{"id":94118,"date":"2020-09-13T07:42:29","date_gmt":"2020-09-13T05:42:29","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/7-ngfw-dlya-malogo-biznesa-proizvoditelnost-i-obshhie-rekomendaczii"},"modified":"2020-09-13T07:42:29","modified_gmt":"2020-09-13T05:42:29","slug":"7-ngfw-dlya-malogo-biznesa-proizvoditelnost-i-obshhie-rekomendaczii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/7-ngfw-dlya-malogo-biznesa-proizvoditelnost-i-obshhie-rekomendaczii","title":{"rendered":"7. NGFW v\u00e4ikeettev\u00f5tete jaoks. J\u00f5udlus ja \u00fcldised soovitused","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"7.<\/p>\n

On the time to conclude the article series on the new generation of SMB Check Point (Series 1500). We hope that this has been a valuable experience for you and that you will continue to follow us on the TS Solution blog. The topic of the final article is not widely covered, but it is no less important \u2014 tuning SMB performance. In it, we will discuss the configuration possibilities of the hardware and software components of the NGFW, outline the available commands, and describe the interaction methods.<\/p>\n

K\u00f5ik NGFW artiklite ts\u00fckli postitused v\u00e4ikeettev\u00f5tetele: <\/p>\n

    \n
  1. \n

    Uus CheckPoint 1500 turvav\u00e4rava tootesari<\/u><\/a><\/noindex><\/p>\n<\/li>\n

  2. \n

    Pakendite avamine ja seadistamine<\/u><\/a><\/noindex><\/p>\n<\/li>\n

  3. \n

    Traadita andmeedastus: WiFi ja LTE<\/u><\/a><\/noindex><\/p>\n<\/li>\n

  4. \n

    VPN<\/u><\/a><\/noindex><\/p>\n<\/li>\n

  5. \n

    Pilvehaldus SMP<\/u><\/a><\/noindex><\/p>\n<\/li>\n

  6. \n

    Smart-1 Cloud<\/u><\/a><\/noindex><\/p>\n<\/li>\n<\/ol>\n

    Praeguseks on olemas vaid m\u00f5ned teabeallikad SMB lahenduste j\u00f5udluse h\u00e4\u00e4lestamise kohta, arvestades piirangud<\/u><\/a><\/noindex> the internal OS \u2014 Gaia 80.20 Embedded. In our article, we will use a layout with centralized management (dedicated Management Server) \u2014 it allows applying more tools when working with NGFW.<\/p>\n

    Riistvara<\/h2>\n

    Enne Check Point SMB arhitektuuri k\u00e4sitlemist v\u00f5ite alati p\u00f6\u00f6rduda oma partneri poole, et kasutada t\u00f6\u00f6riista Appliance Sizing Tool<\/em>, et valida optimaalse lahenduse vastavalt antud parameetritele (l\u00e4bivool, oodatav kasutajate arv jne).<\/p>\n

    Olulised m\u00e4rkused riistvara interaktsioonis teie NGFW-ga<\/p>\n

      \n
    1. \n

      NGFW lahendustel SMB peres ei ole v\u00f5imalik s\u00fcsteemikomponente (CPU, RAM, HDD) f\u00fc\u00fcsiliselt uuendada, s\u00f5ltuvalt mudelist on SD-kaardid toetatud, mis v\u00f5imaldab laiendada ketta kapatsiteeti, kuid mitte oluliselt.<\/p>\n<\/li>\n

    2. \n

      V\u00f5rguliideste t\u00f6\u00f6 n\u00f5uab j\u00e4lgimist. Gaia 80.20 Embedded'is ei ole palju j\u00e4lgimisriistu, kuid v\u00f5ite alati kasutada tuntud k\u00e4sku CLI-s Expert re\u017eiimis <\/p>\n

      # ifconfig<\/em><\/p>\n

      \"7.<\/p>\n

      P\u00f6\u00f6rake t\u00e4helepanu allajoonitud ridadele, need aitavad teil hinnata vigade arvu liideses. Soovitame neid parameetreid kontrollida teie NGFW esmakordsel juurutamisel ning ka perioodiliselt selle kasutamise ajal.<\/p>\n<\/li>\n

    3. \n

      T\u00e4ieliku Gaia jaoks on k\u00e4sk: <\/p>\n

      > show diag <\/p>\n

      With it, you can obtain information about the hardware temperature. Unfortunately, in 80.20 Embedded, this option is unavailable; we will specify the most popular SNMP traps:<\/p>\n

