{"id":31058,"date":"2019-10-31T21:39:12","date_gmt":"2019-10-31T18:39:12","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya\/"},"modified":"2019-10-31T21:39:12","modified_gmt":"2019-10-31T18:39:12","slug":"kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya","title":{"rendered":"Cum s\u0103 preiei controlul asupra infrastructurii de re\u021bea. Capitolul trei. Securitatea re\u021belei. Partea \u00eent\u00e2i","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><i>Acest articol este al treilea dintr-o serie de articole \"Cum s\u0103 preiei controlul asupra infrastructurii de re\u021bea\". Con\u021binutul tuturor articolelor din serie \u0219i linkurile pot fi g\u0103site <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/447008\/\">aici<\/a><\/noindex><\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"Cum s\u0103 preiei controlul asupra infrastructurii de re\u021bea. Capitolul trei. Securitatea re\u021belei. Partea \u00eent\u00e2i\" src=\"\/wp-content\/uploads\/2019\/04\/cdf33cc6797d26df8fef5533f2570c47.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNu are sens s\u0103 vorbim despre eliminarea complet\u0103 a riscurilor de securitate. \u00cen principiu, nu putem s\u0103 le reducem la zero. De asemenea, trebuie s\u0103 \u00een\u021belegem c\u0103, pe m\u0103sur\u0103 ce \u00eencerc\u0103m s\u0103 facem re\u021beaua mai sigur\u0103, solu\u021biile noastre devin din ce \u00een ce mai scumpe. Este necesar s\u0103 g\u0103sim un compromis rezonabil pentru re\u021beaua dumneavoastr\u0103 \u00eentre cost, complexitate \u0219i securitate. <\/p>\n<p>Desigur, designul de securitate este integrat organic \u00een arhitectura general\u0103, iar solu\u021biile de securitate utilizate influen\u021beaz\u0103 scalabilitatea, fiabilitatea, gestionabilitatea\u2026 infrastructurii de re\u021bea, ceea ce trebuie de asemenea avut \u00een vedere.<\/p>\n<p>Dar, reamintesc, c\u0103 acum nu discut\u0103m despre crearea unei re\u021bele. Conform <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/433614\/\">condi\u021biilor noastre ini\u021biale<\/a><\/noindex> avem deja un design ales, echipamentele selectate \u0219i o infrastructur\u0103 creat\u0103, iar \u00een acest stadiu, trebuie s\u0103 \"tr\u0103im\" c\u00e2t mai mult posibil \u0219i s\u0103 g\u0103sim solu\u021bii \u00een contextul abord\u0103rii alese anterior.<\/p>\n<p>Sarcina noastr\u0103 acum este s\u0103 identific\u0103m riscurile legate de securitate la nivel de re\u021bea \u0219i s\u0103 le reducem la o dimensiune rezonabil\u0103. <noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h1>Auditul securit\u0103\u021bii re\u021belei<\/h1>\n<p>\nDac\u0103 \u00een organiza\u021bia dumneavoastr\u0103 sunt implementate procese ISO 27k, atunci auditul de securitate \u0219i modific\u0103rile re\u021belei trebuie s\u0103 se integreze organic \u00een procesele generale conform acestei abord\u0103ri. Dar aceste standarde nu se refer\u0103 totu\u0219i la solu\u021bii specifice, nu la configura\u021bie, nu la design\u2026 Nu exist\u0103 sfaturi univoce, nu exist\u0103 standarde care s\u0103 dicteze detaliat cum ar trebui s\u0103 fie re\u021beaua dumneavoastr\u0103, aceasta este complexitatea \u0219i frumuse\u021bea acestei sarcini.