{"id":95432,"date":"2020-09-29T07:42:38","date_gmt":"2020-09-29T05:42:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/razbor-samogo-demokratichnogo-iz-sd-wan-arhitektura-nastrojka-administrirovanie-i-podvodnye-kamni"},"modified":"2020-09-29T07:42:38","modified_gmt":"2020-09-29T05:42:38","slug":"razbor-samogo-demokratichnogo-iz-sd-wan-arhitektura-nastrojka-administrirovanie-i-podvodnye-kamni","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/razbor-samogo-demokratichnogo-iz-sd-wan-arhitektura-nastrojka-administrirovanie-i-podvodnye-kamni","title":{"rendered":"Demokraatliku SD-WAN'i anal\u00fc\u00fcs: arhitektuur, seadistamine, haldamine ja allveelaevad","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kuna palju k\u00fcsimusi, mis on SD-WANi kohta saabunud, on tehnoloogia hakanud Venemaal t\u00f5eliselt kasutusele v\u00f5tma. Tarnijad ei maga ega paku oma kontseptsioone, ning m\u00f5ned julgemaid esimesi kasutajaid on juba neid oma v\u00f5rgu sisse seadnud. <\/p>\n

Me teeme koost\u00f6\u00f6d peaaegu k\u00f5ikide tarnijatega ja paari aasta jooksul olen meie laboris saanud p\u00f5hjalikult uurida iga suure programmid m\u00e4\u00e4ravate lahenduste arendaja arhitektuuri. Erakordseks j\u00e4\u00e4b siin SD-WAN Fortinetilt, mis integreeris liikluse tasakaalustamise funktsiooni oma tulem\u00fc\u00fcride tarkvarasse. Lahendus on pigem demokraatlik, seet\u00f5ttu vaatavad seda tavaliselt firmad, kes pole veel globaalseks muutuseks valmis, aga soovivad oma sidekanaleid t\u00f5husamalt kasutada. <\/p>\n

Selles artiklis tahan r\u00e4\u00e4kida, kuidas seadistada ja kasutada SD-WANi Fortinetilt, kellele see lahendus sobib ja milliste probleemidega v\u00f5ib kokku puutuda. <\/a><\/noindex><\/p>\n

Suurimate m\u00e4rgatavate SD-WANi turu m\u00e4ngijate saab jaotada kahe t\u00fc\u00fcbi vahel: <\/p>\n

1. Idufirmad, kes l\u00f5id SD-WANi lahendused nullist. Edukaimad neist saavad suurte ettev\u00f5tete ostmise t\u00f5ttu tohutu arenguimpulsi \u2013 see on lugude nagu Cisco\/Viptela, VMWare\/VeloCloud, Nuage\/Nokia lugu.<\/p>\n

2. Suured v\u00f5rgu tarnijad, kes on loonud SD-WANi lahendused, edendades oma traditsiooniliste marsruutide programmeeritavust ja haldamist \u2013 see on Juniperi, Huawei lugu.<\/p>\n

Fortinet suutis leida oma tee. Tulem\u00fc\u00fcride tarkvarasse on integreeritud funktsioon, mis v\u00f5imaldab liita nende liidesed virtuaalseteks kanaliteks ja kaasata nende vahel koormuse tasakaalustamist keerukate algoritmidega, v\u00f5rreldes harjumusp\u00e4rase marsruutimisega. Seda funktsiooni nimetatakse SD-WANiks. Kas Fortineti tehtut saab nimetada SD-WANiks? Turul kujuneb j\u00e4rk-j\u00e4rgult arusaam, et Software-Defined t\u00e4hendab kontrollplaani eraldamist andmeplaanist, eraldatud kontrollerite ja orkestreerijate olemasolu. Fortinetil ei ole sellist midagi. Keskne haldamine on v\u00f5imalus ja pakutakse traditsioonilise vahendi Fortimanageri kaudu. Aga minu arvates ei tohiks otsida abstraktset t\u00f5de ja raisata aega terminites vaidluste pidamiseks. T\u00f5eses maailmas on igal l\u00e4henemisel oma tugevused ja n\u00f5rkused. Parim lahendus on neist aru saada ja osata valida lahendusi, mis vastavad \u00fclesannetele. <\/p>\n

Proovin jagada, kuidas n\u00e4eb v\u00e4lja ja mida oskab Fortineti SD-WAN, koos ekraanipiltidega.<\/p>\n