      Nimi <\/strong><\/p>\n

      Kirjeldus<\/strong><\/p>\n

      Interface disconnected<\/em><\/p>\n

      Liidese katkestamine<\/p>\n

      VLAN removed<\/em><\/p>\n

      VLAN-i eemaldamine<\/p>\n

      High memory utilization<\/em><\/p>\n

      K\u00f5rge RAM-i kasutamine<\/p>\n

      Low disk space<\/em><\/p>\n

      HDD-l on v\u00e4he vaba ruumi<\/p>\n

      High CPU utilization<\/em><\/p>\n

      K\u00f5rge CPU kasutamine<\/p>\n

      High CPU interrupts rate<\/em><\/p>\n

      K\u00f5rge katkemise m\u00e4\u00e4r<\/p>\n

      High connection rate<\/em><\/p>\n

      K\u00f5rge uute \u00fchenduste voog<\/p>\n

      K\u00f5rge samal ajal \u00fchenduste arv<\/em><\/p>\n

      K\u00f5rge konkurentsi seansside tase<\/p>\n

      K\u00f5rge tulem\u00fc\u00fcr\u00fc l\u00e4bilaskev\u00f5ime<\/em><\/p>\n

      K\u00f5rge tulem\u00fc\u00fcrip\u00f5hise l\u00e4bilaskev\u00f5ime tase<\/p>\n

      K\u00f5rge vastuv\u00f5etud pakettide m\u00e4\u00e4r<\/em><\/p>\n

      K\u00f5rge pakettide vastuv\u00f5tu tase<\/p>\n

      Klastri liikme olek muutus<\/em><\/p>\n

      Klastri oleku muutmine<\/p>\n

      \u00dchendus logiserveriga eba\u00f5nnestus<\/em><\/p>\n

      \u00dchendus Log-Serveriga katkes<\/p>\n<\/li>\n

    4. \n

      Teie v\u00e4rava t\u00f6\u00f6 n\u00f5uab RAM-i kontrolli. Gaia (Linuxi sarnane OP) jaoks on see normaalne olukord<\/u><\/a><\/noindex>, kui RAM-i kasutuse osakaal t\u00f5useb 70-80% -ni. <\/p>\n

      SMB-lahenduste arhitektuuris ei ole SWAP-m\u00e4lu kasutamine ette n\u00e4htud, erinevalt vanematest Check Pointi mudelitest. Siiski, Linuxi s\u00fcsteemifailides on t\u00e4heldatud , mis n\u00e4itab teoreetilist v\u00f5imalust muuta SWAP-i parameetrit.<\/p>\n<\/li>\n<\/ol>\n

      Tarkvaraline osa<\/h2>\n

      Artikli avaldamise hetkel kehtiv<\/u><\/a><\/noindex> Gaia version \u2014 80.20.10. You need to know that there are limitations when working in CLI: in Expert mode, some Linux commands are supported. To evaluate the performance of the NGFW, it is necessary to assess the operation of demons and services; more detailed information can be found in artiklis<\/u><\/a><\/noindex> minu kolleegi k\u00e4est. Me vaatame SMB jaoks v\u00f5imalikke k\u00e4ske.<\/p>\n

      T\u00f6\u00f6 Gaia OS-iga<\/p>\n

        \n
      1. \n

        SecureXL mallide vaatamine<\/p>\n

        # fwaccel stat<\/strong><\/p>\n

        \"7.<\/li>\n

      2. \n

        Ydede koormuse vaatamine<\/p>\n

        # fw ctl multik stat<\/strong><\/p>\n

        \"7.<\/li>\n

      3. \n

        Seansside (\u00fchenduste) arvu vaatamine.<\/p>\n

        # fw ctl pstat<\/strong><\/p>\n

        \"7.<\/li>\n

      4. \n

        *Klastri oleku vaatamine<\/p>\n

        # cphaprob stat<\/strong><\/p>\n

        \"7.<\/li>\n

      5. \n

        Klassikaline Linuxi k\u00e4sk TOP<\/p>\n<\/li>\n<\/ol>\n

        Logimine<\/h3>\n

        As you already know, there are three ways to work with NGFW logs (storage, processing): locally, centrally, and in the cloud. The latter two options imply the presence of an entity \u2014 Management Server. <\/p>\n

        NGFW haldamise v\u00f5imalikud skeemid\"7.<\/p>\n

        K\u00f5ige v\u00e4\u00e4rtuslikumad logifailid<\/p>\n

          \n
        1. \n

          S\u00fcsteemi s\u00f5numid (sisaldab v\u00e4hem teavet kui t\u00e4isversioon Gaia-st)<\/p>\n

          # tail -f \/var\/log\/messages2<\/strong><\/p>\n

          \"7.<\/li>\n

        2. \n

          Vead bleyidide t\u00f6\u00f6s (kasulik fail probleemide otsimisel)<\/p>\n

          # tail -f \/var\/log\/log\/sfwd.elg<\/strong><\/p>\n

          \"7.<\/li>\n

        3. \n

          S\u00fcsteemi tasandi tuumapuhvri s\u00f5numite vaatamine.<\/p>\n

          # dmesg<\/strong><\/p>\n

          \"7.<\/li>\n<\/ol>\n

          Bleyidide konfiguratsioon<\/h2>\n

          See osa ei sisalda t\u00e4ielikke juhiseid teie NGFW Check Pointi seadistamiseks, see sisaldab ainult meie soovitusi, mis on v\u00e4lja t\u00f6\u00f6tatud praktilise kogemuse p\u00f5hjal. <\/p>\n

          Rakenduste kontroll \/ URL-i filtreerimine<\/p>\n