<\/p>\n<p>A\u0219 eviden\u021bia c\u00e2teva audite posibile de securitate a re\u021belei:<\/p>\n<ul>\n<li>auditul configura\u021biei echipamentului (hardening)<\/li>\n<li>auditul designului de securitate<\/li>\n<li>auditul acceselor<\/li>\n<li>auditul proceselor<\/li>\n<\/ul>\n<p><\/p>\n<h1>Auditul configura\u021biei echipamentului (hardening)<\/h1>\n<p>\nSe pare c\u0103, \u00een majoritatea cazurilor, acesta este cel mai bun punct de plecare pentru auditarea \u0219i \u00eembun\u0103t\u0103\u021birea securit\u0103\u021bii re\u021belei dumneavoastr\u0103. IMHO, este o bun\u0103 demonstra\u021bie a legii lui Pareto (20% din eforturi dau 80% din rezultate, iar restul de 80% din eforturi - doar 20% din rezultate). <\/p>\n<p>Ideea principal\u0103 este c\u0103 de obicei avem recomand\u0103ri de la furnizori cu privire la \"cele mai bune practici\" \u00een securitate la configurarea echipamentului. Acest proces se nume\u0219te \u201chardening.\u201d<\/p>\n<p>De asemenea, este frecvent \u00eent\u00e2lnit un chestionar (sau se poate crea unul), bazat pe aceste recomand\u0103ri, care te va ajuta s\u0103 determini c\u00e2t de bine se aliniaz\u0103 configura\u021bia echipamentului t\u0103u cu aceste \u201ebest practices\u201d \u0219i, \u00een func\u021bie de rezultate, s\u0103 efectuezi modific\u0103ri \u00een re\u021beaua ta. Aceasta \u00ee\u021bi va permite s\u0103 reduci riscurile de securitate \u00eentr-un mod considerabil, practic f\u0103r\u0103 costuri.<\/p>\n<blockquote><p>C\u00e2teva exemple pentru anumite sisteme de operare Cisco.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/support\/docs\/ip\/access-lists\/13608-21.html\">\u00cent\u0103rirea configura\u021biei Cisco IOS<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/tools.cisco.com\/security\/center\/resources\/increase_security_ios_xr_devices.html\">\u00cent\u0103rirea configura\u021biei Cisco IOS-XR<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/tools.cisco.com\/security\/center\/resources\/securing_nx_os.html\">\u00cent\u0103rirea configura\u021biei Cisco NX-OS<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/solutions\/Enterprise\/Security\/Baseline_Security\/securebasebook\/appendxD.html\">Lista de verificare a securit\u0103\u021bii de baz\u0103 Cisco<\/a><\/noindex><\/p>\n<p>Pe baza acestor documente poate fi creat\u0103 o list\u0103 de cerin\u021be de configurare pentru fiecare tip de echipament. De exemplu, pentru Cisco N7K VDC, aceste cerin\u021be pot ar\u0103ta <noindex><a rel=\"nofollow\" href=\"https:\/\/www.dropbox.com\/s\/hnat6yriyptigzb\/7k_hard.xlsx?dl=0\">. Cu ajutorul acestuia, se pot instala un cluster Kafka pe Kubernetes cu doar c\u00e2teva comenzi:<\/a><\/noindex>.<\/p><\/blockquote>\n<p>\nAstfel, pot fi create fi\u0219iere de configurare pentru diferite tipuri de echipamente active din infrastructura ta de re\u021bea. Ulterior, manual sau prin automatizare, po\u021bi \u201e\u00eenc\u0103rca\u201d aceste fi\u0219iere de configurare. Cum s\u0103 automatizezi acest proces va fi discutat \u00een detaliu \u00eentr-o alt\u0103 serie de articole dedicate orchestr\u0103rii \u0219i automatiz\u0103rii.<\/p>\n<h1>Auditul designului de securitate<\/h1>\n<p>\n\u00cen general, \u00een re\u021beaua unei \u00eentreprinderi (enterprise network) exist\u0103, \u00eentr-o form\u0103 sau alta, urm\u0103toarele segmente: <\/p>\n<ul>\n<li>DC (DMZ servicii publice \u0219i centru de date Intranet)<\/li>\n<li>Acces la internet<\/li>\n<li>VPN de acces de la distan\u021b\u0103<\/li>\n<li>WAN edge<\/li>\n<li>Filial\u0103<\/li>\n<li>Campus (Birou)<\/li>\n<li>Nucleu<\/li>\n<\/ul>\n<p>\nDenomina\u021biile sunt preluate din <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/solutions\/Enterprise\/Security\/SAFE_RG\/SAFE_rg\/chap1.html\">Cisco SAFE<\/a><\/noindex> modele, dar nu este neap\u0103rat nevoie s\u0103 te limitezi strict la aceste denumiri \u0219i la acest model. Totu\u0219i, este important s\u0103 discut\u0103m despre esen\u021b\u0103 \u0219i s\u0103 nu ne pierdem \u00een formalit\u0103\u021bi.