2014 the Add button on the left side of the window:<br \/>\n<img decoding=\"async\" alt=\"Palo Alto Networks NGFW turbe optimeerija\" src=\"\/wp-content\/uploads\/2019\/03\/23016dea6a835a07e3284b49845596ca.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nThen, this rule can be applied and tested. Congratulations!<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"AppsSpecified\"><\/a><\/noindex><\/p>\n<h3>Let's click No Apps Specified.<\/h3>\n<p>\nIn this case, an important security window will open.<br \/>\n<img decoding=\"async\" alt=\"Palo Alto Networks NGFW turbe optimeerija\" src=\"\/wp-content\/uploads\/2019\/03\/acac83fdf63c74fe537b4ce37c93e064.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nSelliseid reegleid, kus L7 taseme rakendust ei ole selgelt m\u00e4rgitud, on teie v\u00f5rgus t\u00f5en\u00e4oliselt v\u00e4ga palju. Ka minu v\u00f5rgus on selline reegel \u2014 meenutuseks, et seadsin selle \u00fcles algse seadistamise k\u00e4igus, et n\u00e4idata, kuidas Policy Optimizer t\u00f6\u00f6tab.<\/p>\n<blockquote><p>Pildilt n\u00e4ha, et reegel AllowAll lubas ajavahemikus 9. m\u00e4rts kuni 17. m\u00e4rts 220 gigabaiti liiklust, samas on minu v\u00f5rgus kokku 150 erinevat rakendust. Ja see on veel v\u00e4he. T\u00fc\u00fcpiliselt on keskmise suurusega ettev\u00f5tte v\u00f5rgus 200-300 erinevat rakendust.<\/p><\/blockquote>\n<p>\nN\u00fc\u00fcd siis \u00fcks reegel lubab tervelt 150 rakendust. See t\u00e4hendab tavaliselt, et tulem\u00fc\u00fcr on valesti seadistatud, sest tavaliselt lubatakse \u00fches reeglis 1-10 rakendust erinevatel eesm\u00e4rkidel. Vaadakem, mis rakendused need on: kl\u00f5psame nuppu Compare:<br \/>\n<img decoding=\"async\" alt=\"Palo Alto Networks NGFW turbe optimeerija\" src=\"\/wp-content\/uploads\/2019\/03\/50050efc9d6f074d974c36d198447cc9.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nAdministratoorile on Policy Optimizeri funktsiooni juures k\u00f5ige imelisem nupp Match Usage \u2014 \u00fche kl\u00f5psuga saate luua reegli, kuhu sisestate k\u00f5ik 150 rakendust. K\u00e4siotse seda teha oleks olnud \u00fcsna aegan\u00f5udev. T\u00fckkide arv, millega administraator isegi minu 10 seadme v\u00f5rgus t\u00f6\u00f6tab, on tohutu.<\/p>\n<blockquote><p>Kodus t\u00f6\u00f6tab mul 150 erinevat rakendust, mis edastavad gigabaitide kaupa liiklust! Ent kui palju on teie juures?<\/p><\/blockquote>\n<p>\nMis siis aga toimub 100 seadme, 1000 v\u00f5i 10000 seadme v\u00f5rgus? Olen n\u00e4inud tulem\u00fc\u00fcre, kus on 8000 reeglit ja olen v\u00e4ga r\u00f5\u00f5mus, et administraatoritel on n\u00fc\u00fcd niisugused mugavad automatiseerimisvahendid.<\/p>\n<p>M\u00f5ned rakendused, mida L7 rakenduste anal\u00fc\u00fcsimoodul NGFW-is n\u00e4itas, ei ole teie v\u00f5rgus vajalikud, seet\u00f5ttu v\u00f5ite need lihtsalt eemaldada lubava reegli nimekirjast, v\u00f5i teha reeglite kloonimist nupuga Clone (peamisest liidesest) ja \u00fches reeglis lubada rakendused, samas kui teises reeglis blokeerite rakendused, mis ei ole teie v\u00f5rgus \u00f5iged. Sellisteks rakendusteks muutuvad sageli bittorrent, steam, ultrasurf, tor, peidetud tunnelid, nagu tcp-over-dns, ja muud.<br \/>\n<img decoding=\"async\" alt=\"Palo Alto Networks NGFW turbe optimeerija\" src=\"\/wp-content\/uploads\/2019\/03\/4aff079413a0995eb5324e7509c6b156.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nVaadakem n\u00fc\u00fcd teist reeglit \u2014 mida seal n\u00e4ha on:<br \/>\n<img decoding=\"async\" alt=\"Palo Alto Networks NGFW turbe optimeerija\" src=\"\/wp-content\/uploads\/2019\/03\/73ab263fc788b185d4717a02d91bdffe.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nJah, seal on rakendused, mis on iseloomulikud multicast'ile. Peame need lubama, et video voogesitus v\u00f5rgu kaudu toimiks. Kl\u00f5psame Match Usage. Suurep\u00e4rane! Ait\u00e4h Policy Optimizer.