{"id":32137,"date":"2019-10-31T21:45:21","date_gmt":"2019-10-31T18:45:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/nastrojka-ipsec-site-to-site-vpn-na-oborudovanii-palo-alto-networks\/"},"modified":"2019-10-31T21:45:21","modified_gmt":"2019-10-31T18:45:21","slug":"nastrojka-ipsec-site-to-site-vpn-na-oborudovanii-palo-alto-networks","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/nastrojka-ipsec-site-to-site-vpn-na-oborudovanii-palo-alto-networks","title":{"rendered":"IPSec Site-to-Site VPN seadistamine Palo Alto Networks seadmetes","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"IPSec
\n
\nSee artikkel on j\u00e4tk eelnevale materjalile<\/a><\/noindex>, mis k\u00e4sitleb seadmete seadistamise erip\u00e4ra Palo Alto Networks <\/b>. Siin soovime r\u00e4\u00e4kida IPSec Site-to-Site VPN<\/b> seadmetes Palo Alto Networks<\/b> ja v\u00f5imalikust konfiguratsioonist, mis \u00fchendab mitut internetiteenuse pakkujat.
\n<\/a><\/noindex>
\nDemonstratsiooniks kasutatakse standardset \u00fchendusskeemi peakorterist filiaalini. Et tagada usaldusv\u00e4\u00e4rne interneti\u00fchendus, kasutatakse peakorterisse samaaegset \u00fchendust kahe teenuse pakkujaga: ISP-1 ja ISP-2. Filiaal on \u00fchendatud ainult \u00fche teenuse pakkujaga, ISP-3. Vahepealsete tulem\u00fc\u00fcride PA-1 ja PA-2 vahel luuakse kaks tunnelit. Tunnelid t\u00f6\u00f6tavad Active-Standby<\/b>, Tunnel-1 on aktiivne, Tunnel-2 hakkab liiklust edastama, kui Tunnel-1 eba\u00f5nnestub. Tunnel-1 kasutab \u00fchendust interneti teenuse pakkujaga ISP-1, Tunnel-2 kasutab \u00fchendust interneti teenuse pakkujaga ISP-2. K\u00f5ik IP-aadressid on genereeritud juhuslikult demonstreerimise eesm\u00e4rgil ja ei ole seotud reaalsusega.<\/p>\n

\"IPSec
\n
\nSite-to-Site VPN rajamiseks kasutatakse IPSec<\/b> \u2014 protokollide komplekt, mis tagab IP-protokolli kaudu edastatavate andmete kaitse. IPSec <\/b>t\u00f6\u00f6tab turvaprotokolli abil ESP <\/b>(Encapsulating Security Payload), mis tagab edastatavate andmete kr\u00fcpteerimise.<\/p>\n

V IPSec <\/b>kuulub IKE <\/b>(Internet Key Exchange) \u2014 protokoll, mis vastutab SA (turvaassotsiatsioonide) kokkuleppimise eest, mis on vajalik edastatavate andmete kaitsmiseks. PAN tulem\u00fc\u00fcrid toetavad IKEv1 <\/b>ja IKEv2<\/b>.<\/p>\n

V IKEv1 <\/b>VPN-\u00fchendus luuakse kahel etapil: IKEv1 faas 1 <\/b>(IKE tunnel) ja IKEv1 faas 2<\/b> (IPSec tunnel), luues kaks tunnelit, millest \u00fcks on seotud teenusteabe vahetamisega tulem\u00fc\u00fcride vahel ja teine \u200b\u200btrafiku edastamiseks. On olemas kaks t\u00f6\u00f6re\u017eiimi \u2014 p\u00f5hire\u017eiim ja agressiivne re\u017eiim. Agressiivne re\u017eiim kasutab v\u00e4hem s\u00f5numeid ja t\u00f6\u00f6tab kiiremini, kuid ei toeta peer-i identiteedi kaitset. IKEv1 faas 1<\/b> tuli asemel<\/p>\n