<\/p>\n<p>Pentru fiecare dintre aceste segmente, cerin\u021bele referitoare la nivelul de securitate, riscurile \u0219i, respectiv, solu\u021biile vor varia.<\/p>\n<p>S\u0103 examin\u0103m fiecare dintre ele \u00een parte \u00een ceea ce prive\u0219te problemele \u00eent\u00e2mpinate din perspectiva designului de securitate. Desigur, repet, aceast\u0103 articol\u0103 nu \u00ee\u0219i propune s\u0103 fie cuprinz\u0103toare, deoarece este greu s\u0103 atingi acest obiectiv \u00eentr-o tem\u0103 at\u00e2t de profund\u0103 \u0219i complex\u0103 (dac\u0103 este posibil), dar reflect\u0103 experien\u021ba mea personal\u0103.<\/p>\n<p>Nu exist\u0103 o solu\u021bie perfect\u0103 (cel pu\u021bin nu \u00een prezent). Este \u00eentotdeauna un compromis. Dar este important ca decizia de a aplica un anumit abord s\u0103 fie luat\u0103 \u00een mod con\u0219tient, cu o \u00een\u021belegere a at\u00e2t avantajelor, c\u00e2t \u0219i dezavantajelor sale.<\/p>\n<h2>Data Center<\/h2>\n<p>\nSegmentul cel mai critic din perspectiva securit\u0103\u021bii.<br \/>\n\u0218i, ca de obicei, aici nu exist\u0103 o solu\u021bie universal\u0103. Totul depinde foarte mult de cerin\u021bele re\u021belei. <\/p>\n<h3>Este necesar un firewall?<\/h3>\n<p>\nR\u0103spunsul pare evident, dar nu totul este at\u00e2t de clar cum ar putea p\u0103rea. De asemenea, alegerea dumneavoastr\u0103 poate fi influen\u021bat\u0103 nu doar de<b> pre\u021bul<\/b>. <\/p>\n<blockquote><p>Exemplul 1. <b>\u00cent\u00e2rzierea.<\/b><\/p>\n<p>Dac\u0103 o \u00eent\u00e2rziere sc\u0103zut\u0103 \u00eentre anumite segmente de re\u021bea este o cerin\u021b\u0103 esen\u021bial\u0103, a\u0219a cum este cazul burselor, atunci nu vom putea folosi firewall-uri \u00eentre aceste segmente. Este greu s\u0103 g\u0103sim studii despre \u00eent\u00e2rzierea \u00een firewall-uri, dar doar c\u00e2teva modele de switch-uri pot oferi \u00eent\u00e2rzieri mai mici sau de aproximativ 1 mksec, astfel \u00eenc\u00e2t, cred c\u0103 dac\u0103 microsecundele sunt importante pentru dumneavoastr\u0103, atunci firewall-urile nu sunt pentru dumneavoastr\u0103.<\/p><\/blockquote>\n<blockquote><p>Exemplul 2. <b>Performan\u021b\u0103.<\/b><\/p>\n<p>L\u0103\u021bimea de band\u0103 a celor mai performante switch-uri L3 este de obicei cu un ordin mai mare dec\u00e2t l\u0103\u021bimea de band\u0103 a celor mai performante firewall-uri. A\u0219adar, \u00een cazul unui trafic de mare intensitate, de obicei, va trebui s\u0103 redirec\u021biona\u021bi acest trafic pentru a evita firewall-urile.<\/p><\/blockquote>\n<p><\/p>\n<blockquote><p>Exemplul 3. <b>Fiabilitate.<\/b><\/p>\n<p>Firewall-urile, \u00een special cele moderne NGFW (Next-Generation FW), sunt dispozitive complexe. Ele sunt mult mai complexe dec\u00e2t switch-urile L3\/L2. Acestea ofer\u0103 o mul\u021bime de servicii \u0219i op\u021biuni de configurare, a\u0219a c\u0103 nu este de mirare c\u0103 fiabilitatea lor este considerabil mai sc\u0103zut\u0103. Dac\u0103 continuitatea serviciului este critic\u0103 pentru re\u021bea, atunci, poate, va trebui s\u0103 alege\u021bi ce va duce la o disponibilitate mai bun\u0103 \u2014 securitate prin firewall sau simplitate \u00een re\u021bea, construit\u0103 pe switch-uri (sau tipuri diferite de fabrici) folosind ACL-uri obi\u0219nuite.