BolΠ΅Zaka ziwiri zapitazo, tidalemba kuti woyang'anira aliyense wa Check Point posachedwa adzakumana ndi vuto lakukonzanso mtundu watsopano. Mu izi
Monga mukudziwira, pali zosankha za 2 zogwiritsira ntchito Check Point: Standalone ndi Distributed, ndiko kuti, popanda seva yodzipatulira komanso yodzipatulira. Njira Yogawa imalimbikitsidwa kwambiri pazifukwa zingapo:
-
katundu pazipata zipata zimachepetsedwa;
-
Simusowa kukonza zenera lokonzekera kuti mugwire ntchito pa seva yoyang'anira;
-
kugwira ntchito mokwanira kwa SmartEvent, chifukwa sikungagwire ntchito mu mtundu wa Standalone;
-
Ndikofunikira kwambiri kupanga gulu la zipata mu kasinthidwe ka Distributed.
Poganizira zabwino zonse za kasinthidwe ka Distributed, tilingalira kukweza seva yoyang'anira ndi chipata chachitetezo padera.
Kusintha kwa Seva Yoyang'anira Chitetezo (SMS).
Pali njira ziwiri zosinthira SMS:
-
kudzera ku CPUSE (kudzera Gaia Portal)
-
pogwiritsa ntchito Migration Tools (kukhazikitsa koyera kumafunika - kukhazikitsa mwatsopano)
Kusintha pogwiritsa ntchito CPUSE sikuvomerezedwa ndi ogwira nawo ntchito a Check Point chifukwa sikungasinthe mtundu wanu wamafayilo ndi kernel. Komabe, njirayi sikutanthauza kusamuka kwa ndondomeko ndipo ndi yofulumira komanso yosavuta kuposa njira yachiwiri.
Kukhazikitsa koyera ndi kusamuka kwa mfundo pogwiritsa ntchito Migration Tools ndiyo njira yovomerezeka. Kuphatikiza pa fayilo yatsopano ndi kernel ya Os, nthawi zambiri zimachitika kuti Nawonso achichepere a SMS atsekeka, ndipo kuyika koyera pankhaniyi ndi njira yabwino kwambiri yowonjezerera liwiro ku seva.
1) Gawo loyamba pazosintha zilizonse ndikupanga zosunga zobwezeretsera ndi zithunzi. Ngati muli ndi seva yoyang'anira thupi, ndiye kuti zosunga zobwezeretsera ziyenera kupangidwa kuchokera pa intaneti ya Gaia Portal. Pitani ku tabu Kukonza> Zosunga Zadongosolo> Zosunga zobwezeretsera. Kenako, inu mwachindunji malo kusunga zosunga zobwezeretsera. Izi zitha kukhala seva ya SCP, FTP, TFTP, kapena kwanuko pa chipangizocho, koma muyenera kukweza zosunga zobwezeretsera ku seva kapena kompyuta pambuyo pake.
Chithunzi 1. Kupanga zosunga zobwezeretsera ku Gaia Portal
2) Kenako muyenera kutenga chithunzithunzi pa tabu Kukonza β Kuwongolera Zithunzi β Chatsopano. Kusiyana pakati pa zosunga zobwezeretsera ndi zithunzithunzi ndikuti zithunzithunzi zimasunga zambiri, kuphatikiza ma hotfixes onse omwe adayikidwa. Komabe, ndi bwino kuchita zonse ziwiri.
Ngati seva yanu yoyang'anira imayikidwa ngati makina enieni, ndiye kuti tikulimbikitsidwa kupanga zosunga zobwezeretsera makinawo pogwiritsa ntchito zida za hypervisor. Ndizofulumira komanso zodalirika.
Chithunzi 2. Kupanga chithunzithunzi ku Gaia Portal
3) Sungani kasinthidwe kachipangizo kuchokera ku Gaia Portal. Mutha kujambula makonda onse omwe ali mu Gaia Portal, kapena lowetsani lamulo kuchokera ku Clish sungani kasinthidwe. Kenako, tengerani fayilo ku PC yanu pogwiritsa ntchito WinSCP kapena kasitomala wina.