Kuidas k\u00f5ik on korraldatud <\/h3>\n

\nOletame, et teil on kaks filiaali, mis on \u00fchendatud kahe andmeedastuskanaliga. Need andmeedastuskanalid \u00fchendatakse r\u00fchmaks, sarnaselt sellele, kuidas tavalised Etherneti liidesed \u00fchendatakse LACP-Port-Channel'i kaudu. Kogenud kasutajad meenutavad PPP Multilinki \u2013 see on samuti sobiv analoog. Kanaliteks v\u00f5ivad olla f\u00fc\u00fcsilised portid, VLAN SVI ning samuti VPN<\/a> v\u00f5i GRE-tunnelid. <\/p>\n

VPN v\u00f5i GRE kasutatakse tavaliselt kohalikest v\u00f5rkudest filiaalide \u00fchendamiseks \u00fcle interneti. F\u00fc\u00fcsilisi porte kasutatakse siis, kui teenused on L2-\u00fchenduste kaudu omavahel seotud v\u00f5i kui \u00fchendus on eraldiseisva MPLS\/VPN kaudu, kui me ei soovi \u00fclekatte ja kr\u00fcpteerimist. Veel \u00fcks stsenaarium, kus SD-WAN-grupis kasutatakse f\u00fc\u00fcsilisi porte, on kasutajate kohaliku Interneti-\u00fchenduse tasakaalustamine.<\/p>\n

Meie stendis on neli tulem\u00fc\u00fcri ja kaks VPN-tunnelit, mis t\u00f6\u00f6tavad kahe \"teenusepakkuja\" kaudu. Skeem n\u00e4eb v\u00e4lja selline:<\/p>\n

\"Demokraatliku
\n
\nVPN-tunnelid on seadistatud liidese re\u017eiimis, nii et need sarnanevad punkt-punkt \u00fchendustega seadmete vahel, millel on IP-aadressid P2P-liideseid, mida saab pingida ja veenduda, et \u00fchendus konkreetse tunneli kaudu t\u00f6\u00f6tab. Selleks, et liiklus kr\u00fcpteeritaks ja suunduks teisele poole, piisab selle marsruutimisest tunnelisse. Alternatiiviks on liikluse filtreerimine kr\u00fcpteerimiseks alamv\u00f5rgu loendite abil, mis segab administraatorit, kui konfiguratsioon muutub keerukamaks. Suures v\u00f5rgus VPN-i loomiseks saab kasutada ADVPN-tehnoloogiat, mis on sarnane Cisco DMVPN-le v\u00f5i Huawei DVPN-ile, lihtsustades seadistamist.<\/p>\n

Site-to-Site VPN konfigureerimine kahes seadmes, kus m\u00f5lemal pool on BGP marsruutimine<\/b>
\n <\/p>\n

\"Andmekeskus\" (DC)
\n\"Filiaal\" (BRN)<\/p>\n

konfigureeri s\u00fcsteemi liides
\n\u2003muuda "WAN1"
\n\u2003\u2003seada vdom "Internet"
\n\u2003\u2003seata ip 1.1.1.1 255.255.255.252
\n\u2003\u2003seata lubatud juurdep\u00e4\u00e4s ping
\n\u2003\u2003seata roll wan
\n\u2003\u2003seada liides "DC-BRD"
\n\u2003\u2003seata vlanid 111
\n\u2003j\u00e4rgmine
\n\u2003muuda "WAN2"
\n\u2003\u2003seada vdom "Internet"
\n\u2003\u2003seata ip 3.3.3.1 255.255.255.252
\n\u2003\u2003seata lubatud juurdep\u00e4\u00e4s ping
\n\u2003\u2003seata roll lan
\n\u2003\u2003seada liides "DC-BRD"
\n\u2003\u2003seata vlanid 112
\n\u2003j\u00e4rgmine
\n\u2003muuda "BRN-Ph1-1"
\n\u2003\u2003seada vdom "Internet"
\n\u2003\u2003seata ip 192.168.254.1 255.255.255.255
\n\u2003\u2003seata lubatud juurdep\u00e4\u00e4s ping
\n\u2003\u2003seata t\u00fc\u00fcp tunnel
\n\u2003\u2003seata remote-ip 192.168.254.2 255.255.255.255
\n\u2003\u2003seada liides "WAN1"
\n\u2003j\u00e4rgmine
\n\u2003muuda "BRN-Ph1-2"
\n\u2003\u2003seada vdom "Internet"
\n\u2003\u2003seata ip 192.168.254.3 255.255.255.255
\n\u2003\u2003seata lubatud juurdep\u00e4\u00e4s ping
\n\u2003\u2003seata t\u00fc\u00fcp tunnel
\n\u2003\u2003seata remote-ip 192.168.254.4 255.255.255.255
\n\u2003\u2003seada liides "WAN2"
\n\u2003j\u00e4rgmine
\nl\u00f5peta<\/p>\n