<\/p><\/blockquote>\n<p> \u00cen cazul exemplelor enumerate mai sus, va trebui, de obicei, s\u0103 c\u0103uta\u021bi un compromis. Privind urm\u0103toarele solu\u021bii: <\/p>\n<ul>\n<li>dac\u0103 a\u021bi decis s\u0103 nu utiliza\u021bi firewall-uri \u00een interiorul centrului de date, trebuie s\u0103 v\u0103 g\u00e2ndi\u021bi cum s\u0103 limita\u021bi accesul la maximum la nivelul perimetrului. De exemplu, pute\u021bi deschide doar porturile necesare din Internet (pentru traficul clien\u021bilor) \u0219i accesul administrativ \u00een centrul de date doar de pe hosts de tip jump. Pe hosts de tip jump s\u0103 efectua\u021bi toate verific\u0103rile necesare (autentificare\/autorizare, antivirus, logare, ...)<\/li>\n<li>pute\u021bi folosi o divizare logic\u0103 a re\u021belei centrului de date \u00een segmente, similar cu schema descris\u0103 \u00een PSEFABRIC <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/nihole\/PSEFABRIC\/wiki\/p002-design\">exemplu p002<\/a><\/noindex>. \u00cen acest caz, rutarea trebuie s\u0103 fie configurat\u0103 astfel \u00eenc\u00e2t traficul sensibil la \u00eent\u00e2rziere sau traficul de intensitate mare s\u0103 circule \u201e\u00een interiorul\u201d unui singur segment (\u00een cazul p002, al VRF-ului) \u0219i s\u0103 nu treac\u0103 prin firewall. Totu\u0219i, traficul \u00eentre diferite segmente va continua s\u0103 treac\u0103 prin firewall. De asemenea, se poate folosi route leaking \u00eentre VRF-uri pentru a evita redirec\u021bionarea traficului prin firewall.<\/li>\n<li>De asemenea, se poate folosi firewall-ul \u00een modul transparent \u0219i doar pentru acele VLAN-uri unde ace\u0219ti factori (\u00eent\u00e2rziere\/performance) nu sunt semnificativi. Dar trebuie studiate cu aten\u021bie limit\u0103rile legate de utilizarea acestui mod, pentru fiecare furnizor.<\/li>\n<li>Pute\u021bi lua \u00een considerare aplicarea arhitecturii service chain. Aceasta va permite direc\u021bionarea prin firewall doar a traficului necesar. Teoretic, pare frumos, dar nu am v\u0103zut niciodat\u0103 aceast\u0103 solu\u021bie \u00een produc\u021bie. Am testat service chain pentru Cisco ACI\/Juniper SRX\/F5 LTM acum aproximativ 3 ani, dar pe atunci aceast\u0103 solu\u021bie ni s-a p\u0103rut \u201enecoapt\u0103\u201d.<\/li>\n<\/ul>\n<p><\/p>\n<h3>Nivel de protec\u021bie<\/h3>\n<p>\nAcum trebuie s\u0103 r\u0103spundem la \u00eentrebarea ce instrumente dori\u021bi s\u0103 aplica\u021bi pentru filtrarea traficului. Iat\u0103 c\u00e2teva dintre op\u021biunile care sunt de obicei prezente \u00een NGFW (de exemplu, <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.paloaltonetworks.com\/pan-os\/8-0\/pan-os-admin\/policy\/security-profiles.html\">aici<\/a><\/noindex>):<\/p>\n<ul>\n<li>firewalling de tip stateful (implicit)<\/li>\n<li>firewalling de aplica\u021bii<\/li>\n<li>prevenirea amenin\u021b\u0103rilor (antivirus, anti-spyware \u0219i vulnerabilitate)<\/li>\n<li>filtrarea URL-urilor<\/li>\n<li>filtrarea datelor (filtrarea con\u021binutului)<\/li>\n<li>blocarea fi\u0219ierelor (blocarea tipurilor de fi\u0219iere)<\/li>\n<li>protec\u021bia DOS<\/li>\n<\/ul>\n<p>\n\u0218i nu toate sunt clare. S-ar putea s\u0103 par\u0103 c\u0103, cu c\u00e2t nivelul de protec\u021bie este mai mare, cu at\u00e2t este mai bine. Dar trebuie s\u0103 \u021bine\u021bi cont \u0219i de faptul c\u0103<\/p>\n<ul>\n<li>cu c\u00e2t utiliza\u021bi mai multe dintre func\u021biile enumerate mai sus ale firewall-ului, cu at\u00e2t va fi evident mai scump (licen\u021be, module suplimentare).