Chithunzi 3. Kusunga kasinthidwe ku fayilo yamawu)
ndemanga: ngati WinSCP sikukulolani kuti mulumikizane, sinthani chipolopolo cha ogwiritsa ntchito kukhala / bin/bash mwina pa intaneti pa Ogwiritsa tabu, kapena polowetsa lamulo. chsh -s /bin/bash.
Kusintha ndi CPUSE
4) Masitepe atatu oyamba ndi ovomerezeka pazosintha zilizonse. Ngati mwasankha kutenga njira yosavuta yosinthira, ndiye mu mawonekedwe a intaneti pitani ku tabu Zokweza (CPUSE) > Mkhalidwe ndi Zochita > Mabaibulo Aakulu > Chongani Point R80.40 Gaia Mwatsopano Ikani ndi Kukweza. Dinani kumanja pazosinthazi ndikusankha Wotsimikizira. Njira yotsimikizira idzayamba kwa mphindi zingapo, pambuyo pake mudzawona uthenga woti chipangizocho chikhoza kusinthidwa. Ngati muwona zolakwika, ziyenera kukonzedwa.
Chithunzi 4. Kusintha kudzera mu CPUSE
5) Kusintha kwa CDT (Central Deployment Tool) - chida chomwe chimagwira ntchito pa seva yoyang'anira ndikukulolani kuti muyike zosintha, mapaketi a ntchito, kusamalira zosunga zobwezeretsera, zithunzithunzi, zolemba ndi zina zambiri. Mtundu wachikale wa CDT ukhoza kuyambitsa zovuta pakukonzanso. Mutha kutsitsa CDT pa
6) Mukayika zosungidwa zomwe zatsitsidwa pa SMS mu bukhu lililonse kudzera pa WinSCP, lumikizani kudzera pa SSH kupita ku SMS ndikulowetsa akatswiri. Ndiroleni ndikukumbutseni kuti wogwiritsa ntchito WinSCP ayenera kukhala ndi chipolopolo / bin / bash!
7) Lowetsani malamulo:
cd/somepathtoCDT/
phula -zxvf .tgz
rpm -Uhv -kakamiza CPcdt-00-00.i386.rpm
Chithunzi 5. Kuyika Chida Chapakati Chotumizira (CDT)
8) Chotsatira ndikuyika chithunzi cha R80.40. Dinani pomwe pakusintha Koperani, ndiye Sakani. Kumbukirani kuti zosinthazi zidzatenga mphindi 20-30 ndipo seva yoyang'anira sidzakhalapo kwakanthawi. Choncho, ndizomveka kuvomereza pawindo la utumiki.
9) Zilolezo zonse ndi ndondomeko zachitetezo zimasungidwa, kenako muyenera kutsitsa yatsopano
10) Lumikizani ku SMS SmartConsole yatsopano ndikukhazikitsa mfundo zachitetezo. Batani Ikani Policy mu ngodya yakumanzere yakumtunda.
11) SMS yanu yasinthidwa, kenako muyenera kukhazikitsa hotfix yaposachedwa. Mu tabu Zowonjezera (CPUSE)> Mkhalidwe ndi Zochita> Zosintha dinani pa batani lakumanja la mbewa Verifierndiye Sakani Zosintha. Chipangizocho chidzayambiranso chokha pambuyo pa kukhazikitsa zosintha.
Chithunzi 6. Kuyika hotfix yatsopano kudzera mu CPUSE
Kusintha ndi Migration Tools
4) Choyamba, muyenera kusinthanso ku mtundu waposachedwa wa CDT - mfundo 5, 6, 7 kuchokera pagawo. "Sinthani pogwiritsa ntchito CPUSE."