konfigureeri vpn ipsec phase1-liides
\n\u2003muuda "BRN-Ph1-1"
\n\u2003\u2003seada liides "WAN1"
\n\u2003\u2003seata kohalik-gw 1.1.1.1
\n\u2003\u2003seata peerv\u00e4lja puit
\n\u2003\u2003seata net-seade keelatud
\n\u2003\u2003seata ettepanek aes128-sha1
\n\u2003\u2003seata dhgrp 2
\n\u2003\u2003seata remote-gw 2.2.2.1
\n\u2003\u2003seata psksecret ***
\n\u2003j\u00e4rgmine
\n\u2003muuda "BRN-Ph1-2"
\n\u2003\u2003seada liides "WAN2"
\n\u2003\u2003seata kohalik-gw 3.3.3.1
\n\u2003\u2003seata peerv\u00e4lja puit
\n\u2003\u2003seata net-seade keelatud
\n\u2003\u2003seata ettepanek aes128-sha1
\n\u2003\u2003seata dhgrp 2
\n\u2003\u2003seata remote-gw 4.4.4.1
\n\u2003\u2003seata psksecret ***
\n\u2003j\u00e4rgmine
\nl\u00f5peta<\/p>\n

konfigureeri vpn ipsec phase2-liides
\n\u2003muuda "BRN-Ph2-1"
\n\u2003\u2003seada phase1name "BRN-Ph1-1"
\n\u2003\u2003set proposal aes256-sha256
\n\u2003\u2003seata dhgrp 2
\n\u2003j\u00e4rgmine
\n\u2003muuda "BRN-Ph2-2"
\n\u2003\u2003seada phase1name "BRN-Ph1-2"
\n\u2003\u2003set proposal aes256-sha256
\n\u2003\u2003seata dhgrp 2
\n\u2003j\u00e4rgmine
\nl\u00f5peta<\/p>\n

config router static
\n\u2003edit 1
\n\u2003\u2003set gateway 1.1.1.2
\n\u2003\u2003seada seade "WAN1"
\n\u2003j\u00e4rgmine
\n\u2003edit 3
\n\u2003\u2003set gateway 3.3.3.2
\n\u2003\u2003seada seade "WAN2"
\n\u2003j\u00e4rgmine
\nl\u00f5peta<\/p>\n

config router bgp
\n\u2003set as 65002
\n\u2003set router-id 10.1.7.1
\n\u2003set ebgp-multipath enable
\n\u2003config neighbor
\n\u2003\u2003muuda "192.168.254.2"
\n\u2003\u2003\u2003set remote-as 65003
\n\u2003\u2003next
\n\u2003\u2003muuda "192.168.254.4"
\n\u2003\u2003\u2003set remote-as 65003
\n\u2003\u2003next
\n\u2003end<\/p>\n

\u2003config network
\n\u2003\u2003edit 1
\n\u2003\u2003\u2003set prefix 10.1.0.0 255.255.0.0
\n\u2003\u2003next
\nl\u00f5peta <\/p>\n

konfigureeri s\u00fcsteemi liides
\n\u2003muuda "WAN1"
\n\u2003\u2003seada vdom "Internet"
\n\u2003\u2003set ip 2.2.2.1 255.255.255.252
\n\u2003\u2003seata lubatud juurdep\u00e4\u00e4s ping
\n\u2003\u2003seata roll wan
\n\u2003\u2003seada liides "BRN-BRD"
\n\u2003\u2003seata vlanid 111
\n\u2003j\u00e4rgmine
\n\u2003muuda "WAN2"
\n\u2003\u2003seada vdom "Internet"
\n\u2003\u2003set ip 4.4.4.1 255.255.255.252
\n\u2003\u2003seata lubatud juurdep\u00e4\u00e4s ping
\n\u2003\u2003seata roll wan
\n\u2003\u2003seada liides "BRN-BRD"
\n\u2003\u2003set vlanid 114
\n\u2003j\u00e4rgmine
\n\u2003muuda "DC-Ph1-1"
\n\u2003\u2003seada vdom "Internet"
\n\u2003\u2003set ip 192.168.254.2 255.255.255.255
\n\u2003\u2003seata lubatud juurdep\u00e4\u00e4s ping
\n\u2003\u2003seata t\u00fc\u00fcp tunnel
\n\u2003\u2003set remote-ip 192.168.254.1 255.255.255.255
\n\u2003\u2003seada liides "WAN1"
\n\u2003j\u00e4rgmine
\n\u2003muuda "DC-Ph1-2"
\n\u2003\u2003seada vdom "Internet"
\n\u2003\u2003set ip 192.168.254.4 255.255.255.255
\n\u2003\u2003seata lubatud juurdep\u00e4\u00e4s ping
\n\u2003\u2003seata t\u00fc\u00fcp tunnel
\n\u2003\u2003set remote-ip 192.168.254.3 255.255.255.255
\n\u2003\u2003seada liides "WAN2"
\n\u2003j\u00e4rgmine
\nl\u00f5peta<\/p>\n