IKEv2 <\/b>, ning v\u00f5rreldes sellega IKEv1<\/b>tema peamine eelis on v\u00e4iksemad ribalaiuse n\u00f5uded ja kiirem SA kokkulepe. Sellega IKEv1<\/b> kasutatakse v\u00e4hem teeninduss\u00f5numeid (kokku 4), toetatakse EAP protokolli, MOBIKE-d ja lisatud mehanism peer-i eluj\u00f5u kontrollimiseks, kellega tunnel luuakse \u2014 IKEv2<\/b> Liveness Check Liveness Check<\/b>, mis tahes Dead Peer Detection IKEv1-s. Kui kontroll ei \u00f5nnestu, siis IKEv2 <\/b>v\u00f5ib tunnelit katkestada ja seej\u00e4rel automaatselt taastada esimesel v\u00f5imalusel. T\u00e4iendavat teavet erinevuste kohta saab lugeda siit<\/a><\/noindex>.<\/p>\n

Kui tunnel ehitatakse erinevate tootjate tulem\u00fc\u00fcride vahel, v\u00f5ivad esineda defektid teostuses IKEv2<\/b>, ja sellise seadme \u00fchilduvuse tagamiseks on v\u00f5imalik kasutada IKEv1<\/b>. \u00dclej\u00e4\u00e4nud juhtudel on parem kasutada IKEv2<\/b>.<\/p>\n

Seadistamise etapid:<\/p>\n

\u2022 Kahe Interneti-teenuse pakkuja seadistamine re\u017eiimis ActiveStandby<\/b><\/p>\n

On mitmeid viise, kuidas seda funktsiooni rakendada. \u00dcks neist h\u00f5lmab mehhanismi Path Monitoring<\/b>, mis sai k\u00e4ttesaadavaks alates versioonist PAN-OS 8.0.0<\/b>. Antud n\u00e4ites kasutatakse versiooni 8.0.16. See funktsioon sarnaneb IP SLA-ga Cisco ruuterites. Staatilisest vaikimisi marsruudi parameetris konfigureeritakse ping-pakkide saatmine kindlale IP-aadressile kindlast allika aadressist. Antud juhul pingib liides ethernet1\/1 vaikimisi v\u00e4ravat iga sekundi tagant. Kui kolme j\u00e4rjestikuse ping'i korral ei tule vastust, loetakse marsruut mittetoimivaks ja eemaldatakse marsruuditabelist. Sarnane marsruut seadistatakse teise interneti teenuse pakkuja suunas, kuid suurema m\u00f5\u00f5dikuga (see on varu). Niipea kui esimene marsruut tabelist eemaldatakse, hakkab tulem\u00fc\u00fcr suunama liiklust teise marsruudi kaudu \u2014 Fail-Over<\/b>. Kui esimene teenuse pakkuja hakkab pingidele vastama, naaseb tema marsruut tabelisse ja asendab teise parema m\u00f5\u00f5diku t\u00f5ttu \u2014 Fail-Back<\/b>. Protsess Fail-Over<\/b> kestab paar sekundit, olenevalt seadistatud intervallidest, kuid igal juhul ei ole protsess kohene ja sel ajal kaob liiklus. Fail-Back<\/b> toimub ilma liikluseta. On v\u00f5imalus teha Fail-Over<\/b> kiiremini, kasutades BFD<\/b>, kui internetiteenusepakkuja seda v\u00f5imaldab. BFD <\/b>toetatakse alates mudelist PA-3000 Series<\/b> ja VM-100<\/b>. Parim pingi aadress on n\u00e4idata mitte teenusepakkuja v\u00e4ravat, vaid avalikku, alati ligip\u00e4\u00e4setavat internetiaadressi.<\/p>\n