5) Ikani phukusi la Migration Tools lomwe likufunika kuti musamutse ndondomeko kuchokera pa seva yoyang'anira. Malinga ndi izi
6) Kenako mu mawonekedwe a intaneti a SMS pitani ku tabu Zokweza (CPUSE)> Mkhalidwe ndi Zochita> Lowetsani Phukusi> Sakatulani> Sankhani fayilo yomwe mwatsitsa> Lowetsani.
Chithunzi 7. Kulowetsa Zida Zosamuka
7) Kuchokera pamachitidwe a akatswiri pa SMS, fufuzani kuti phukusi la Migration Tools lakhazikitsidwa pogwiritsa ntchito lamulo (kutulutsa kwa lamulo kuyenera kufanana ndi nambala yomwe ili m'dzina la Migration Tools archive):
cpprod_util CPPROD_GetValue CPupgrade-tools-R80.40 BuildNumber 1
Chithunzi 8. Kutsimikizira kuyika kwa Migration Tools
8) Pitani ku chikwatu cha $FWDIR/scripts pa seva yoyang'anira:
cd $FWDIR/scripts
9) Thamangani chotsimikizira chisanachitike pogwiritsa ntchito lamulo (ngati pali zolakwika, zikonzeni musanapite patsogolo):
./migrate_server tsimikizirani -v R80.40
ndemanga: ngati muwona cholakwika βZakanika kubweza phukusi la Upgrade Toolsβ, koma mwawona kuti zosungidwazo zidatumizidwa bwino (onani mfundo 4), gwiritsani ntchito lamulo:
./migrate_server tsimikizirani -v R80.40 -skip_upgrade_tools_check
Chithunzi 9. Kuthamanga script yotsimikizira
10) Tumizani ndondomeko zachitetezo pogwiritsa ntchito lamulo:
./migrate_server kutumiza kunja -v R80.40 / / .tgz
Chithunzi 10. Kutumiza kunja ndondomeko ya chitetezo
ndemanga: ngati muwona cholakwika βZakanika kubweza phukusi la Upgrade Toolsβ, koma mwawona kuti zosungidwazo zidatumizidwa bwino (gawo 7), gwiritsani ntchito lamulo:
./migrate_server export -skip_upgrade_tools_check -v R80.40 / / .tgz
11) Werengani MD5 hash sum ndikusunga zotuluka za lamulo:
md5sum / / .tgz
Chithunzi 11. Kuwerengera MD5 hash sum
12) Pogwiritsa ntchito WinSCP, sunthani fayiloyi ku kompyuta yanu.
13) Lowani lamulo df -h ndipo dzisungireni kuchuluka kwa akalozera kutengera malo omwe mwakhala.
Chithunzi 12. Peresenti ya zolemba pa SMS
14.1) Ngati muli ndi SMS yeniyeni
14.1.1) Kugwiritsa
14.1.2) Ndikupangira kukonzekera ma drive 2 a bootable flash, popeza zimachitika kuti flash drive siyiwerengeka nthawi zonse.
14.1.3) Monga woyang'anira pa kompyuta yanu, thamangani ISOmorphic.exe. Mu sitepe 1, sankhani chithunzi chotsitsidwa cha Gaia R80.40, mu sitepe 4 flash drive. Sinthani mfundo 2 ndi 3 Posafunikira!
Chithunzi 13. Kupanga bootable USB flash drive
14.1.4) Sankhani chinthu "Ikani zokha popanda kutsimikizira" ndipo ndikofunikira kufotokozera mtundu wa seva yanu yoyang'anira. Pankhani ya SMS, muyenera kusankha mzere 3 kapena 4.
Chithunzi 14. Kusankha chitsanzo cha chipangizo kuti mupange bootable USB flash drive
14.1.5) Kenako, muzimitsa upline, ikani kung'anima padoko la USB, kulumikiza chingwe cholumikizira kudzera pa doko la COM ku chipangizo ndikuyambitsa SMS. The unsembe ndondomeko zimachitika basi. Adilesi ya IP yofikira - 192.168.1.1/24, ndi zambiri zolowera boma / boma.