konfigureeri vpn ipsec phase1-liides
\n\u2003 muuda "DC-Ph1-1"
\n\u2003\u2003 seada liides "WAN1"
\n\u2003\u2003 set local-gw 2.2.2.1
\n\u2003\u2003 set peertype any
\n\u2003\u2003 set net-device disable
\n\u2003\u2003 set proposal aes128-sha1
\n\u2003\u2003 set dhgrp 2
\n\u2003\u2003 set remote-gw 1.1.1.1
\n\u2003\u2003 set psksecret ***
\n\u2003 next
\n\u2003 muuda "DC-Ph1-2"
\n\u2003\u2003 seada liides "WAN2"
\n\u2003\u2003 set local-gw 4.4.4.1
\n\u2003\u2003 set peertype any
\n\u2003\u2003 set net-device disable
\n\u2003\u2003 set proposal aes128-sha1
\n\u2003\u2003 set dhgrp 2
\n\u2003\u2003 set remote-gw 3.3.3.1
\n\u2003\u2003 set psksecret ***
\n\u2003 next
\nl\u00f5peta<\/p>\n

konfigureeri vpn ipsec phase2-liides
\n\u2003 muuda "DC-Ph2-1"
\n\u2003\u2003 seada phase1name "DC-Ph1-1"
\n\u2003\u2003 set proposal aes128-sha1
\n\u2003\u2003 set dhgrp 2
\n\u2003 next
\n\u2003 muuda "DC2-Ph2-2"
\n\u2003\u2003 seada phase1name "DC-Ph1-2"
\n\u2003\u2003 set proposal aes128-sha1
\n\u2003\u2003 set dhgrp 2
\n\u2003 next
\nl\u00f5peta<\/p>\n

config router static
\n\u2003edit 1
\n\u2003\u2003set gateway 2.2.2.2
\n\u2003\u2003seada seade "WAN1"
\n\u2003j\u00e4rgmine
\n\u2003edit 3
\n\u2003\u2003set gateway 4.4.4.2
\n\u2003\u2003seada seade "WAN2"
\n\u2003j\u00e4rgmine
\nl\u00f5peta<\/p>\n

config router bgp
\n\u2003 set as 65003
\n\u2003 set router-id 10.200.7.1
\n\u2003 set ebgp-multipath enable
\n\u2003 config neighbor
\n\u2003\u2003 muuda "192.168.254.1"
\n\u2003\u2003\u2003 set remote-as 65002
\n\u2003\u2003 next
\n\u2003\u2003muuda "192.168.254.3"
\n\u2003\u2003\u2003set remote-as 65002
\n\u2003\u2003 next
\n\u2003 end<\/p>\n

\u2003 config network
\n\u2003\u2003 edit 1
\n\u2003\u2003\u2003 set prefix 10.200.0.0 255.255.0.0
\n\u2003 \u2003next
\n l\u00f5peta <\/p>\n

<\/code><\/p>\n

Ma toon konfigureerimise tekstiversioonis, sest minu arvates on nii VPN-i seadistamine mugavam. Peaaegu k\u00f5ik seaded m\u00f5lemal pool on \u00fchesugused, tekstiversioonis saab neid lihtsalt kopeerida ja kleepida. Kui teha sama veebiliidese kaudu, on lihtne viga teha \u2014 unustada kuskil m\u00e4rk, sisestada vale v\u00e4\u00e4rtus. <\/p>\n

Peale seda, kui oleme liidesed bundi juurde lisanud<\/p>\n

\"Demokraatliku
\n
\nv\u00f5ivad k\u00f5ik marsruudid ja turvapoliitikad viidata sellele, mitte sealsetele liidetele. V\u00e4hemalt tuleb lubada liiklus sisev\u00f5rkudest SD-WAN-ile. Nende jaoks reeglite koostamisel saab rakendada turvameetmeid, nagu IPS, viiruset\u00f5rje ja HTTPS-i avamine.<\/p>\n

\"Demokraatliku
\n
\nBundi jaoks seadistatakse SD-WAN reeglid. Need reeglid m\u00e4\u00e4ravad tasakaalustamise algoritmi konkreetse liikluse jaoks. Need on sarnased marsruutimise poliitikatele, Policy-Based Routing'is, ainult et tulemuseks, kui liiklus kuulub poliitika alla, ei ole next-hop v\u00f5i tavaline v\u00e4ljaminev liides, vaid SD-WAN bundli lisatud liidesed, pluss liikluse tasakaalustamise algoritm nende vahel. <\/p>\n

