{"id":39000,"date":"2019-10-31T22:27:16","date_gmt":"2019-10-31T19:27:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/shifruemsya-po-gostu-pamyatka-po-nastrojke-dinamicheskoj-marshrutizatsii-trafika\/"},"modified":"2019-10-31T22:27:16","modified_gmt":"2019-10-31T19:27:16","slug":"shifruemsya-po-gostu-pamyatka-po-nastrojke-dinamicheskoj-marshrutizatsii-trafika","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/shifruemsya-po-gostu-pamyatka-po-nastrojke-dinamicheskoj-marshrutizatsii-trafika","title":{"rendered":"Kr\u00fcpteerimine vastavalt GOSTile: juhend d\u00fcnaamilise liikluse marsruutimise seadistamiseks","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Kr\u00fcpteerimine
\nKui teie ettev\u00f5te edastab v\u00f5i saab v\u00f5rgus isikuandmeid ja muud konfidentsiaalset teavet, mida tuleb kaitsta seadusandluse kohaselt, tuleb rakendada GOST-iga kr\u00fcptimist. T\u00e4na r\u00e4\u00e4gime, kuidas rakendasime sellist kr\u00fcptimist S-Terra kr\u00fcpto\u00fclevaate (K\u00dc) p\u00f5hjal \u00fche kliendi juures. See lugu on huvitav IT-turbe spetsialistidele, aga ka inseneridele, projekteerijatele ja arhitektidele. Me ei s\u00fcvene tehnilise konfiguratsiooni n\u00fcanssidesse \u2014 peatume ainult p\u00f5hiparameetrite seadistamisv\u00f5imalustes. Suured kogused dokumentatsiooni Linuxi OS demonite seadistamiseks, millel S-Terra K\u00dc p\u00f5hineb, on internetis vabalt k\u00e4ttesaadavad. Dokumentatsioon S-Terra patenteeritud tarkvara seadistamiseks on samuti avatud. portaalis<\/a><\/noindex> tootjalt.
\n<\/a><\/noindex><\/p>\n

Projektist paari s\u00f5naga <\/h2>\n

\nKliendi v\u00f5rgutopoloogia oli t\u00fc\u00fcpiline \u2014 full mesh keskuse ja filiaalide vahel. Vaja oli rakendada kr\u00fcptimine teabevahetuse kanalites k\u00f5ikide 8 objekti vahel. <\/p>\n

Tavaliselt on sarnastes projektides k\u00f5ik staatiline: kr\u00fcpto\u00fclevaates (K\u00dc) seadistatakse staatilised marsruudid objekti kohalikus v\u00f5rgus, m\u00e4\u00e4ratakse IP-aadresside nimekirjad (ACL) kr\u00fcptimise jaoks. Kuid antud juhul ei ole objektidel tsentraliseeritud haldust ning nende kohalikes v\u00f5rkudes v\u00f5ib toimuda k\u00f5ike: v\u00f5rke saadakse lisada, eemaldada ja igasuguseid muudatusi teha. Selleks, et v\u00e4ltida marsruutimise ja ACL-i seadistamise \u00fcmberseadistamist K\u00dc-s kohalike v\u00f5rkude aadresside muutmisel, otsustati kasutada GRE-tunnelit ja d\u00fcnaamilist OSPF marsruutimist, kuhu on kaasatud k\u00f5ik K\u00dcd ning enamus tuumaruute objekti v\u00f5rkudes (m\u00f5nedel objektidel eelistasid infrastruktuuri administraatorid K\u00dc suunas SNAT-i tuumaruuterites). <\/p>\n

GRE-tunnelimine v\u00f5imaldas lahendada kaks \u00fclesannet:
\n1.<\/b> Kasutada ACL-is kr\u00fcptimiseks K\u00dc v\u00e4lise liidese IP-aadressi, kuhu on kapseldatud kogu liiklus, mis suundub teistele objektidele.
\n2.<\/b> Korraldada p-t-p tunnelid K\u00dcde vahel, mis v\u00f5imaldavad seadistada d\u00fcnaamilist marsruutimist (meie puhul on objektide vahel korraldatud teenusepakkuja MPLS L3VPN).<\/p>\n

Kliendi tellimus oli rakendada kr\u00fcpteerimist teenusena. Vastasel juhul oleks tal tulnud mitte ainult hallata kr\u00fcptov\u00e4ravaid v\u00f5i anda see mingile organisatsioonile allhankesse, vaid ka iseseisvalt j\u00e4lgida kr\u00fcptimissertifikaatide eluts\u00fcklit, neid \u00f5igel ajal pikendada ja uusi paigaldada.
\n\"Kr\u00fcpteerimine
\nN\u00fc\u00fcd, milline on siis meeldetuletus \u2013 kuidas ja mida me seadistasime<\/p>\n

