{"id":38726,"date":"2019-10-31T22:25:31","date_gmt":"2019-10-31T19:25:31","guid":{"rendered":"https:\/\/prohoster.info\/blog\/1-check-point-maestro-hyperscale-network-security-novaya-masshtabiruemaya-security-platforma\/"},"modified":"2019-10-31T22:25:31","modified_gmt":"2019-10-31T19:25:31","slug":"1-check-point-maestro-hyperscale-network-security-novaya-masshtabiruemaya-security-platforma","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/1-check-point-maestro-hyperscale-network-security-novaya-masshtabiruemaya-security-platforma","title":{"rendered":"1. Check Point Maestro Hyperscale Network Security \u2014 noua platform\u0103 de securitate scalabil\u0103","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"1.
\n
\nCompania Check Point a \u00eenceput anul 2019 cu elan, f\u0103c\u00e2nd imediat mai multe anun\u021buri. Nu este posibil s\u0103 vorbim despre toate acestea \u00eentr-un singur articol, a\u0219a c\u0103 s\u0103 \u00eencepem cu cel mai important \u2014 Check Point Maestro Securitate a Re\u021belei Hyperscale<\/a><\/noindex><\/b>. Maestro este o nou\u0103 platform\u0103 scalabil\u0103 care permite cre\u0219terea \u201eputerii\u201d unei solu\u021bii de securitate la cifre \u201eincredibile\u201d \u0219i practic liniar. Acest lucru se ob\u021bine, desigur, prin echilibrarea \u00eenc\u0103rc\u0103turii \u00eentre solu\u021biile individuale care func\u021bioneaz\u0103 \u00eentr-un cluster, ca o singur\u0103 entitate. Cineva ar putea spune \u2014 «A fost! Exist\u0103 deja platformele blade 44000\/64000<\/i>«. Totu\u0219i, Maestro este cu totul altceva. \u00cen cadrul acestui articol, voi \u00eencerca pe scurt s\u0103 explic ce este, cum func\u021bioneaz\u0103 \u0219i cum aceast\u0103 tehnologie va ajuta s\u0103 economiseasc\u0103 la protec\u021bia perimetrului re\u021belei<\/b>.<\/a><\/noindex><\/p>\n

A fost \u2014 Este<\/h3>\n

\nCel mai simplu mod de a \u00een\u021belege ce distinge noua platform\u0103 scalabil\u0103 de vechile 44000\/64000 este s\u0103 prive\u0219ti imaginea de mai jos:<\/p>\n

\"1.
\n
\nDiferen\u021ba este evident\u0103.<\/p>\n

Vechea platform\u0103 Check Point 44000\/64000<\/h3>\n

\nDup\u0103 cum se poate vedea din imaginea de mai sus, prima variant\u0103 reprezint\u0103 o platform\u0103 fix\u0103 (\u0219asiu), \u00een care pot fi introduse un num\u0103r limitat de module speciale \u201eblade\u201d (Check Point SGM<\/b>). Toate acestea sunt conectate la Security Switch Module<\/b> (SSM), care realizeaz\u0103 echilibrarea traficului \u00eentre gateway-uri. \u00cen imaginea de mai jos sunt prezentate mai detaliat componentele acestei platforme:<\/p>\n

\"1.
\n
\nEste o platform\u0103 excelent\u0103 \u00een cazul \u00een care \u0219ti\u021bi exact ce performan\u021b\u0103 ave\u021bi nevoie acum \u0219i \u00een ce limite poate cre\u0219te. Totu\u0219i, din cauza factorului de form\u0103 fix (12 sau 6 blade-uri), sunte\u021bi limita\u021bi \u00een scalarea ulterioar\u0103. \u00cen plus, sunte\u021bi obliga\u021bi s\u0103 utiliza\u021bi exclusiv blade-urile SGM, f\u0103r\u0103 posibilitatea de a conecta uplink-uri standard, care au o gam\u0103 mult mai variat\u0103. Odat\u0103 cu apari\u021bia Maestro Hyperscale Network Security<\/b> situa\u021bia se schimb\u0103 radical.<\/p>\n

Noua platform\u0103 Check Point Maestro Hyperscale Network Security<\/h3>\n

\nCheck Point Maestro a fost prezentat pentru prima dat\u0103 pe 22 ianuarie la conferin\u021ba CPX din Bangkok. Cele mai importante caracteristici pot fi v\u0103zute \u00een imaginea de mai jos:<\/p>\n