Traffic can be distinguished from the general flow based on L3-L4 information, recognized applications, internet services (URLs and IPs), as well as by identified users of workstations and laptops. After that, one of the following load balancing algorithms can be assigned to the distinguished traffic:<\/p>\n

\"Demokraatliku
\n
\nIn the Interface Preference list, select the interfaces from those already added to the bundle that will serve this type of traffic. By not adding all interfaces, you can restrict which channels, for example, your email travels through if you don't want it to burden expensive channels with high SLA. In FortiOS 6.4.1, it became possible to group interfaces added to the SD-WAN bundle into zones, creating, for example, one zone for connecting to remote sites and another for local internet access using NAT. Yes, the traffic going to the regular internet can also be balanced.<\/p>\n

About load balancing algorithms
\n<\/h3>\n

\nRegarding how Fortigate (the firewall from Fortinet) splits traffic between channels, there are two interesting options that are not very common on the market:<\/p>\n

Lowest Cost (SLA)<\/b> \u2013 among all interfaces satisfying SLA at the moment, the one with the lowest cost, defined by the administrator manually, is selected; this mode is suitable for 'bulk' traffic, such as backups and file transfers. <\/p>\n

Best Quality (SLA)<\/b> \u2013 this algorithm, in addition to the usual delay, jitter, and packet loss, can also use the current channel load for quality assessment; this mode is suitable for 'sensitive' traffic, such as VoIP and video conferencing.<\/p>\n

Need for Performance SLA configuration arises for these algorithms. This measurement tool periodically checks SLA compliance information: packet loss, latency, and jitter, and can 'reject' those channels that currently do not meet the quality threshold \u2014 losing too many packets or having excessive latency. Additionally, the tool monitors the channel's status and may temporarily remove it from the bundle in case of repeated response losses. Upon recovery, after several consecutive responses, the tool automatically returns the channel to the bundle, allowing data transmission to resume.<\/p>\n

This is what the \u2018measurer\u2019 setup looks like: <\/p>\n

\"Demokraatliku
\n
\nIn the web interface, ICMP-Echo-request, HTTP-GET, and DNS request are available as testing protocols. The command line offers slightly more options: TCP-echo and UDP-echo are available, along with a specialized quality measurement protocol \u2014 TWAMP.<\/p>\n

\"Demokraatliku
\n
\nMeasurement results can be viewed in the web interface: <\/p>\n

\"Demokraatliku
\n
\nAnd in the command line: <\/p>\n

\"Demokraatliku
\n<\/p>\n

Troubleshooting<\/h3>\n

\nIf a rule was created but everything doesn't work as expected, it's worth checking the Hit Count value in the SD-WAN Rules list. It will show whether the traffic is hitting this rule at all:<\/p>\n

\"Demokraatliku
\n
\nOn the configuration page of the measurer itself, you can see the change in channel parameters over time. The threshold value of the parameter is indicated by a dashed line.<\/p>\n

\"Demokraatliku
\n
\nIn the web interface, you can view how traffic is distributed by the volume of transmitted\/received data and the number of sessions:<\/p>\n

\"Demokraatliku
\n
\nIn addition to all this, there is an excellent opportunity to track packet passage with maximum detail. In a real network setting, the device configuration accumulates numerous routing policies, firewall rules, and traffic distribution across SD-WAN ports. All of this interacts in complex ways, and while the vendor provides detailed flowcharts of packet processing algorithms, it is crucial to have the ability to observe where exactly the traffic is actually going instead of just building and verifying theories.<\/p>\n

For example, the following set of commands<\/p>\n

diagnoosige silumifiltri algallika 10.200.64.15
\ndiagnoosige silumifiltri sihtpunkt 10.1.7.2
\ndiagnoosige silumi n\u00e4ita funktsiooni-nime
\ndiagnoosige silum lubamine
\ndiagnoosige silum j\u00e4lgimine 2<\/code><\/p>\n

Will allow tracking two packets from source address 10.200.64.15 to destination address 10.1.7.2.
\nPingime adresse 10.7.1.2 RII 10.200.64.15 kaks korda ja vaatame tulemusi konsoolis.<\/p>\n

Esimene pakett:<\/p>\n

\"Demokraatliku
\n
\nTeine pakett:<\/p>\n

\"Demokraatliku
\n
\nSiin on esimene pakett, mille v\u00f5ttis vastu tulem\u00fc\u00fcr:
\nid=20085 trace_id=475 func=print_pkt_detail line=5605 msg=\"vd-Internet:0 received a packet(proto=1, 10.200.64.15:42->10.1.7.2:2048) from DMZ-Office. type=8, code=0, id=42, seq=0.\"
\nVDOM \u2013 Internet, Proto=1 (ICMP), DMZ-Office \u2013 L3-liidese nimi. <\/b>Type=8 \u2013 Echo.<\/code><\/p>\n

