{"id":29980,"date":"2019-10-31T21:32:59","date_gmt":"2019-10-31T18:32:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/optimizator-politik-bezopasnosti-palo-alto-networks-ngfw\/"},"modified":"2019-10-31T21:32:59","modified_gmt":"2019-10-31T18:32:59","slug":"optimizator-politik-bezopasnosti-palo-alto-networks-ngfw","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/optimizator-politik-bezopasnosti-palo-alto-networks-ngfw","title":{"rendered":"Palo Alto Networks NGFW turvapoliitika optimeerija","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kuidas hinnata NGFW konfiguratsiooni efektiivsust<\/h1>\n

\nK\u00f5ige levinum \u00fclesanne on kontrollida, kui efektiivselt on teie tulem\u00fc\u00fcr seadistatud. Selleks on olemas tasuta t\u00f6\u00f6riistad ja teenused ettev\u00f5tetelt, mis tegelevad NGFW-iga. <\/p>\n

N\u00e4iteks allpool on n\u00e4ha, et Palo Alto Networks'il on v\u00f5imalus otse toetuse portaalist<\/a><\/noindex> alustada tulem\u00fc\u00fcri statistika anal\u00fc\u00fcsi - SLR aruanne v\u00f5i anal\u00fc\u00fcs parimate praktikate kohaselt - BPA aruanne. Need on tasuta veebip\u00f5hised t\u00f6\u00f6riistad, millega saab kasutada, ilma et oleks vaja midagi installida.
\n\"Palo <\/a><\/noindex><\/p>\n

SISU<\/h3>\n

\nExpedition (Migration Tool)<\/a><\/noindex>
\nPolicy Optimizer<\/a><\/noindex>
\nZero Trust<\/a><\/noindex>
\nKl\u00f5psame Unused<\/a><\/noindex>
\nKl\u00f5psame Unused App<\/a><\/noindex>
\nKl\u00f5psame No Apps Specified<\/a><\/noindex>
\nAga kuidas on masin\u00f5ppega?<\/a><\/noindex>
\nUTD<\/a><\/noindex><\/p>\n

<\/a><\/noindex><\/p>\n

Expedition (Migration Tool)<\/h2>\n

\n\"Palo
\n
\nRohkem keeruline meetod oma seadete kontrollimiseks on alla laadida tasuta t\u00f6\u00f6riist Expedition<\/a><\/noindex> (endine Migration Tool). See laetakse alla Virtual Appliance'ina VMware jaoks, seadistusi pole vajalik - lihtsalt laadige pilt alla ja k\u00e4itage seda VMware h\u00fcperviisoril, k\u00e4ivitage ja minge veebiliidesesse. See utiliit v\u00e4\u00e4rib eraldi arutelu, pelgalt kursus selle kohta kestab 5 p\u00e4eva, kuna seal on n\u00fc\u00fcd nii palju funktsioone, sealhulgas masin\u00f5pe ja erinevate konfiguratsioonide, poliitikate, NAT-i ja objekti migratsioon erinevate tulem\u00fc\u00fcri tootjate jaoks. Masin\u00f5ppe kohta kirjutan hiljem \u00fcksikasjalikumalt.<\/p>\n

<\/a><\/noindex><\/p>\n

Policy Optimizer<\/h2>\n

\nJa k\u00f5ige mugavam variant (IMHO), millest r\u00e4\u00e4gin t\u00e4na l\u00e4hemalt - poliitika optimeerija, mis on integreeritud Palo Alto Networks'i kasutajaliidesesse. Selle demonstreerimiseks installisin tulem\u00fc\u00fcr enda koju ja kirjutasin lihtsa reegli: lubada k\u00f5ik k\u00f5ikidele. Selliseid reegleid kohtan vahel isegi ettev\u00f5ttev\u00f5rkudes. Loomulikult aktiveerisin k\u00f5ik NGFW turvaprofiilid, nagu on n\u00e4ha ekraanipildilt:
\n\"Palo
\n
\nAlloleval ekraanipildil on n\u00e4idatud minu kodune, seadistamata tulem\u00fc\u00fcr, kus peaaegu k\u00f5ik \u00fchendused langevad viimasele reegli: AllowAll, mida n\u00e4eb kolonni Hit Count statistikas.
\n\"Palo
\n
\n<\/a><\/noindex><\/p>\n

Zero Trust<\/h2>\n

\nOn olemas l\u00e4henemine turvalisusele, mida nimetatakse Zero Trust<\/a><\/noindex>. See what this means: we must allow individuals within the network only those connections that they need and block everything else. This means we need to establish clear rules regarding applications, users, URL categories, file types; include all IPS and antivirus signatures, incorporate a sandbox, implement DNS protection, and utilize IoC from available Threat Intelligence databases. In general, there are quite a few tasks when configuring the firewall. <\/p>\n

By the way, the minimum set of necessary settings for Palo Alto Networks NGFW is described in one of the SANS documents: Palo Alto Networks Security Configuration Benchmark<\/a><\/noindex> \u2014 I recommend starting with it. And of course, there's a set of best practices for configuring the firewall from the manufacturer: Best Practice<\/a><\/noindex>.<\/p>\n

So, I've had the firewall at home for a week. Let's take a look at the traffic in my network:
\n\"Palo
\n
\nIf sorted by the number of sessions, bittorrent creates the most, followed by SSL, then QUIC. This is the statistics for both incoming and outgoing traffic: there is a lot of external scanning of my router. There are 150 different applications in my network. <\/p>\n

Nii et, k\u00f5ik see on l\u00e4binud \u00fche reegli. Vaatame n\u00fc\u00fcd, mida selle kohta \u00fctleb Policy Optimizer. Kui vaatasite \u00fcleval olevat turvareeglite liidese ekraanipilti, siis n\u00e4gite vasakus alanurgas v\u00e4ikest akent, mis vihjab, et on olemas reegleid, mida saab optimeerida. Kliki sinna.<\/p>\n

Mida n\u00e4itab Policy Optimizer:<\/p>\n