<\/li>\n<li>utilizarea unor algoritmi poate reduce semnificativ l\u0103\u021bimea de band\u0103 a firewall-ului, precum \u0219i s\u0103 creasc\u0103 \u00eent\u00e2rzierile, vezi de exemplu <noindex><a rel=\"nofollow\" href=\"https:\/\/www.paloaltonetworks.com\/products\/secure-the-network\/next-generation-firewall\/pa-7000-series\">aici<\/a><\/noindex><\/li>\n<li>a\u0219a cum se \u00eent\u00e2mpl\u0103 cu orice solu\u021bie complex\u0103, utilizarea unor metode de protec\u021bie complexe poate reduce fiabilitatea solu\u021biei dvs., de exemplu, \u00een utilizarea firewall-ului de aplica\u021bie m-am confruntat cu blocarea unor aplica\u021bii care func\u021bioneaz\u0103 \u00een mod standard (dns, smb).<\/li>\n<\/ul>\n<p>\nTrebuie, ca de obicei, s\u0103 g\u0103si\u021bi solu\u021bia optim\u0103 pentru re\u021beaua dvs.<\/p>\n<p>Nu se poate r\u0103spunde clar la \u00eentrebarea ce func\u021bii de protec\u021bie pot fi necesare. \u00cen primul r\u00e2nd, pentru c\u0103, desigur, depinde de datele pe care le transmite\u021bi sau le stoca\u021bi \u0219i pe care \u00eencerca\u021bi s\u0103 le proteja\u021bi. \u00cen al doilea r\u00e2nd, de fapt, adesea alegerea mijloacelor de protec\u021bie este o chestiune de credin\u021b\u0103 \u0219i \u00eencredere \u00een furnizor. Nu \u0219ti\u021bi algoritmii, nu \u0219ti\u021bi c\u00e2t de eficien\u021bi sunt \u0219i nu pute\u021bi s\u0103 \u00eei testa\u021bi complet. <\/p>\n<p>De aceea, \u00een segmente critice, o solu\u021bie bun\u0103 ar putea fi utilizarea ofertelor de la diferite companii. De exemplu, pute\u021bi activa un antivirus pe firewall, dar, de asemenea, s\u0103 utiliza\u021bi protec\u021bia antivirus (de la un alt furnizor) local pe gazde.<\/p>\n<h3>Segmentare<\/h3>\n<p>\nEste vorba despre segmentarea logic\u0103 a re\u021belei centrului de date. De exemplu, \u00eemp\u0103r\u021birea \u00een VLAN-uri \u0219i subre\u021bele este, de asemenea, o segmentare logic\u0103, dar nu o vom considera din cauza eviden\u021bei sale. Interesant\u0103 este segmentarea av\u00e2nd \u00een vedere entit\u0103\u021bi precum zonele de securitate FW, VRF (\u0219i omologii acestora \u00een raport cu diferi\u021bi furnizori), dispozitive logice (PA VSYS, Cisco N7K VDC, Cisco ACI Tenant, \u2026), \u2026<\/p>\n<blockquote><p>Un exemplu de aceast\u0103 segmentare logic\u0103 \u0219i de design-ul cerut \u00een prezent pentru centrul de date este prezentat \u00een <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/nihole\/PSEFABRIC\/wiki\/p002-design\">p002 proiectul PSEFABRIC<\/a><\/noindex>.<\/p><\/blockquote>\n<p> Dup\u0103 ce a\u021bi definit p\u0103r\u021bile logice ale re\u021belei dvs., pute\u021bi descrie cum se mi\u0219c\u0103 traficul \u00eentre diferitele segmente, pe ce dispozitive se va realiza filtrarea \u0219i cu ce mijloace.<\/p>\n<p>Dac\u0103 re\u021beaua dvs. nu are o \u00eemp\u0103r\u021bire logic\u0103 clar\u0103 \u0219i nu sunt formalizate regulile de aplicare a politicilor de securitate pentru diferitele fluxuri de date, aceasta \u00eenseamn\u0103 c\u0103 la deschiderea unui anumit acces va trebui s\u0103 rezolva\u021bi aceast\u0103 problem\u0103, iar cu o mare probabilitate o ve\u021bi rezolva de fiecare dat\u0103 diferit. <\/p>\n<p>Adesea, segmentarea se bazeaz\u0103 doar pe zonele de securitate FW. Atunci, trebuie s\u0103 r\u0103spunde\u021bi la urm\u0103toarele \u00eentreb\u0103ri:<\/p>\n<ul>\n<li>ce zone de securitate ave\u021bi nevoie<\/li>\n<li>ce nivel de protec\u021bie dori\u021bi s\u0103 aplica\u021bi fiec\u0103rei dintre aceste zone <\/li>\n<li>va fi permis traficul intra-zone \u00een mod implicit <\/li>\n<li>dac\u0103 nu, ce politici de filtrare a traficului vor fi aplicate \u00een interiorul fiec\u0103rei zone<\/li>\n<li>ce politici de filtrare a traficului vor fi aplicate pentru fiecare pereche de zone (surs\u0103\/destina\u021bie)<\/li>\n<\/ul>\n<p><\/p>\n<h3>TCAM<\/h3>\n<p>\nO problem\u0103 frecvent \u00eent\u00e2lnit\u0103 este insuficien\u021ba TCAM (Ternary Content Addressable Memory), at\u00e2t pentru rutare, c\u00e2t \u0219i pentru acces. \u00cen opinia mea, aceasta este una dintre cele mai importante aspecte \u00een alegerea echipamentului, a\u0219adar trebuie abordat\u0103 cu aten\u021bia cuvenit\u0103.