14.1.6) Chotsatira ndikulumikiza mawonekedwe a intaneti pa Gaia Portal (adiresi yokhazikika
14.2) Ngati muli ndi ma SMS enieni
14.2.1) Musalole kuti muchotse ma SMS akale; pangani makina atsopano okhala ndi zinthu zomwezo (CPU, RAM, HDD) ndi adilesi yomweyo ya IP. Mwa njira, mutha kuwonjezera RAM ndi HDD, popeza mtundu wa R80.40 ndiwofunikira pang'ono. Kuti mupewe mikangano ya adilesi ya IP, zimitsani SMS yakale ndikuyamba kukhazikitsa ina.
14.2.2) Pakukhazikitsa Gaia, sinthani adilesi ya IP yomwe ilipo ndikusankha chikwatu / mizu malo okwanira. Maperesenti aakalozera omwe muli nawo akuyenera kukhala pafupifupi pulumuka, gwiritsani ntchito zotsatira df -h.
15) Panthawi yosankha mtundu wa kukhazikitsa "Installation Type" sankhani njira yoyamba, chifukwa mwina mulibe MDS (Multi-Domain Server). Ngati MDS, ndiye kuti munayang'anira madambwe ambiri kuchokera kumabungwe osiyanasiyana a SMS nthawi imodzi. Pankhaniyi, muyenera kusankha chinthu chachiwiri.
Chithunzi 15. Kusankha mtundu wa kukhazikitsa Gaia
16) Mfundo yofunika kwambiri yomwe siyingawongoleredwe popanda kuyikanso ndikusankha gulu. Ayenera kusankha Kusamalira Chitetezo ndi dinani Ena. Zina zonse ndi zosakhazikika.
Chithunzi 16. Kusankha mtundu wa bungwe poika Gaia
17) Chidacho chikayambiranso, gwirizanitsani ndi intaneti pogwiritsa ntchito
18) Tumizani zosintha kuchokera pazithunzi kupita ku ma tabo onse a Gaia Portal momwe china chake chinakhazikitsidwa, kapena yendetsani lamulo kuchokera ku clish. katundu kasinthidwe .ndilembereni. Fayilo yosinthira iyi iyenera kukwezedwa ku SMS.
ndemanga: Chifukwa chakuti OS ndi yatsopano, WinSCP sikukulolani kuti mugwirizane ngati woyang'anira, sinthani chipolopolo cha ogwiritsa ntchito kukhala / bin/bash kaya pa intaneti pa Ogwiritsa ntchito tabu, kapena polowetsa lamulo. chsh -s /bin/bash kapena pangani wosuta watsopano.
19) Kwezani fayiloyo ndi mfundo zotumizidwa kunja kuchokera ku seva yakale yoyang'anira kupita ku chikwatu chilichonse. Kenako pitani ku console mumalowedwe aukadaulo ndikuwonetsetsa kuti kuchuluka kwa hashi ya MD5 ikufanana ndi yapitayo. Kupanda kutero, kutumiza kuyenera kuchitidwanso:
md5sum / / .tgz
20) Bwerezani sitepe 6 ndikuyika Zida Zokweza pa SMS yatsopano ku Gaia Portal mu tabu. Zokweza (CPUSE)> Mkhalidwe ndi Zochita.
21) Lowetsani lamulo mumayendedwe aukadaulo:
./migrate_server import -v R80.40 -skip_upgrade_tools_check / / .tgz
Chithunzi 17. Kulowetsa ndondomeko ya chitetezo ku SMS yatsopano
22) Yambitsani ntchito ndi lamulo cp kuyamba.
23) Tsitsani yatsopano
Chithunzi 18. Kuyang'ana malayisensi oikidwa
24) Khazikitsani ndondomeko yachitetezo pachipata kapena gulu - Ikani Policy.