Selle jaoks loodi uus seanss:
\nmsg=\"m\u00e4\u00e4ra uus seanss-0006a627\"<\/code><\/p>\n

Ja avastati, et marsruutimise poliitikate seadetes on kattuvus
\nmsg=\"Match policy routing id=2136539137: to 10.1.7.2 via ifindex-110\"<\/code><\/p>\n

Selgub, et pakett tuleb saata \u00fche VPN-tunneli kaudu:
\n\"leia marsruut: flag=04000000 gw-192.168.254.1 via DC-Ph1-1\"<\/code><\/p>\n

Tulem\u00fc\u00fcripoliitikates leitakse lubav reegel:
\nmsg=\"Lubatud poliitika-3:\"<\/code><\/p>\n

Pakett kr\u00fcpteeritakse ja saadetakse VPN-tunneli kaudu:
\nfunc=ipsecdev_hard_start_xmit line=789 msg=\"sisen IPsec liides-DC-Ph1-1\"
\nfunc=_ipsecdev_hard_start_xmit line=666 msg=\"IPsec tunnel-DC-Ph1-1\"
\nfunc=esp_output4 line=905 msg=\"IPsec kr\u00fcptimine\/autentimine\"<\/code><\/p>\n

Kr\u00fcpteeritud pakett saadetakse selle WAN-liidese jaoks m\u00f5eldud v\u00e4rava aadressile:
\nmsg=\"saada 2.2.2.2 kaudu intf-WAN1\"<\/code><\/p>\n

Teise paketi puhul toimub k\u00f5ik sarnaselt, kuid see saadetakse teise VPN-tunneli kaudu ja v\u00e4ljub teise porti tulem\u00fc\u00fcrist:
\nfunc=ipsecdev_hard_start_xmit line=789 msg=\"sisen IPsec liides-DC-Ph1-2\"
\nfunc=_ipsecdev_hard_start_xmit line=666 msg=\"IPsec tunnel-DC-Ph1-2\"
\nfunc=esp_output4 line=905 msg=\"IPsec kr\u00fcptimine\/autentimine\"
\nfunc=ipsec_output_finish line=622 msg=\"saada 4.4.4.2 kaudu intf-WAN2\"<\/code><\/p>\n

Lahenduse eelised
\n<\/h3>\n

\nUsaldusv\u00e4\u00e4rne funktsionaalsus ja mugav liides. <\/b>FortiOS-i funktsioonide loetelu on t\u00e4ielikult s\u00e4ilinud alates SD-WAN-i ilmumisest. See t\u00e4hendab, et meil on mitte uuesti arendatud tarkvara, vaid k\u00fcps s\u00fcsteem usaldusv\u00e4\u00e4rselt tulem\u00fc\u00fcrivendorilt. Traditsiooniliste v\u00f5rgufunktsioonide komplektiga, mugava ja lihtsalt omandatava veebiliidese. Kas paljusid SD-WAN-i tootjaid on oma l\u00f5ppseadmetes n\u00e4iteks Remote-Access VPN funktsioon?<\/p>\n

Turvalisus tasemel 80. <\/b>FortiGate kuulub parimate tulem\u00fc\u00fcrilahenduste hulka. Internetis on palju materjale tulem\u00fc\u00fcride seadistamise ja haldamise kohta ning t\u00f6\u00f6turul on palju julgeolekuspetsialiste, kes on juba omandanud selle tootja lahendused.<\/p>\n

SD-WAN funktsiooni puhul nullkulu. <\/b>SD-WAN-v\u00f5rgu rajamine FortiGate'i peale maksab sama palju kui tavalise WAN-v\u00f5rgu rajamine, kuna SD-WAN-funktsiooni rakendamiseks ei ole vaja t\u00e4iendavaid litsentse. <\/p>\n

Madala hinna barj\u00e4\u00e4r. <\/b>Fortigate'il on erinevate tootlikkuse jaoks head seadmete klassifikatsioonid. K\u00f5ige madalamad ja odavamaid mudeleid saab kasutada, et rajada kontor v\u00f5i m\u00fc\u00fcgikoht n\u00e4iteks 3\u20135 t\u00f6\u00f6tajale. Paljudel tootjatel selliseid madala tootlikkuse ja taskukohaseid mudeleid lihtsalt ei ole. <\/p>\n

K\u00f5rge tootlikkus. <\/b>SD-WAN funktsiooni v\u00e4hendamine liikluse tasakaalustamiseks on v\u00f5imaldanud ettev\u00f5ttel vabastada spetsialiseeritud SD-WAN ASIC, mille t\u00f5ttu ei v\u00e4henda SD-WAN t\u00f6\u00f6tamise tulemust tulem\u00fc\u00fcri \u00fcldiselt. <\/p>\n