KII subjekti t\u00e4helepanu: seadistame kr\u00fcptov\u00e4rava <\/h2>\n

<\/p>\n

V\u00f5rguhalduse p\u00f5hiseaded<\/h3>\n

\nEsiteks k\u00e4ivitame uue K\u0160 ja j\u00f5uame halduskonsooli. Alustada tasub sisseehitatud administraatori parooli muutmisest - k\u00e4sk change user password administrator<\/b>. Seej\u00e4rel tuleb l\u00e4bi viia initsialiseerimisprotseduur (k\u00e4sk initialize<\/b>) mille k\u00e4igus sisestatakse litsentsiandmed ja initsialiseeritakse juhuslike arvude generaator (JAG).<\/p>\n

Pange t\u00e4hele!<\/u><\/b> Kr\u00fcptov\u00e4rava S-Terra initsialiseerimise k\u00e4igus kehtestatakse turvapoliitika, mille kohaselt ei luba turvav\u00e4rava liidesed pakette. On vajalik kas luua enda poliitika v\u00f5i aktiveerida eelnevalt m\u00e4\u00e4ratud lubav poliitika, kasutades k\u00e4sku run csconf_mgr activate<\/b> .
\nJ\u00e4rgmiseks tuleb seadistada v\u00e4liste ja sisemiste liideste aadressid ning vaikimisi marsruut. Kr\u00fcptov\u00e4rava v\u00f5rgukonfiguratsiooniga ja kr\u00fcpteerimise seadistamisega on soovitatav t\u00f6\u00f6tada Cisco-sarnases konsoolis. See konsool on m\u00f5eldud k\u00e4skude sisestamiseks, mis on sarnased Cisco IOS-i k\u00e4skudele. Cisco-sarnases konsoolis vormistatud konfiguratsioon konverteeritakse seej\u00e4rel vastavatesse konfiguratsioonifailidesse, millega t\u00f6\u00f6tavad operatsioonis\u00fcsteemi demonid. Cisco-sarnasesse konsolisse saab minna halduskonsoolist k\u00e4su kaudu konfigureeri<\/b>.<\/p>\n

Muudame paroolid integreeritud kasutajale cscons ja enable: <\/p>\n

>enable
\nParool: csp(eelnevalt m\u00e4\u00e4ratud)
\n#configure terminal
\n#username cscons privilege 15 secret 0 #enable secret 0 \u041d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c \u0431\u0430\u0437\u043e\u0432\u0443\u044e \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e:<\/p>\n

#interface GigabitEthernet0\/0
\n#ip address 10.111.21.3 255.255.255.0
\n#no shutdown
\n#interface GigabitEthernet0\/1
\n#ip address 192.168.2.5 255.255.255.252
\n#no shutdown
\n#ip route 0.0.0.0 0.0.0.0 10.111.21.254<\/p>\n

GRE<\/h3>\n

\nV\u00e4ljuge Cisco-sarnasest konsoolist ja minge debiani shelli k\u00e4suga system<\/b>. Seame sisseehitatud kasutajale oma parooli root<\/b> k\u00e4sklusega passwd<\/b>.
\nIga K\u0160 jaoks seadistatakse iga asukoha jaoks eraldi tunnel. Tunneliliidese seadistamine toimub failis \/etc\/network\/interfaces<\/b>. Tunneliliidese loomise eest vastutab IP tunnel utiliit, mis kuulub eelnevalt m\u00e4\u00e4ratud iproute2 komplekti. Tunneliliidese loomise k\u00e4sk kirjutatakse pre-up valikusse.<\/p>\n

N\u00e4ide t\u00fc\u00fcpilise tunneliliidese konfiguratsioonist:
\nauto site1
\niface site1 inet static
\naddress 192.168.1.4
\nnetmask 255.255.255.254
\npre-up ip tunnel add site1 mode gre local 10.111.21.3 remote 10.111.22.3 key hfLYEg^vCh6p<\/p>\n

Pange t\u00e4hele!<\/u><\/b> Oluline on m\u00e4rkida, et tunnelite seadistused tuleb paigutada v\u00e4ljapoole sektsiooni <\/p>\n

###netifcfg-begin###
\n*****
\n###netifcfg-end###<\/p>\n

Vastasel juhul kirjutatakse need seadistused \u00fcle f\u00fc\u00fcsiliste liideste v\u00f5rguseadete muutmisel Cisco-taolises konsoolis.<\/p>\n