\"1.
\n
\nDup\u0103 cum se poate observa, principalul avantaj al Check Point Maestro este posibilitatea de a utiliza gateway-uri (appliance) obi\u0219nuite pentru balansare. Adic\u0103, nu mai suntem limita\u021bi la blade-urile SGM. \u00cemp\u0103r\u021birea sarcinii poate fi realizat\u0103 \u00eentre orice dispozitive \u00eencep\u00e2nd cu modelul 5600 (modelele SMB \u0219i chassis-urile 44000\/64000 nu sunt suportate). \u00cen imaginea de mai sus sunt prezentate principalele valori care pot fi atinse prin utilizarea noii platforme. Putem combina \u00eentr-o resurs\u0103 de calcul p\u00e2n\u0103 la 31! gateway-uri<\/b>. Acum, firewall-ul dvs. poate ar\u0103ta \u00een felul urm\u0103tor:<\/p>\n

\"1.
\n<\/p>\n

Maestro Hyperscale Orchestrator<\/h3>\n

\nSunt sigur c\u0103 mul\u021bi dintre voi ave\u021bi deja \u00eentrebarea: \u201cCe este acest Orchestrator?<\/i>\u201d Ei bine, v\u0103 prezint. Maestro Hyperscale Orchestrator<\/b> \u2014 tocmai aceast\u0103 unitate se ocup\u0103 cu balansarea \u00eenc\u0103rc\u0103turii. Pe acest dispozitiv este instalat sistemul de operare Gaia R80.20 SP<\/b>. \u00cen prezent, exist\u0103 dou\u0103 modele de Orchestratori \u2014 MHO-140<\/b> \u0219i MHO-170<\/b>. Specifica\u021biile sunt prezentate \u00een imaginea de mai jos:<\/p>\n

\"1.
\n
\nLa prima vedere, ar putea p\u0103rea un switch obi\u0219nuit. \u00cen realitate, este un \u201cswitch + balansoar + sistem de gestionare a resurselor\u201d. Totul \u00eentr-o cutie.
\nLa ace\u0219ti Orchestratori se conecteaz\u0103 gateway-uri. \u00cen cazul \u00een care balansoarele sunt implementate \u00een mod redundant, fiecare gateway se conecteaz\u0103 la fiecare orchestrator. Pentru conectare se poate utiliza \u201coptica\u201d (sfp+ \/ qsfp+ \/ qsfp28+) sau cablul DAC (Direct Attach Copper). \u00cen acest context, \u00eentre orchestratori trebuie, desigur, s\u0103 existe un link de sincronizare:<\/p>\n

\"1.
\n
\n\u00cen imaginea de mai jos se poate observa cum sunt distribuite porturile acestor orchestratori:<\/p>\n

\"1.
\n<\/p>\n

Grupuri de securitate<\/h3>\n

\nPentru ca sarcina s\u0103 poat\u0103 fi distribuit\u0103 \u00eentre gateway-uri, aceste gateway-uri trebuie s\u0103 fie \u00een acela\u0219i grup de securitate. Security Group<\/b> aceasta este un grup logic de dispozitive, care func\u021bioneaz\u0103 ca un cluster active\/active. Acest grup func\u021bioneaz\u0103 independent de alte Grupe de Securitate. Din perspectiva serverului de gestionare, Grupul de Securitate arat\u0103 ca un singur dispozitiv cu o singur\u0103 adres\u0103 ip.
\nDac\u0103 este necesar, putem muta unul sau mai multe gateway-uri \u00eentr-un Grup de Securitate separat \u0219i putem folosi acest grup pentru alte scopuri, ca un firewall separat din perspectiva managementului. Exemplul de utilizare este prezentat \u00een imaginea de mai jos:<\/p>\n

\"1.
\n
\nO limitare important\u0103<\/b>, \u00eentr-o singur\u0103 Grup\u0103 de Securitate pot fi folosite exclusiv gateway-uri identice (model). Asta \u00eenseamn\u0103 c\u0103, dac\u0103 dori\u021bi s\u0103 cre\u0219te\u021bi gradual puterea gateway-ului dvs. de securitate (care este un cluster format din mai multe dispozitive), trebuie s\u0103 ad\u0103uga\u021bi exact acelea\u0219i gateway-uri. \u00cen viitoarele versiuni de software, aceast\u0103 restric\u021bie ar trebui s\u0103 dispar\u0103.<\/p>\n