\"IPSec
\n
\n\u2022 Tunneliliidese loomine<\/b><\/p>\n

Tunnelis edastatav liiklus toimub spetsiaalsete virtuaalsete liideste kaudu. Igal neist peab olema konfigureeritud IP-aadress \u00fcleminekuv\u00f5rgust. Antud n\u00e4ites kasutatakse Tunnel-1 jaoks alamv\u00f5rku 172.16.1.0\/30 ja Tunnel-2 jaoks alamv\u00f5rku 172.16.2.0\/30.
\nTunneliliides luuakse jaos Network -> Interfaces -> Tunnel<\/b>. Tuleb m\u00e4\u00e4rata virtuaalne marsruuter ja turvapiirkond, samuti IP-aadress vastavast transportv\u00f5rgust. Liidese number v\u00f5ib olla \u00fcksk\u00f5ik milline.<\/p>\n

\"IPSec
\n
\n\"IPSec
\n
\nJaotises Advanced <\/b>v\u00f5ib m\u00e4\u00e4rata Management Profile<\/b>, mis lubab pingida antud liidest, mis v\u00f5ib olla kasulik testimiseks.<\/p>\n

\"IPSec
\n
\n\u2022 IKE Profiili konfigureerimine<\/b><\/p>\n

IKE Profiil<\/b> on vastutav VPN-\u00fchenduse loomise esimese etapi eest, siin m\u00e4\u00e4ratakse tunneliparametrid IKE Phase 1<\/b>. Profiil luuakse jaos Network -> Network Profiles -> IKE Crypto<\/b>. Tuleb m\u00e4rkida kr\u00fcpteerimisalgotitmi, r\u00e4si, Diffie-Hellmani r\u00fchma ja v\u00f5tme eluea. \u00dcldiselt, mida keerulisemad on algoritmid, seda halvema j\u00f5udlusega need on, seega tuleks neid valida vastavalt konkreetsetele turva n\u00f5uetele. Siiski ei tohi kindlasti kasutada Diffie-Hellmani r\u00fchma alla 14 olulise teabe kaitsmiseks. See on seotud protokolli haavatavustega, mida saab leevendada vaid 2048 bitise ja suurema mooduli suuruse v\u00f5i elliptse kr\u00fcptograafia algoritmide kasutamisega, mis rakenduvad gruppides 19, 20, 21, 24. Need algoritmid pakuvad traditsioonilise kr\u00fcptograafiaga v\u00f5rreldes paremat j\u00f5udlust. Loe l\u00e4hemalt siit<\/a><\/noindex>. Ja siit<\/a><\/noindex>.<\/p>\n

\"IPSec
\n
\n\u2022 IPSec profiili seadistamine<\/b><\/p>\n

Teine etapp VPN-\u00fchenduse loomisel on IPSec tunnel. Selle jaoks seadistatakse SA parameetrid Network -> Network Profiles -> IPSec Crypto Profile<\/b>. Siin tuleb m\u00e4rkida IPSec protokoll \u2014 AH <\/b>v\u00f5i ESP<\/b>, samuti parameetrid SA <\/b> \u2014 r\u00e4si, kr\u00fcpteerimise algoritmid, Diffie-Hellmani r\u00fchmad ja v\u00f5tme eluiga. IKE Crypto Profile'i ja IPSec Crypto Profile'i SA parameetrid v\u00f5ivad mitte kattuda.<\/p>\n

\"IPSec
\n
\n\u2022 IKE Gateway seadistamine<\/b><\/p>\n

IKE Gateway<\/b> \u2014 see objekt, mis t\u00e4histab ruuterit v\u00f5i tulem\u00fc\u00fcri, millega luuakse VPN tunnel. Iga tunnel peab olema loodud eraldi. IKE Gateway<\/b>Antud juhul luuakse kaks tunnelit, \u00fcks iga internetiteenuse pakkuja kaudu. M\u00e4\u00e4ratakse vastav v\u00e4ljaminev liides ja selle ip-aadress, peer'i ip-aadress ja \u00fchine v\u00f5tme. \u00dchise v\u00f5tme asemel v\u00f5ib kasutada ka sertifikaate.<\/p>\n