D\u00fcnaamiline suunamine<\/h3>\n

\nS-Terras on d\u00fcnaamiline suunamine rakendatud Quagga tarkvarapaketi abil. OSPF-i seadistamiseks on vajalik demonite aktiveerimine ja seadistamine zebra<\/b> ja ospfd<\/b>. Zebra demon vastutab suunamisdemonite ja operatsioonis\u00fcsteemi vahelise suhtluse eest. Ospfd demon, nagu \u00fcldiselt nimest j\u00e4reldada, vastutab OSPF-protokolli rakendamise eest.
\nOSPF seadistamine toimub kas demoni konsooli kaudu v\u00f5i otse konfiguratsioonifaili kaudu \/etc\/quagga\/ospfd.conf<\/b>. Faili lisatakse k\u00f5ik f\u00fc\u00fcsilised ja tunnelite liidesed, mis osalevad d\u00fcnaamilises suunamises, samuti kuulutatakse v\u00e4lja v\u00f5rgud, mis saavad kuulutusi edastada ja vastu v\u00f5tta.<\/p>\n

Konfiguratsiooni n\u00e4ide, mille tuleb lisada ospfd.conf<\/b>:
\nliides eth0
\n!
\nliides eth1
\n!
\nliides site1
\n!
\nliides site2
\nruuter ospf
\n ospf ruuter-id 192.168.2.21
\n v\u00f5rk 192.168.1.4\/31 ala 0.0.0.0
\n v\u00f5rk 192.168.1.16\/31 ala 0.0.0.0
\n v\u00f5rk 192.168.2.4\/30 ala 0.0.0.0<\/p>\n

Antud juhul on aadressid 192.168.1.x\/31 eraldatud tunnelite ptp-v\u00f5rkude jaoks kohtade vahel, aadressid 192.168.2.x\/30 \u2014 transiidiv\u00f5rkude jaoks kesksete ruuterite ja ruutrite vahel. <\/p>\n

Pange t\u00e4hele!<\/b><\/u> Suurem\u00f5\u00f5tmelistes paigutustes saab marsruutide tabeli v\u00e4hendamiseks filtreerida transiidiv\u00f5rkude kuulutamise no redistribute connected<\/b> v\u00f5i redistribute connected route-map<\/b>.<\/p>\n

P\u00e4rast demonite seadistamist peab muutma demonite k\u00e4ivitamise staatust \/etc\/quagga\/daemons<\/b>. Valikutes zebra<\/b> ja ospfd<\/b> no asenda yes-iga. K\u00e4ivita quagga demon ja seadista selle automaatne k\u00e4ivitamine K\u0160 k\u00e4sklusega update-rc.d quagga enable<\/b>.<\/p>\n

Kui GRE-tunnelite ja OSPF seadistamine on \u00f5igesti tehtud, siis peaks K\u0160-l ja kesksetel ruutritel olema marsruudid teiste kohtade v\u00f5rkudesse, seega tekib v\u00f5rgu \u00fchenduvus kohalike v\u00f5rkude vahel.<\/p>\n

Kr\u00fcpteerime edastatavat liiklust <\/h3>\n

\nNagu juba \u00f6eldud, n\u00e4itame tavaliselt IP-aadresside vahemikke (ACL), mille vahel kr\u00fcpteeritakse liiklus: kui alg- ja sihtadresse ei pea nende vahemike sisse, siis liiklus nende vahel kr\u00fcpteeritakse. Kuid selles projektis on struktuur d\u00fcnaamiline ja aadressid v\u00f5ivad muutuda. Kuna oleme juba seadistanud GRE-tunnelimise, saame kr\u00fcpteerimise jaoks kasutada v\u00e4liseid aadresse KSH \u2014 sest kr\u00fcpteerimisele tuleb liiklus, mis on juba GRE-protokolliga kapseldatud. Teisis\u00f5nu, kr\u00fcpteeritakse k\u00f5ik, mis siseneb KSH-st \u00fches kohas kohaliku v\u00f5rgu kaudu teistele v\u00f5rkudele, mis on reklaamitud teistes kohtades. Ja igas kohas v\u00f5ib toimuda mis tahes adresseerimine. Seega, kui m\u00f5ni kohalike v\u00f5rkude muutus toimub, peab administraator lihtsalt kohandama reklaame, mis tulevad tema v\u00f5rgust KSH suunas, ja see muutub teistele kohtadele k\u00e4tte saadavaks.<\/p>\n