Kusintha kwa Security Gateway (SG).
The Security Gateway ikhoza kusinthidwa kudzera pa CPUSE, monga seva yoyang'anira, kapena kuyikanso - kukhazikitsa mwatsopano. Kuchokera pazochitika zanga, mu 99% ya milandu, aliyense amaikanso Security Gateway chifukwa zimatenga nthawi yofanana ndi kukonzanso kudzera mu CPUSE, koma mumapeza OS yoyera, yosinthidwa popanda nsikidzi.
Poyerekeza ndi SMS, choyamba muyenera kupanga zosunga zobwezeretsera ndi chithunzithunzi, komanso kusunga zosintha kuchokera ku Gaia Portal. Onani mfundo 1, 2 ndi 3 mβgawo "Security Management Server Update".
Kusintha ndi CPUSE
Kukonzanso Chipata Chachitetezo kudzera pa CPUSE ndikofanana ndendende ndi kukonzanso Seva Yoyang'anira Chitetezo, kotero chonde onani koyambirira kwa nkhaniyi.
Mfundo yofunika: Kusintha kwa SG kumafunika kuyambiranso! Choncho, kusintha pa kukonza zenera. Ngati muli ndi gulu, konzani node yoyamba, kenako sinthani maudindo ndikukweza mfundo ina. Pankhani ya tsango, mazenera okonza amatha kupewedwa.
Kuyika mtundu watsopano wa OS pa Security Gateway
1.1) Ngati muli ndi SG yeniyeni
1.1.1) Kugwiritsa
1.1.2) Ndikupangira kukonzekera ma drive 2 a bootable flash, popeza zimachitika kuti flash drive siyiwerengeka nthawi zonse.
1.1.3) Monga woyang'anira pa kompyuta yanu, thamangani ISOmorphic.exe. Mu sitepe 1, sankhani chithunzi chotsitsidwa cha Gaia R80.40, mu sitepe 4 flash drive. Sinthani mfundo 2 ndi 3 Posafunikira!
Chithunzi 19. Kupanga bootable USB flash drive
1.1.4) Sankhani chinthu "Ikani zokha popanda kutsimikizira", ndipo ndikofunikira kusonyeza chitsanzo cha Chitetezo chanu - mizere 2 kapena 3. Ngati ili ndi mchenga wakuthupi (SandBlast Appliance), ndiye sankhani mzere 5.
Chithunzi 20. Kusankha chitsanzo cha chipangizo kuti mupange bootable USB flash drive
1.1.5) Kenako, muzimitsa upline, ikani flash drive mu doko la USB, kulumikiza chingwe cholumikizira kudzera pa doko la COM ku chipangizocho ndikutsegula chipata. The unsembe ndondomeko zimachitika basi. Adilesi ya IP yofikira - 192.168.1.1/24, ndi zambiri zolowera boma / boma. Muyenera kusintha kaye passive node, kenako ikani ndondomeko pa izo, sinthani maudindo ndikusintha mfundo ina. Mudzafunika zenera la utumiki.
1.1.6) Chotsatira ndikulumikiza mawonekedwe a intaneti pa Gaia Portal, komwe mumadutsa poyambitsa koyamba kwa chipangizocho. Mumayambiriro amakanikiza Ena, chifukwa pafupifupi makonda onse akhoza kusinthidwa mtsogolo. Komabe, mutha kusintha nthawi yomweyo adilesi ya IP, zoikamo za DNS ndi dzina la alendo.
1.2) Ngati muli ndi SG yeniyeni
1.2.1) Pangani makina atsopano omwe ali ndi zinthu zomwezo (CPU, RAM, HDD) kapena zambiri, popeza mtundu wa R80.40 ndi wovuta kwambiri. Kuti mupewe kusamvana kwa ma adilesi a IP, zimitsani chipata chakale ndikuyamba kukhazikitsa chatsopano ndi adilesi ya IP yomweyo. SG yakale ikhoza kuchotsedwa bwino, popeza palibe chinthu chamtengo wapatali pa izo, chifukwa zinthu zonse zofunika kwambiri - ndondomeko ya chitetezo - zili pa seva yoyang'anira.