\"IPSec
\n
\nSiia m\u00e4rgitakse varem loodud IKE kr\u00fcptoprofiil<\/b>. Teise objekti parameetrid IKE Gateway<\/b> on sarnased, v\u00e4lja arvatud IP-aadressid. Kui Palo Alto Networks'i tulem\u00fc\u00fcr asub NAT ruuteri taga, tuleb aktiveerida mehhanism NAT Traversal<\/b>.<\/p>\n

\"IPSec
\n
\n\u2022 IPSec tunnelite seadistamine<\/b><\/p>\n

IPSec tunnel<\/b> \u2014 see objekt, kus m\u00e4\u00e4ratakse IPSec tunneli parameetrid, nagu nimigi \u00fctleb. Siia tuleb m\u00e4rkida tunneli liides ja varem loodud objektid IKE Gateway<\/b>, IPSec kr\u00fcptoprofiil<\/b>. Automaatse marsruutimise \u00fcleminekuks varutunnelile tuleb aktiveerida Tunnel Monitor<\/b>. See on mehhanism, mis kontrollib, kas peer on elus, kasutades ICMP liiklust. Sihtaadressina tuleb m\u00e4rkida peer'i tunneliliidese IP-aadress, millega tunnelit ehitatakse. Profiilis m\u00e4\u00e4ratakse ajastust ja toiming, kui \u00fchendus kaob. Oota taastumist<\/b> \u2013 oota, kuni \u00fchendus taastub, \u00c4ra l\u00fckka<\/b> \u2014 suunata liiklus teisele marsruudile, kui selline on. Teise tunneliseadistamine on t\u00e4iesti analoogne, peab olema m\u00e4\u00e4ratud teine tunneliliides ja IKE Gateway.<\/p>\n

\"IPSec
\n
\n\"IPSec
\n
\n\u2022 Marsruutimise seadistamine<\/b><\/p>\n

Antud n\u00e4ites kasutatakse staatilist marsruutimist. V\u00e4lisseinas PA-1 tuleb kahe vaikimisi marsruudi k\u00f5rval m\u00e4rkida kaks marsruuti haru alamv\u00f5rku 10.10.10.0\/24. \u00dcks marsruut kasutab Tunnel-1, teine Tunnel-2. Marsruut Tunnel-1 kaudu on peamine, kuna sellel on madalam meetrika. Mehhanism Path Monitoring<\/b> selle marsruudi jaoks ei ole kasutusel. \u00dcleminek vastutab Tunnel Monitor<\/b>.<\/p>\n

\"IPSec
\n
\nSarnased marsruudid alamv\u00f5rgu 192.168.30.0\/24 jaoks tuleb seadistada PA-2-l.<\/p>\n

\"IPSec
\n
\n\u2022 V\u00f5rgureeglite seadistamine<\/b><\/p>\n

Tunnelil t\u00f6\u00f6tamiseks on vaja kolme reeglit:<\/p>\n

    \n
  1. Kuna Path Monitor<\/b> lubada ICMP v\u00e4lises liideses.<\/li>\n
  2. Kuna IPSec <\/b>lubada rakendused ike <\/b>ja ipsec <\/b>v\u00e4lises liideses.<\/li>\n
  3. Luba liiklus sisev\u00f5rkude ja tunneliliideste vahel.<\/li>\n<\/ol>\n