<\/p>\n<blockquote><p>Exemplul 1. Tabelul de Rutare TCAM.<\/p>\n<p>S\u0103 analiz\u0103m <noindex>Palo Alto 7k<\/noindex> firewall.<br \/>\nObserv\u0103m c\u0103 dimensiunea tabelului de rutare IPv4* = 32K<br \/>\nAcest num\u0103r de rute este total pentru toate VSYS-urile.<\/p>\n<p>S\u0103 presupunem c\u0103, conform designului dvs., a\u021bi decis s\u0103 utiliza\u021bi 4 VSYS-uri.<br \/>\nFiecare dintre aceste VSYS-uri este conectat prin BGP la dou\u0103 PE ale re\u021belei MPLS, pe care o folosi\u021bi ca BB. Astfel, cele 4 VSYS-uri schimb\u0103 toate rutele specifice \u00eentre ele \u0219i au un tabel de rutare cu seturi aproximativ identice de rute (dar NH diferite). Deoarece fiecare VSYS are 2 sesiuni BGP (cu set\u0103ri identice), fiecare rut\u0103 ob\u021binut\u0103 prin MPLS are 2 NH \u0219i, prin urmare, 2 \u00eenregistr\u0103ri FIB \u00een Tabelul de Rutare. Dac\u0103 presupunem c\u0103 acesta este singurul firewall din data center \u0219i c\u0103 trebuie s\u0103 cunoasc\u0103 toate rutele, atunci asta ar \u00eensemna c\u0103 num\u0103rul total de rute din data center-ul nostru nu poate dep\u0103\u0219i 32K\/(4 * 2) = 4K. <\/p>\n<p>Acum, s\u0103 presupunem c\u0103 avem 2 centre de date (cu un design identic) \u0219i dorim s\u0103 utiliz\u0103m VLAN-uri \u201eextinse\u201d \u00eentre centrele de date (de exemplu, pentru vMotion). Pentru a rezolva problema de rutare, trebuie s\u0103 folosim rutele gazdelor. Dar asta \u00eenseamn\u0103 c\u0103 la cele 2 centre de date vom avea nu mai mult de 4096 de gazde posibile \u0219i, desigur, aceasta poate fi insuficient.<\/p><\/blockquote>\n<blockquote><p>Exemplul 2. ACL TCAM.<\/p>\n<p>Dac\u0103 inten\u021biona\u021bi s\u0103 filtra\u021bi traficul pe comutatoarele L3 (sau alte solu\u021bii care utilizeaz\u0103 comutatoare L3, de exemplu, Cisco ACI), atunci c\u00e2nd alege\u021bi echipamentul, trebuie s\u0103 acorda\u021bi aten\u021bie TCAM-ului ACL.<\/p>\n<p>S\u0103 presupunem c\u0103 dori\u021bi s\u0103 controla\u021bi accesul pe interfe\u021bele SVI ale Cisco Catalyst 4500. Atunci, a\u0219a cum se poate observa din <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/support\/docs\/switches\/catalyst-4000-series-switches\/66978-tcam-cat-4500.html\">acestui articol<\/a><\/noindex>, pentru a controla traficul de ie\u0219ire (la fel ca \u0219i traficul de intrare) pe interfe\u021be, pute\u021bi folosi doar 4096 de linii TCAM. Ceea ce, folosind TCAM3, v\u0103 va oferi aproximativ 4000 de ACE (linii ACL).<\/p><\/blockquote>\n<p> \u00cen cazul \u00een care te confrun\u021bi cu o problem\u0103 de insuficien\u021b\u0103 TCAM, \u00een primul r\u00e2nd, trebuie s\u0103 iei \u00een considerare optimizarea. De exemplu, \u00een cazul unei probleme cu dimensiunea Tabelei de \u00cenaintare, ar trebui s\u0103 te g\u00e2nde\u0219ti la agregarea rutelor. Dac\u0103 exist\u0103 o problem\u0103 cu dimensiunea TCAM pentru accesuri - auditul accesurilor, eliminarea \u00eenregistr\u0103rilor \u00eenvechite \u0219i suprapuse, precum \u0219i, poate, reconsiderarea procedurii de deschidere a accesurilor (aceasta va fi detaliat \u00een capitolul dedicat auditului accesurilor).