\u00cen videoclipul de mai jos pute\u021bi vedea procesul de creare a unei Grupe de Securitate. Procedura este intuitiv\u0103.<\/p>\n

\"1.
\n
\nDin nou, dac\u0103 compar\u0103m componentele Maestro cu platforma de tip \u0219asiu, ar rezulta o imagine aproximativ\u0103 \u201ea fost-a devenit\u201d:<\/p>\n

\"1.
\n<\/p>\n

Care este avantajul noului platformei?<\/h3>\n

\nExist\u0103 de fapt multe avantaje, at\u00e2t din punct de vedere tehnic, c\u00e2t \u0219i economic. Voi prezenta pe scurt cele mai importante:<\/p>\n

    \n
  1. Practic nu suntem limita\u021bi \u00een scalare. P\u00e2n\u0103 la 31 de gateway-uri \u00een cadrul unei singure Grupe de Securitate.<\/li>\n
  2. Putem ad\u0103uga gateway-uri pe m\u0103sur\u0103 ce este necesar. Setul minim la achizi\u021bie const\u0103 \u00een: un orchestrator + dou\u0103 gateway-uri. Nu este nevoie s\u0103 anticip\u0103m modele \u201ede cre\u0219tere\u201d.<\/li>\n
  3. Din punctul anterior rezult\u0103 un alt avantaj. Nu mai trebuie s\u0103 schimb\u0103m gateway-uri care nu mai fac fa\u021b\u0103 \u00eenc\u0103rc\u0103rilor. \u00cen trecut, aceast\u0103 problem\u0103 era rezolvat\u0103 printr-o procedur\u0103 de trade-in \u2014 predai \u201ehardware\u201d-ul vechi \u0219i prime\u0219ti unul nou cu discount. \u00centr-un astfel de sistem, pierderile financiare sunt inevitabile. Noua procedur\u0103 de scalare elimin\u0103 acest factor. Nu trebuie s\u0103 pred\u0103m nimic, putem pur \u0219i simplu s\u0103 continu\u0103m s\u0103 cre\u0219tem performan\u021ba cu ajutorul \u201ehardware\u201d-ului suplimentar.<\/li>\n
  4. Posibilitatea de a combina resursele existente pentru a distribui sarcina. De exemplu, putem \u201etrasa\u201d toate clusterele pe platforma Maestro \u0219i s\u0103 form\u0103m mai multe Grupe de Securitate, \u00een func\u021bie de \u00eenc\u0103rcare.<\/li>\n<\/ol>\n

    <\/p>\n

    Pachetele Maestro Hyperscale Network Security<\/h3>\n

    \n\u00cen prezent, exist\u0103 mai multe op\u021biuni de achizi\u021bie a a\u0219a-numitelor pachete cu platforma Maestro. Solu\u021bia se bazeaz\u0103 pe gateway-uri 23800, 6800 \u0219i 6500:<\/p>\n

    \"1.
    \n
    \nDe asemenea, se pot alege dintre dou\u0103 tipuri standard de configura\u021bie:<\/p>\n

      \n
    1. Un orchestrator \u0219i dou\u0103 gateway-uri;<\/li>\n
    2. Un orchestrator \u0219i trei gateway-uri.<\/li>\n<\/ol>\n

      \nAici <\/a><\/noindex>se pot consulta pre\u021buri orientative. Fire\u0219te, suplimentar se poate prevedea \u0219i un alt orchestrator \u0219i un num\u0103r nelimitat de gateway-uri. Informa\u021bii suplimentare privind specifica\u021biile pot fi solicitate aici<\/a><\/noindex>.
      \nDispozitive 6500<\/b> \u0219i 6800<\/b> acestea sunt cele mai noi modele, care au fost de asemenea prezentate la \u00eenceputul acestui an. Dar despre ele vom discuta mai \u00een detaliu \u00een articolul urm\u0103tor.<\/p>\n

      C\u00e2nd poate fi achizi\u021bionat?<\/h3>\n

      \nNu exist\u0103 un r\u0103spuns clar. \u00cen prezent, nu avem nicio notificare cu privire la importul acestor solu\u021bii \u00een \u021bara noastr\u0103. De \u00eendat\u0103 ce vor ap\u0103rea informa\u021bii cu privire la termene, vom anun\u021ba imediat \u00een canalele noastre (vk<\/a><\/noindex>, telegram<\/a><\/noindex>, facebook<\/a><\/noindex>). \u00cen plus, \u00een cur\u00e2nd va avea loc un webinar dedicat solu\u021biei Check Point Maestro, unde vor fi discutate toate caracteristicile tehnice. Desigur, vor exista \u0219i oportunit\u0103\u021bi de a adresa \u00eentreb\u0103ri. R\u0103m\u00e2ne\u021bi la curent cu nout\u0103\u021bile!<\/p>\n