    \n\"IPSec
    \n
    \nKokkuv\u00f5te<\/b><\/p>\n

    K\u00e4esolevas artiklis k\u00e4sitleme usaldusv\u00e4\u00e4rse interneti\u00fchenduse seadistamise varianti ja Site-to-Site VPN<\/b>. Loodame, et teave oli kasulik ning lugeja sai \u00fclevaate rakendatud tehnoloogiatest Palo Alto Networks<\/b>. Kui teil on seadistamise kohta k\u00fcsimusi v\u00f5i ideid tulevaste artiklite teemadeks \u2014 kirjutage need kommentaaridesse, oleme r\u00f5\u00f5msad vastata.
    \n
    Allikas:     habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u0414\u0430\u043d\u043d\u0430\u044f \u0441\u0442\u0430\u0442\u044c\u044f \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0435\u043d\u0438\u0435 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0433\u043e \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0430, \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u044f\u043c \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f Palo Alto Networks . \u0417\u0434\u0435\u0441\u044c \u043c\u044b \u0445\u043e\u0442\u0438\u043c \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u0442\u044c \u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 IPSec Site-to-Site VPN \u043d\u0430 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0438 Palo Alto Networks \u0438 \u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u043c \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u0435 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432. \u0414\u043b\u044f \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u0431\u0443\u0434\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u0430\u044f \u0441\u0445\u0435\u043c\u0430 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0433\u043e\u043b\u043e\u0432\u043d\u043e\u0433\u043e \u043e\u0444\u0438\u0441\u0430 \u043a \u0444\u0438\u043b\u0438\u0430\u043b\u0443. \u0414\u043b\u044f \u0442\u043e\u0433\u043e, \u0447\u0442\u043e\u0431\u044b \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0442\u044c \u043e\u0442\u043a\u0430\u0437\u043e\u0443\u0441\u0442\u043e\u0439\u0447\u0438\u0432\u043e\u0435 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435, \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23973,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-32137","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47IPSec Site-to-Site VPN seadistamine Palo Alto Networks seadmetes | ProHoster","description":"K\u00e4esolev artikkel on j\u00e4tk eelnevale materjalile, mis k\u00e4sitleb Palo Alto Networks seadmete seadistamise erip\u00e4ra. Soovime r\u00e4\u00e4kida IPSec Site-to-Site VPN seadistamisest Palo Alto Networks seadmetes ning v\u00f5imalusest \u00fchendada mitmeid internetiteenuse pakkujaid. N\u00e4itlikustamiseks kasutatakse standardset skeemi peamise kontori ja harukontori \u00fchendamiseks. Et tagada usaldusv\u00e4\u00e4rne interneti\u00fchendus,","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/nastrojka-ipsec-site-to-site-vpn-na-oborudovanii-palo-alto-networks","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 IPSec Site-to-Site VPN \u043d\u0430 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0438 Palo Alto Networks | ProHoster","og:description":"\u0414\u0430\u043d\u043d\u0430\u044f \u0441\u0442\u0430\u0442\u044c\u044f \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0435\u043d\u0438\u0435 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0433\u043e \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0430, \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u044f\u043c \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f Palo Alto Networks . \u0417\u0434\u0435\u0441\u044c \u043c\u044b \u0445\u043e\u0442\u0438\u043c \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u0442\u044c \u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 IPSec Site-to-Site VPN \u043d\u0430 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0438 Palo Alto Networks \u0438 \u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u043c \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u0435 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432. \u0414\u043b\u044f \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u0431\u0443\u0434\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u0430\u044f \u0441\u0445\u0435\u043c\u0430 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0433\u043e\u043b\u043e\u0432\u043d\u043e\u0433\u043e \u043e\u0444\u0438\u0441\u0430 \u043a \u0444\u0438\u043b\u0438\u0430\u043b\u0443. \u0414\u043b\u044f \u0442\u043e\u0433\u043e, \u0447\u0442\u043e\u0431\u044b \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0442\u044c \u043e\u0442\u043a\u0430\u0437\u043e\u0443\u0441\u0442\u043e\u0439\u0447\u0438\u0432\u043e\u0435 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435, \u0432","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/nastrojka-ipsec-site-to-site-vpn-na-oborudovanii-palo-alto-networks","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:45:21+00:00","article:modified_time":"2019-10-31T18:45:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"32137","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 09:27:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:04:40","updated":"2026-01-21 09:27:20"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/32137","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=32137"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/32137\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/23973"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=32137"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=32137"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=32137"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}