V\u00f5ime rakendada kontorit t\u00e4ielikult Fortineti seadmetel. <\/b>See on paar tulem\u00fc\u00fcre, l\u00fclitid, Wi-Fi ligip\u00e4\u00e4supunktid. Sellist kontorit on lihtne ja mugav hallata \u2013 l\u00fclitid ja ligip\u00e4\u00e4supunktid registreeritakse tulem\u00fc\u00fcrides ning hallatakse sealt. N\u00e4iteks v\u00f5ib selline v\u00e4lja n\u00e4ha l\u00fcliti port tulem\u00fc\u00fcri kasutajaliidese kaudu, millega see l\u00fcliti on hallatav:<\/p>\n

\"Demokraatliku
\n
\nKontrollerite puudumine, kui ainus rike koht. <\/b>Sellele r\u00f5hutab t\u00e4helepanu m\u00fc\u00fcja ise, kuid seda saab nimetada plussiks vaid osaliselt, kuna nendel m\u00fc\u00fcjatel, kellel kontrollerid on, on nende talitlush\u00e4ire kindlustamine suhteliselt odav, enamasti v\u00e4ikese arvu arvutusressursside maksumuse ulatuses virtualiseerimise keskkonnas.<\/p>\n

Millele t\u00e4helepanu p\u00f6\u00f6rata
\n<\/h3>\n

\nKontrollplaani ja andmeplaani puudumine<\/b>. See t\u00e4hendab, et v\u00f5rku tuleb seadistada kas k\u00e4sitsi v\u00f5i juba olemasolevate traditsiooniliste haldust\u00f6\u00f6riistadega \u2013 FortiManager. Neil m\u00fc\u00fcjatel, kellel see eristus on loodud, koguneb v\u00f5rk iseenesest. Administraatoril v\u00f5ib olla vajalik vaid korrigeerida selle topoloogiat, midagi kuskil keelata, mitte rohkem. Kuid FortiManageri eeliseks on see, et see suudab hallata mitte ainult tulem\u00fc\u00fcre, vaid ka l\u00fcliteid ja Wi-Fi ligip\u00e4\u00e4supunkte, seega praktiliselt kogu v\u00f5rku. <\/p>\n

H\u00fcpoteetiline kasv haldamise osas. <\/b>Kuna v\u00f5rgu seadistamise automatiseerimiseks kasutatakse traditsioonilisi vahendeid, haldamise tase v\u00f5rgu juurutamisega SD-WAN-is suureneb vaid veidi. Teisest k\u00fcljest, uus funktsionaalsus muutub kergemini k\u00e4ttesaadavaks, kuna m\u00fc\u00fcja vabastab selle esmalt ainult tulem\u00fc\u00fcride ops\u00fcsteemile (mis annab kohe v\u00f5imaluse selle kasutamiseks) ja alles seej\u00e4rel t\u00e4iendab juhtimiss\u00fcsteemi vajalike liideste abil.<\/p>\n

Osad funktsioonid v\u00f5ivad olla saadaval k\u00e4surealt, kuid pole k\u00e4ttesaadavad veebiliidesest. <\/b>Pole nii hirmutav vahel k\u00e4sureale minna midagi seadistama, kui see on hirmutav mitte n\u00e4ha veebiliideses, et midagi on juba seadistatud k\u00e4surealt. Kuid see puudutab tavaliselt k\u00f5ige uusi funktsioone ja j\u00e4rk-j\u00e4rgult, koos FortiOS'i uuendustega, saadakse veebiliidese v\u00f5imalused j\u00e4rk-j\u00e4rgult k\u00e4tte.<\/p>\n

Kellele sobib<\/h3>\n

\nNeile, kellel ei ole palju filiaale.<\/b> SD-WAN lahenduse rakendamine keerukate kesksete komponentidega 8-10 harukontoris ei pruugi tasuda \u2013 tuleb kulutada raha SD-WAN seadmete litsentside ja virtualiseerimiss\u00fcsteemi ressursside peale kesksete komponentide paigutamiseks. V\u00e4ikestel ettev\u00f5tetel on tavaliselt vabu arvutusressursse v\u00e4he. Fortineti puhul piisab lihtsalt tulem\u00fc\u00fcride ostmisest. <\/p>\n

Neile, kellel on v\u00e4ga palju v\u00e4ikeseid harukontoreid. <\/b>Paljude m\u00fc\u00fcjate minimaalne hind lahenduse kohta harukontori kohta on piisavalt k\u00f5rge ja ei pruugi olla l\u00f5ppkasutaja ettev\u00f5tte jaoks atraktiivne. Fortinet pakub v\u00e4ikeseid seadmeid v\u00e4ga soodsa hinnaga. <\/p>\n