KSH S-Terra kr\u00fcpteerimine toimub IPSec-protokolli kaudu. Kasutame algoritmi \u201eKuznechik\u201c vastavalt GOST R 34.12-2015, ning \u00fchilduvuse tagamiseks vanemate versioonidega v\u00f5ib kasutada GOST 28147-89. Ahituvus v\u00f5ib tehniliselt toimuda kas eeldefineeritud v\u00f5tmete (PSK) v\u00f5i sertifikaatide alusel. Siiski, t\u00f6\u00f6stuslikuks kasutamiseks on vaja kasutada sertifikaate, mis on v\u00e4lja antud GOST R 34.10-2012 alusel.<\/p>\n

Sertifikaatidega, konteineritega ja CRL-iga t\u00f6\u00f6tamine toimub utiliidi cert_mgr<\/b>. Esmalt tuleb k\u00e4suga cert_mgr create<\/b> luua privaatv\u00f5tme konteiner ja sertifikaadi taotlus, mis saadetakse sertifikaatide halduskeskusesse. Sertifikaadi saamisel tuleb see koos juursertifikaadi ja CRL-iga (kui see on kasutusel) importida k\u00e4suga cert_mgr import<\/b>. Veenduge, et k\u00f5ik sertifikaadid ja CRL on installitud, kasutades k\u00e4sku cert_mgr show<\/b>.<\/p>\n

. P\u00e4rast sertifikaatide edukat installimist liigume Cisco-like konsooli, et seadistada IPSec.
\nLoome IKE-poliitika, milles m\u00e4\u00e4ratakse soovitud algoritmid ja parameetrid, mida pakkuda partnerile kokkuleppeks. <\/p>\n

#crypto isakmp policy 1000
\n#encr gost341215k
\n#hash gost341112-512-tc26
\n#authentication sign
\n#group vko2
\n#lifetime 3600<\/p>\n

Seda poliitikat rakendatakse IPSec esimese etapi loomisel. Esimese etapi eduka l\u00e4bimise tulemus on SA (Security Association) loomine.
\nNext, we need to define the list of source and destination IP addresses (ACL) for encryption, create a transformation set, create a crypto map, and attach it to the external interface of the gateway. <\/p>\n

Setting the ACL:
\n#ip access-list extended site1
\n#permit gre host 10.111.21.3 host 10.111.22.3<\/p>\n

Transformation set (as with the first phase, we use the \"Grasshopper\" encryption algorithm with the MAC mode):<\/p>\n

#crypto ipsec transform-set GOST esp-gost341215k-mac<\/p>\n

Creating the crypto map, specifying the ACL, transformation set, and peer address:<\/p>\n

#crypto map MAIN 100 ipsec-isakmp
\n#match address site1
\n#set transform-set GOST
\n#set peer 10.111.22.3<\/p>\n

Attaching the crypto map to the external interface of the gateway:<\/p>\n

#interface GigabitEthernet0\/0
\n#ip address 10.111.21.3 255.255.255.0
\n#crypto map MAIN<\/p>\n

To encrypt channels with other sites, it is necessary to repeat the process of creating an ACL and a crypto map, changing the ACL name, IP addresses, and crypto map number.<\/p>\n

Pange t\u00e4hele! <\/u><\/b>If certificate validation via CRL is not used, it must be explicitly stated:<\/p>\n

#crypto pki trustpoint s-terra_technological_trustpoint
\n#revocation-check none<\/p>\n

Monitoring the system's 'health'<\/h2>\n

\nIn the gateway S-Terra, the standard daemon snmpd is used for monitoring. In addition to typical Linux parameters, S-Terra 'out of the box' supports outputting data on IPSec tunnels according to CISCO-IPSEC-FLOW-MONITOR-MIB, which we use to monitor the state of IPSec tunnels. It also supports custom OIDs that output the results of script execution as values. This capability allows us to track the expiration dates of certificates. The script parses the output of the command cert_mgr show<\/b> and ultimately provides the number of days until the expiration of local and root certificates. This approach is indispensable when administering a large number of gateways.
\n\"Kr\u00fcpteerimine
\n<\/p>\n

What is the essence of such encryption?<\/h2>\n

\nK\u00f5ik \u00fclaltoodud funktsionaalsus on KSH S-Terra juures \u201ekastist v\u00e4lja\u201c toetatud. See t\u00e4hendab, et ei olnud vaja installida mingeid lisamooduleid, mis v\u00f5iksid m\u00f5jutada kr\u00fcptogateide sertifitseerimist ja kogu infos\u00fcsteemi atesteerimist. Kanaleid erinevate platvormide vahel v\u00f5ib olla k\u00f5ike, isegi interneti kaudu. <\/p>\n