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"MachineLearning\"><\/a><\/noindex><\/p>\n<h2>Aga kuidas on Masin\u00f5ppega?<\/h2>\n<p>\nPraegu on moes r\u00e4\u00e4kida automatiseerimisest. See, mida ma kirjeldasin, on v\u00e4ga abiks. On veel \u00fcks v\u00f5imalus, millest pean r\u00e4\u00e4kima. See on masin\u00f5ppe funktsionaalsus, mis on integreeritud Expedition-t\u00f6\u00f6riista, millest juba varem r\u00e4\u00e4giti. Selles t\u00f6\u00f6riistas on v\u00f5imalik \u00fcle kanda reegleid teie vanalt tulem\u00fc\u00fcrilt teise tootja poolt. Samuti on v\u00f5imalik anal\u00fc\u00fcsida olemasolevaid Palo Alto Networksi liikluslogisid ja soovitada, milliseid reegleid kirjutada. See sarnaneb Policy Optimizeri funktsionaalsusele, kuid Expeditionis on see veelgi laiem ja teile pakutakse juba valmis reeglite nimekirja \u2014 teil tuleb need lihtsalt heaks kiita. <br \/>\n<noindex><a rel=\"nofollow\" name=\"UTD\"><\/a><\/noindex>Selle funktsionaalsuse testimiseks on olemas laboratoorne t\u00f6\u00f6 \u2014 me nimetame seda testi s\u00f5iduks. Seda testi saab teha, sisenedes virtuaalsetesse tulem\u00fc\u00fcritesse, mille Palo Alto Networksi Moskva b\u00fcroo t\u00f6\u00f6tajad k\u00e4ivitavad teie n\u00f5udmisel.<br \/>\n<img decoding=\"async\" alt=\"Palo Alto Networks NGFW turbe optimeerija\" src=\"\/wp-content\/uploads\/2019\/03\/1be20da261e12f93736c4607f18299dc.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nP\u00e4ringu saab saata aadressile Russia@paloaltonetworks.com ja p\u00e4ringus kirjutada: \u201eSoovin teha UTD Migratsiooniprotsessi kohta\u201c.<\/p>\n<p>Tegelikult on mitmeid laboratoorseid t\u00f6id nimega Unified Test Drive (UTD) ja k\u00f5ik need <noindex><a rel=\"nofollow\" href=\"https:\/\/use.cloudshare.com\/Ent\/CsClient.mvc\/#\/vendor\/welcome\">on eemalt k\u00e4ttesaadavad<\/a><\/noindex> p\u00e4rast p\u00e4ringut.<\/h3>\n<p class=\"for_users_only_msg\">Ainult registreeritud kasutajad saavad k\u00fcsitluses osaleda. <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/auth\/login\/\">Logige sisse<\/a><\/noindex>, palun.<\/p>\n<h2 class=\"default-block__polling-title\">Kas soovite, et keegi aitaks teil oma tulem\u00fc\u00fcri poliitikaid optimeerida?<\/h2>\n<ul class=\"content-list content-list_polling\">\n<li class=\"content-list__item content-list__item_polling\">\n<p>                    Jah<\/p>\n<\/li>\n<li class=\"content-list__item content-list__item_polling\">\n<p>                    Ei<\/p>\n<\/li>\n<li class=\"content-list__item content-list__item_polling\">\n<p>                    Teen k\u00f5ik ise<\/p>\n<\/li>\n<\/ul>\n<p>    Keegi pole veel h\u00e4\u00e4letanud. Vastukaalujate h\u00e4\u00e4li pole.<br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/444582\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041a\u0430\u043a \u043e\u0446\u0435\u043d\u0438\u0442\u044c \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 NGFW \u0421\u0430\u043c\u0430\u044f \u0447\u0430\u0441\u0442\u0430\u044f \u0437\u0430\u0434\u0430\u0447\u0430 \u2014 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d \u0432\u0430\u0448 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u044d\u043a\u0440\u0430\u043d. \u0414\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0442 \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0435 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u0443 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u043d\u0438\u043c\u0430\u044e\u0442\u0441\u044f NGFW. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043d\u0438\u0436\u0435 \u0432\u0438\u0434\u043d\u043e, \u0447\u0442\u043e \u0443 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Palo Alto Networks \u0435\u0441\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u044f\u043c\u043e \u0438\u0437 \u043f\u043e\u0440\u0442\u0430\u043b\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0430\u043d\u0430\u043b\u0438\u0437 \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0438 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 \u2014 SLR \u043e\u0442\u0447\u0435\u0442 \u0438\u043b\u0438 \u0430\u043d\u0430\u043b\u0438\u0437 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u044f \u043b\u0443\u0447\u0448\u0438\u043c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-29980","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041a\u0430\u043a \u043e\u0446\u0435\u043d\u0438\u0442\u044c \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 NGFW \u0421\u0430\u043c\u0430\u044f \u0447\u0430\u0441\u0442\u0430\u044f \u0437\u0430\u0434\u0430\u0447\u0430 \u2014 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d \u0432\u0430\u0448 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u044d\u043a\u0440\u0430\u043d.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/optimizator-politik-bezopasnosti-palo-alto-networks-ngfw\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0442\u043e\u0440 \u043f\u043e\u043b\u0438\u0442\u0438\u043a \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Palo Alto Networks NGFW | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041a\u0430\u043a \u043e\u0446\u0435\u043d\u0438\u0442\u044c \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 NGFW \u0421\u0430\u043c\u0430\u044f \u0447\u0430\u0441\u0442\u0430\u044f \u0437\u0430\u0434\u0430\u0447\u0430 \u2014 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d \u0432\u0430\u0448 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u044d\u043a\u0440\u0430\u043d.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/optimizator-politik-bezopasnosti-palo-alto-networks-ngfw\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:32:59+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:32:59+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Palo Alto Networksi NGFW turvapoliitikate optimeerija | ProHoster","description":"Kuidas hinnata NGFW seadistuse efektiivsust? K\u00f5ige sagedasem \u00fclesanne on kontrollida, kui efektiivselt on teie tulem\u00fc\u00fcr seadistatud.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/optimizator-politik-bezopasnosti-palo-alto-networks-ngfw","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0442\u043e\u0440 \u043f\u043e\u043b\u0438\u0442\u0438\u043a \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Palo Alto Networks NGFW | ProHoster","og:description":"\u041a\u0430\u043a \u043e\u0446\u0435\u043d\u0438\u0442\u044c \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 NGFW \u0421\u0430\u043c\u0430\u044f \u0447\u0430\u0441\u0442\u0430\u044f \u0437\u0430\u0434\u0430\u0447\u0430 \u2014 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d \u0432\u0430\u0448 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u044d\u043a\u0440\u0430\u043d.","og:url":"https:\/\/prohoster.info\/et\/blog\/optimizator-politik-bezopasnosti-palo-alto-networks-ngfw","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:32:59+00:00","article:modified_time":"2019-10-31T18:32:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"29980","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-20 23:17:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:44:39","updated":"2026-01-20 23:17:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/29980","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=29980"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/29980\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=29980"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=29980"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=29980"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}