Neile, kes ei ole veel valmis liiga kaugele astuma. <\/b>SD-WAN rakendamine kontrolleritega, patenteeritud marsruutimisega, uue l\u00e4henemisega v\u00f5rgu kavandamisele ja haldamisele v\u00f5ib osutuda m\u00f5ne kliendi jaoks liiga t\u00f5siseks sammuks. Jah, selline rakendamine aitab l\u00f5puks optimeerida sidekanalite kasutust ja administraatorite t\u00f6\u00f6d, kuid esmalt tuleb \u00f5ppida palju uut. Neile, kes ei ole veel paradigma muutuseks valmis, kuid soovivad oma sidekanalitest rohkem v\u00e4lja pigistada, sobib Fortineti lahendus suurep\u00e4raselt.
\n
Allikas: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0421\u0443\u0434\u044f \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u0432\u043e\u043f\u0440\u043e\u0441\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0430\u043c \u0441\u0442\u0430\u043b\u0438 \u043f\u0440\u0438\u043b\u0435\u0442\u0430\u0442\u044c \u043f\u043e SD-WAN, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f \u043d\u0430\u0447\u0430\u043b\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u0440\u0438\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0432 \u0420\u043e\u0441\u0441\u0438\u0438. \u0412\u0435\u043d\u0434\u043e\u0440\u044b, \u0435\u0441\u0442\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e, \u043d\u0435 \u0434\u0440\u0435\u043c\u043b\u044e\u0442 \u0438 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0442 \u0441\u0432\u043e\u0438 \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438, \u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u043c\u0435\u043b\u044c\u0447\u0430\u043a\u0438 \u043f\u0435\u0440\u0432\u043e\u043f\u0440\u043e\u0445\u043e\u0434\u0446\u044b \u0443\u0436\u0435 \u0432\u043d\u0435\u0434\u0440\u044f\u044e\u0442 \u0438\u0445 \u0443 \u0441\u0435\u0431\u044f \u043d\u0430 \u0441\u0435\u0442\u0438. \u041c\u044b \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u043c \u043f\u043e\u0447\u0442\u0438 \u0441\u043e \u0432\u0441\u0435\u043c\u0438 \u0432\u0435\u043d\u0434\u043e\u0440\u0430\u043c\u0438, \u0438 \u0437\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043b\u0435\u0442 \u0432 \u043d\u0430\u0448\u0435\u0439 \u043b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u044f \u0443\u0441\u043f\u0435\u043b \u043f\u043e\u043a\u043e\u043f\u0430\u0442\u044c\u0441\u044f \u0432 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0435 \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u043a\u0440\u0443\u043f\u043d\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":95433,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-95432","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Anal\u00fc\u00fcs k\u00f5ige demokraatlikumast SD-WANist: arhitektuur, seadistamine, haldamine ja peidetud ohud | ProHoster","description":"Arvestades k\u00fcsimuste arvu, mis on meile SD-WANi kohta saabunud, on tehnoloogia hakanud Venemaal t\u00f5eliselt juurduma.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/razbor-samogo-demokratichnogo-iz-sd-wan-arhitektura-nastrojka-administrirovanie-i-podvodnye-kamni","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0430\u0437\u0431\u043e\u0440 \u0441\u0430\u043c\u043e\u0433\u043e \u0434\u0435\u043c\u043e\u043a\u0440\u0430\u0442\u0438\u0447\u043d\u043e\u0433\u043e \u0438\u0437 SD-WAN: \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0430, \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430, \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0438 \u043f\u043e\u0434\u0432\u043e\u0434\u043d\u044b\u0435 \u043a\u0430\u043c\u043d\u0438 | ProHoster","og:description":"\u0421\u0443\u0434\u044f \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u0432\u043e\u043f\u0440\u043e\u0441\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0430\u043c \u0441\u0442\u0430\u043b\u0438 \u043f\u0440\u0438\u043b\u0435\u0442\u0430\u0442\u044c \u043f\u043e SD-WAN, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f \u043d\u0430\u0447\u0430\u043b\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u0440\u0438\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0432 \u0420\u043e\u0441\u0441\u0438\u0438.","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/razbor-samogo-demokratichnogo-iz-sd-wan-arhitektura-nastrojka-administrirovanie-i-podvodnye-kamni","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-29T05:42:38+00:00","article:modified_time":"2020-09-29T05:42:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"95432","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:05:30","updated":"2026-02-04 14:42:07","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/95432","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=95432"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/95432\/revisions"}],"predecessor-version":[{"id":156763,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/95432\/revisions\/156763"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/95433"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=95432"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=95432"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=95432"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}