T\u00e4nu sellele, et siseinfrastruktuuri muutmisel ei ole vaja kr\u00fcptogateid uuesti seadistada. s\u00fcsteem t\u00f6\u00f6tab teenusena<\/b>, mis on tellija jaoks v\u00e4ga mugav: ta saab oma teenuseid (klient- ja serveriteenused) paigutada mistahes aadressidele ning k\u00f5ik muudatused edastatakse d\u00fcnaamiliselt kr\u00fcpteerimisseadmete vahel. <\/p>\n

Ilma igasuguste kahtlusteta m\u00f5jutab kr\u00fcptimine juhtidekulude (overhead) t\u00f5ttu andmete edastamise kiirus, kuid mitte m\u00e4rkimisv\u00e4\u00e4rselt \u2014 kanali l\u00e4bilaskev\u00f5ime v\u00f5ib langeda maksimaalselt 5\u201310%. Sellegipoolest on tehnoloogiat testitud ja see on n\u00e4idanud h\u00e4id tulemusi isegi satelliitkanalites, mis on \u00fcsna ebastabiilsed ja mille l\u00e4bilaskev\u00f5ime on madal. <\/p>\n

Igor Vinokhodov, 2. taseme halduse insener \u201eRostelecom-Solar\u201c<\/i>
\n
Allikas: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0415\u0441\u043b\u0438 \u0432\u0430\u0448\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u0435\u0440\u0435\u0434\u0430\u0451\u0442 \u0438\u043b\u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u043f\u043e \u0441\u0435\u0442\u0438 \u043f\u0435\u0440\u0441\u0434\u0430\u043d\u043d\u044b\u0435 \u0438 \u0434\u0440\u0443\u0433\u0443\u044e \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e, \u043f\u043e\u0434\u043b\u0435\u0436\u0430\u0449\u0443\u044e \u0437\u0430\u0449\u0438\u0442\u0435 \u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0438 \u0441 \u0437\u0430\u043a\u043e\u043d\u043e\u0434\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e\u043c, \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e \u0413\u041e\u0421\u0422\u0443. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0435\u043c, \u043a\u0430\u043a \u0432\u043d\u0435\u0434\u0440\u0438\u043b\u0438 \u0442\u0430\u043a\u043e\u0435 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0430 \u0431\u0430\u0437\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0448\u043b\u044e\u0437\u0430 (\u041a\u0428) S-Terra \u0443 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u043e\u0432. \u042d\u0442\u0430 \u0438\u0441\u0442\u043e\u0440\u0438\u044f \u0431\u0443\u0434\u0435\u0442 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0430 \u0418\u0411-\u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0430\u043c, \u043f\u0440\u043e\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0430\u043c \u0438 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u043e\u0440\u0430\u043c. \u0413\u043b\u0443\u0431\u043e\u043a\u043e \u043f\u043e\u0433\u0440\u0443\u0436\u0430\u0442\u044c\u0441\u044f \u0432 \u043d\u044e\u0430\u043d\u0441\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":29260,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-39000","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kr\u00fcpteerime vastavalt GOSTile: liikluse d\u00fcnaamilise marsruutimise seadistamise meenutus | ProHoster","description":"Kui teie ettev\u00f5te.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/shifruemsya-po-gostu-pamyatka-po-nastrojke-dinamicheskoj-marshrutizatsii-trafika","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0428\u0438\u0444\u0440\u0443\u0435\u043c\u0441\u044f \u043f\u043e \u0413\u041e\u0421\u0422\u0443: \u043f\u0430\u043c\u044f\u0442\u043a\u0430 \u043f\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 | ProHoster","og:description":"\u0415\u0441\u043b\u0438 \u0432\u0430\u0448\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f.","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/shifruemsya-po-gostu-pamyatka-po-nastrojke-dinamicheskoj-marshrutizatsii-trafika","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:27:16+00:00","article:modified_time":"2019-10-31T19:27:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"39000","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-04 15:17:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:58:40","updated":"2026-02-04 15:17:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/39000","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=39000"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/39000\/revisions"}],"predecessor-version":[{"id":156680,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/39000\/revisions\/156680"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/29260"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=39000"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=39000"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=39000"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

At this point, the configuration can be considered complete. In the output of Cisco-like console commands show crypto isakmp sa<\/b> ja show crypto ipsec sa<\/b> the established first and second phases of IPSec should be displayed. This information can also be obtained using the command sa_mgr show<\/b>, executed from the Debian shell. The output of the command cert_mgr show<\/b> should show the certificates of remote sites. The status of such certificates will be remote<\/b>. If tunnels are not built, it is necessary to look into the log VPN<\/a>-service, which is stored in the file \/var\/log\/cspvpngate.log<\/b>. A complete list of log files with descriptions of their contents is available in the documentation.<\/p>\n