<\/p>\n<h3>Disponibilitate ridicat\u0103<\/h3>\n<p>\n\u00centrebarea este dac\u0103 s\u0103 folose\u0219ti HA pentru firewall-uri sau s\u0103 configurezi \u00abparalel\u00bb dou\u0103 unit\u0103\u021bi independente \u0219i, \u00een cazul \u00een care una dintre ele cedeaz\u0103, s\u0103 dirijezi traficul prin a doua?<\/p>\n<p>Se pare c\u0103 r\u0103spunsul este evident \u2013 folose\u0219te HA. Motivul pentru care aceast\u0103 \u00eentrebare apare totu\u0219i se datoreaz\u0103 faptului c\u0103, din p\u0103cate, teoreticele \u0219i promo\u021bionalele 99 \u0219i c\u00e2teva zecimale procente de disponibilitate se dovedesc, \u00een practic\u0103, a fi departe de a fi at\u00e2t de optimiste. HA este un lucru logic suficient de complex, \u0219i pe diverse echipamente \u0219i cu diferi\u021bi furnizori (nu au fost excep\u021bii) am interceptat probleme, bug-uri \u0219i opriri ale serviciului.<\/p>\n<p>\u00cen cazul utiliz\u0103rii HA, vei avea posibilitatea de a opri noduri individuale, comut\u00e2nd \u00eentre ele f\u0103r\u0103 a opri serviciul, ceea ce este important, de exemplu, \u00een timpul actualiz\u0103rilor, dar \u00een acela\u0219i timp exist\u0103 o probabilitate semnificativ\u0103 ca ambele noduri s\u0103 se defecteze simultan, precum \u0219i c\u0103 urm\u0103toarea actualizare nu va decurge la fel de u\u0219or cum promite furnizorul (aceast\u0103 problem\u0103 poate fi evitat\u0103 dac\u0103 ai posibilitatea de a testa actualizarea pe echipamente de laborator).<\/p>\n<p>Dac\u0103 nu folose\u0219ti HA, atunci din punctul de vedere al dublei defec\u021biuni, riscurile tale sunt semnificativ mai mici (deoarece ai 2 firewall-uri independente), dar, deoarece sesiunile nu sunt sincronizate, de fiecare dat\u0103 c\u00e2nd se va face comutarea \u00eentre aceste firewall-uri, vei pierde trafic. Poate fi folosit firewalling f\u0103r\u0103 stare, dar atunci sensul utiliz\u0103rii unui firewall se pierde \u00een mare parte.<\/p>\n<p>Prin urmare, dac\u0103 \u00een urma auditului ai descoperit firewall-uri izolate \u0219i te g\u00e2nde\u0219ti la \u00eembun\u0103t\u0103\u021birea fiabilit\u0103\u021bii re\u021belei tale, atunci HA este, desigur, una dintre solu\u021biile recomandate, dar trebuie s\u0103 iei \u00een considerare \u0219i dezavantajele asociate acestui abordare \u0219i, poate, pentru re\u021beaua ta o solu\u021bie diferit\u0103 ar fi mai potrivit\u0103.<\/p>\n<h3>Confort \u00een gestionare (managability)<\/h3>\n<p>\nPractic, HA se refer\u0103 \u0219i la gestionabilitate. \u00cen loc s\u0103 configura\u021bi separat dou\u0103 dispozitive \u0219i s\u0103 rezolva\u021bi problema sincroniz\u0103rii configura\u021biilor, le gestiona\u021bi astfel \u00eenc\u00e2t s\u0103 fie ca \u0219i cum a\u021bi avea un singur dispozitiv. <\/p>\n<p>Dar, poate ave\u021bi multe centre de date \u0219i multe firewall-uri, iar atunci aceast\u0103 problem\u0103 devine de un alt nivel. \u0218i problema nu este doar legat\u0103 de configurare, ci \u0219i de<\/p>\n<ul>\n<li>backup-ul configura\u021biilor<\/li>\n<li>actualiz\u0103ri<\/li>\n<li>upgrade-uri<\/li>\n<li>monitorizare<\/li>\n<li>logare<\/li>\n<\/ul>\n<p>\n\u0218i toate acestea pot fi rezolvate prin sisteme centralizate de management. <\/p>\n<blockquote><p>De exemplu, dac\u0103 utiliza\u021bi firewall-uri Palo Alto, atunci <noindex><a rel=\"nofollow\" href=\"https:\/\/www.paloaltonetworks.com\/products\/management\/panorama\">Panorama<\/a><\/noindex> este o astfel de solu\u021bie.\n<\/p><\/blockquote>\n<p>\n<i>Continuarea urmeaz\u0103.