1.2.2) Pakuyika kwa OS, sinthani adilesi ya IP yomwe ilipo ndikusankha chikwatu / mizu malo okwanira.
3) Lumikizani pachipata kudzera pa doko la HTTPS ndikuyamba njira yoyambira. Pa nthawi yosankha mtundu wa kukhazikitsa "Installation Type" sankhani njira yoyamba - Security Gateway ndi/kapena Security Management.
Chithunzi 21. Kusankha mtundu wa kukhazikitsa Gaia
4) Mfundo yofunika kwambiri ndi kusankha chinthu (Zogulitsa). Ayenera kusankha Chipata Chachitetezo ndipo, ngati muli ndi tsango, onani bokosilo "Chigawo ndi gawo la gulu, mtundu: ClusterXL". Ngati muli ndi gulu la VRRP, ndiye sankhani mtundu uwu, koma sizingatheke.
Chithunzi 22. Kusankha mtundu wa bungwe poika Gaia
5) Mu sitepe yotsatira, ikani mawu achinsinsi a SIC kamodzi kuti mukhazikitse chidaliro ndi seva yoyang'anira. Pogwiritsa ntchito mawu achinsinsiwa, satifiketi imapangidwa, ndipo seva yoyang'anira imalumikizana ndi chipata panjira yolumikizirana yobisika. Chongani chizindikiro "Lumikizani ku Management yanu ngati Service" ziyenera kukhazikitsidwa ngati seva yoyang'anira ili mumtambo. Tangolemba kumene za izi
Chithunzi 23. Kulengedwa kwa SIC
6) Yambitsani njira yoyambira patsamba lotsatira. Chidacho chikangoyambiranso, gwirizanitsani mawonekedwe a intaneti ndikusintha zosintha kuchokera pazithunzi kupita ku ma tabu onse a Gaia Portal momwe china chake chinakhazikitsidwa, kapena yendetsani lamulo kuchokera ku clish. katundu kasinthidwe .ndilembereni. Fayilo yosinthira iyi iyenera kukwezedwa kaye pachipata chachitetezo.
ndemanga: Chifukwa chakuti OS ndi yatsopano, WinSCP sikukulolani kuti mugwirizane ngati woyang'anira, sinthani chipolopolo cha ogwiritsa ntchito kukhala / bin/bash kaya pa intaneti pa Ogwiritsa ntchito tabu, kapena polowetsa lamulo. chsh -s /bin/bash kapena pangani wosuta watsopano ndi chipolopolo ichi.
7) Tsegulani
Chithunzi 24: Kukhazikitsa chidaliro ndi chipata chatsopano chachitetezo
8) Mtundu wa Gaia wa chinthucho uyenera kusintha, ngati sichisintha, ndiye musinthe pamanja. Ndiye kukhazikitsa ndondomeko pachipata.
9) Mu Gaia Portal, pitani ku tabu Zowonjezera (CPUSE)> Mkhalidwe ndi Zochita> Zosintha ndikuyika hotfix yaposachedwa. Chipangizocho chidzalowa yambitsanso pa unsembe!
10) Ngati pali gulu, sinthani maudindo a node ndikuchitanso chimodzimodzi pa mfundo ina.
Pomaliza
Ndinayesa kupanga chitsogozo chomveka bwino komanso chomveka bwino chowongolera kuchokera ku R80.20/R80.30 kupita ku R80.40 yamakono, popeza zambiri zasintha. Baibulo
Pamafunso aliwonse mutha kulumikizana nafe. Tidzakhala okondwa kuthandiza ndi zosintha zovuta kwambiri ndi milandu ngati gawo la chithandizo chathu chaukadaulo
Source: www.habr.com