      Concluzie<\/h3>\n

      \nCu siguran\u021b\u0103, noua platform\u0103 Maestro Hyperscale Network Security<\/a><\/noindex> este o ad\u0103ugare excelent\u0103 la solu\u021biile hardware Check Point. Practic, acest produs deschide un nou segment pentru care nu orice furnizor de securitate are solu\u021bii similare. Mai mult, p\u00e2n\u0103 \u00een prezent, Check Point Maestro nu are practic alternative, atunci c\u00e2nd vine vorba de asigurarea unei astfel de \u201eputeri de securitate\u201d f\u0103r\u0103 precedent. Cu toate acestea, Maestro Hyperscale Network Security va fi interesant nu doar pentru proprietarii de centre de date, ci \u0219i pentru companii obi\u0219nuite. Cei care de\u021bin sau inten\u021bioneaz\u0103 s\u0103 achizi\u021bioneze dispozitive \u00eencep\u00e2nd cu modelul 5600 pot deja \u00eencepe s\u0103 se familiarizeze cu Maestro. \u00cen unele cazuri, utilizarea Maestro Hyperscale Network Security poate fi o solu\u021bie extrem de avantajoas\u0103, at\u00e2t din punct de vedere economic, c\u00e2t \u0219i tehnic.<\/p>\n

      P.S. Articolul a fost redactat cu participarea Anatolii Masovera<\/b> \u2014 Expert \u00een platforme scalabile, Check Point Software Technologies.
      \n
      Sursa:       habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

      \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Check Point \u0434\u043e\u0432\u043e\u043b\u044c\u043d\u043e \u0440\u0435\u0437\u0432\u043e \u043d\u0430\u0447\u0430\u043b\u0430 2019 \u0433\u043e\u0434 \u0441\u0434\u0435\u043b\u0430\u0432 \u0441\u0440\u0430\u0437\u0443 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0430\u043d\u043e\u043d\u0441\u043e\u0432. \u0420\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u0442\u044c \u043e\u0431\u043e \u0432\u0441\u0435\u043c \u0432 \u043e\u0434\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043d\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u0441\u044f, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043d\u0430\u0447\u043d\u0435\u043c \u0441 \u0441\u0430\u043c\u043e\u0433\u043e \u0433\u043b\u0430\u0432\u043d\u043e\u0433\u043e \u2014 Check Point Maestro Hyperscale Network Security. Maestro \u044d\u0442\u043e \u043d\u043e\u0432\u0430\u044f \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0430\u0440\u0430\u0449\u0438\u0432\u0430\u0442\u044c \u00ab\u043c\u043e\u0449\u043d\u043e\u0441\u0442\u044c\u00bb \u0448\u043b\u044e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043e \u00ab\u043d\u0435\u043f\u0440\u0438\u043b\u0438\u0447\u043d\u044b\u0445\u00bb \u0446\u0438\u0444\u0440 \u0438 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043b\u0438\u043d\u0435\u0439\u043d\u043e. \u0414\u043e\u0441\u0442\u0438\u0433\u0430\u0435\u0442\u0441\u044f \u044d\u0442\u043e \u0435\u0441\u0442\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0437\u0430 \u0441\u0447\u0435\u0442 \u0431\u0430\u043b\u0430\u043d\u0441\u0438\u0440\u043e\u0432\u043a\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":29050,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-38726","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd471. Check Point Maestro Hyperscale Network Security \u2014 noua platform\u0103 de securitate scalabil\u0103 | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/1-check-point-maestro-hyperscale-network-security-novaya-masshtabiruemaya-security-platforma","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd471. Check Point Maestro Hyperscale Network Security \u2014 \u043d\u043e\u0432\u0430\u044f \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u0438\u0440\u0443\u0435\u043c\u0430\u044f security \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 | ProHoster","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/1-check-point-maestro-hyperscale-network-security-novaya-masshtabiruemaya-security-platforma","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:25:31+00:00","article:modified_time":"2019-10-31T19:25:31+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38726","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 23:11:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 16:59:39","updated":"2026-01-23 23:11:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/38726","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=38726"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/38726\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/29050"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=38726"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=38726"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=38726"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}