<\/i><br \/>\n<br \/>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0440\u0435\u0442\u044c\u0435\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb. \u0421\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u0441\u0442\u0430\u0442\u0435\u0439 \u0446\u0438\u043a\u043b\u0430 \u0438 \u0441\u0441\u044b\u043b\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0437\u0434\u0435\u0441\u044c. \u041d\u0435\u0442 \u0441\u043c\u044b\u0441\u043b\u0430 \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u044c \u043e \u043f\u043e\u043b\u043d\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 security \u0440\u0438\u0441\u043a\u043e\u0432. \u041c\u044b \u0432 \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0435 \u043d\u0435 \u043c\u043e\u0436\u0435\u043c \u0441\u043d\u0438\u0437\u0438\u0442\u044c \u0438\u0445 \u0434\u043e \u043d\u0443\u043b\u044f. \u0422\u0430\u043a\u0436\u0435 \u043d\u0443\u0436\u043d\u043e \u043f\u043e\u043d\u0438\u043c\u0430\u0442\u044c, \u0447\u0442\u043e \u043f\u0440\u0438 \u0441\u0442\u0440\u0435\u043c\u043b\u0435\u043d\u0438\u0438 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0441\u0435\u0442\u044c \u0431\u043e\u043b\u0435\u0435 \u0438 \u0431\u043e\u043b\u0435\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043d\u0430\u0448\u0438 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0441\u0442\u0430\u043d\u043e\u0432\u044f\u0442\u0441\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23033,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31058","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0440\u0435\u0442\u044c\u0435\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c. \u0413\u043b\u0430\u0432\u0430 \u0442\u0440\u0435\u0442\u044c\u044f. \u0421\u0435\u0442\u0435\u0432\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c. \u0427\u0430\u0441\u0442\u044c \u043f\u0435\u0440\u0432\u0430\u044f | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0440\u0435\u0442\u044c\u0435\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:39:12+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:39:12+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Cum s\u0103 preiei controlul asupra infrastructurii de re\u021bea. Capitolul trei. Securitatea re\u021belei. Partea \u00eent\u00e2i | ProHoster","description":"Acest articol este al treilea dintr-o serie de articole \u201eCum s\u0103 preiei controlul asupra infrastructurii de re\u021bea\u201d.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c. \u0413\u043b\u0430\u0432\u0430 \u0442\u0440\u0435\u0442\u044c\u044f. \u0421\u0435\u0442\u0435\u0432\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c. \u0427\u0430\u0441\u0442\u044c \u043f\u0435\u0440\u0432\u0430\u044f | ProHoster","og:description":"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0440\u0435\u0442\u044c\u0435\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:39:12+00:00","article:modified_time":"2019-10-31T18:39:12+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31058","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 04:20:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:24:14","updated":"2026-01-21 04:20:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/31058","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=31058"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/31058\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/23033"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=31058"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=31058"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=31058"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}