{"id":39000,"date":"2019-10-31T22:27:16","date_gmt":"2019-10-31T19:27:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/shifruemsya-po-gostu-pamyatka-po-nastrojke-dinamicheskoj-marshrutizatsii-trafika\/"},"modified":"2019-10-31T22:27:16","modified_gmt":"2019-10-31T19:27:16","slug":"shifruemsya-po-gostu-pamyatka-po-nastrojke-dinamicheskoj-marshrutizatsii-trafika","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/shifruemsya-po-gostu-pamyatka-po-nastrojke-dinamicheskoj-marshrutizatsii-trafika","title":{"rendered":"Cript\u0103m conform GOST: not\u0103 informativ\u0103 pentru configurarea rut\u0103rii dinamice a traficului","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Cript\u0103m
\nDac\u0103 compania dumneavoastr\u0103 transmite sau prime\u0219te date personale \u0219i alte informa\u021bii confiden\u021biale care trebuie protejate conform legisla\u021biei, este necesar s\u0103 aplica\u021bi criptarea conform standardului GOST. Ast\u0103zi v\u0103 vom povesti cum am implementat aceast\u0103 criptare pe baza criptogatei (KG) S-Terra pentru unul dintre clien\u021bi. Aceast\u0103 poveste va fi interesant\u0103 pentru speciali\u0219tii \u00een securitatea informa\u021biei, precum \u0219i pentru ingineri, proiectan\u021bi \u0219i arhitec\u021bi. Nu ne vom aprofunda \u00een detaliile tehnice ale configura\u021biei \u00een acest articol - ne vom concentra asupra aspectelor cheie ale configur\u0103rii de baz\u0103. Exist\u0103 o cantitate enorm\u0103 de documenta\u021bie despre configurarea daemonilor sistemului de operare Linux, pe care se bazeaz\u0103 KG S-Terra, disponibil\u0103 liber pe internet. Documenta\u021bia despre configurarea software-ului proprietar S-Terra este de asemenea disponibil\u0103 publicului. portalului<\/a><\/noindex> a produc\u0103torului.
\n<\/a><\/noindex><\/p>\n

C\u00e2teva cuvinte despre proiect <\/h2>\n

\nTopologia re\u021belei clientului era standard - full mesh \u00eentre sediu \u0219i filialele sale. Era necesar\u0103 implementarea cript\u0103rii canalelor de schimb de informa\u021bii \u00eentre toate loca\u021biile, erau 8 la num\u0103r. <\/p>\n

De obicei, \u00een astfel de proiecte totul este static: pe criptogate (KG) sunt configurate rute statice \u00een re\u021beaua local\u0103 a site-ului, sunt specificate listele de IP-uri (ACL) pentru criptare. Totu\u0219i, \u00een acest caz, loca\u021biile nu au o gestionare centralizat\u0103, iar \u00een re\u021belele locale ale acestora se poate \u00eent\u00e2mpla orice: re\u021belele pot fi ad\u0103ugate, eliminate \u0219i modificate \u00een diverse moduri. Pentru a evita reconfigurarea rut\u0103rii \u0219i ACL-urilor pe KG atunci c\u00e2nd se schimb\u0103 adresarea re\u021belelor locale, s-a decis s\u0103 se utilizeze tunelarea GRE \u0219i rutarea dinamic\u0103 OSPF, \u00een care sunt incluse toate KG-urile \u0219i majoritatea routerelor de nivel de baz\u0103 din re\u021bea (la unele loca\u021bii, administratorii infrastructurii au preferat s\u0103 utilizeze SNAT \u00een direc\u021bia KG-urilor pe routerele de baz\u0103). <\/p>\n

Tunelarea GRE a permis rezolvarea a dou\u0103 sarcini:
\n1.<\/b> S\u0103 foloseasc\u0103 \u00een ACL pentru criptare adresa IP a interfe\u021bei externe a KG-ului, \u00een care este encapsulat tot traficul destinat altor loca\u021bii.
\n2.<\/b> S\u0103 organizeze tuneluri p-t-p \u00eentre KG-uri, care permit configurarea rut\u0103rii dinamice (\u00een cazul nostru, \u00eentre loca\u021bii este organizat un MPLS L3VPN de furnizor).<\/p>\n

Clientul a solicitat implementarea cript\u0103rii ca serviciu. Altfel, ar fi fost nevoit nu doar s\u0103 men\u021bin\u0103 gateway-urile criptografice sau s\u0103 le externalizeze unei organiza\u021bii, ci \u0219i s\u0103 urm\u0103reasc\u0103 personal ciclul de via\u021b\u0103 al certificatelor de criptare, prelungindu-le la timp \u0219i instal\u00e2nd altele noi.
\n\"Cript\u0103m
\n\u0218i acum, propriul ghid \u2013 cum \u0219i ce am configurat<\/p>\n

Aten\u021bie subiec\u021bilor KIIs: configur\u0103m gateway-ul criptografic <\/h2>\n

<\/p>\n

Configurarea de baz\u0103 a re\u021belei<\/h3>\n

\n\u00cen primul r\u00e2nd, lans\u0103m noul K\u0160 \u0219i ajungem \u00een consola de administrare. Trebuie s\u0103 \u00eencepem cu schimbarea parolei administratorului \u00eencorporat \u2014 comanda change user password administrator<\/b>. Apoi, este necesar\u0103 efectuarea procedurii de ini\u021bializare (comanda initialize<\/b>) \u00een care se introduc datele licen\u021bei \u0219i se ini\u021biaz\u0103 generatorul de numere aleatorii (GNU).<\/p>\n

Aten\u021bie!<\/u><\/b> \u00cen timpul ini\u021bializ\u0103rii K\u0160 S-Terra se stabile\u0219te o politic\u0103 de securitate \u00een care interfe\u021bele gateway-ului de securitate nu permit pachete. Este necesar fie s\u0103 crea\u021bi o politic\u0103 proprie, fie s\u0103 activa\u021bi politica permisiv\u0103 preinstalat\u0103 folosind comanda run csconf_mgr activate<\/b> .
\nApoi, este necesar s\u0103 configura\u021bi adresarea interfe\u021belor externe \u0219i interne, precum \u0219i ruta implicit\u0103. Este preferabil s\u0103 efectua\u021bi lucr\u0103rile cu configura\u021bia re\u021belei K\u0160 \u0219i setarea cript\u0103rii printr-o consol\u0103 Cisco-like. Aceast\u0103 consol\u0103 este destinat\u0103 introducerii comenzilor similare cu cele din Cisco IOS. Configura\u021bia generat\u0103 prin consola Cisco-like este apoi convertit\u0103 \u00een fi\u0219iere de configurare corespunz\u0103toare, cu care lucreaz\u0103 demonii OS. Pute\u021bi trece \u00een consola Cisco-like din consola de administrare folosind comanda configure<\/b>.<\/p>\n

Schimb\u0103m parolele pentru utilizatorul \u00eencorporat cscons \u0219i enable: <\/p>\n

>enable
\nParol\u0103: csp (premontat\u0103)
\n#configure terminal
\n#username cscons privilege 15 secret 0 #enable secret 0 \u041d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c \u0431\u0430\u0437\u043e\u0432\u0443\u044e \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e:<\/p>\n

#interface GigabitEthernet0\/0
\n#ip address 10.111.21.3 255.255.255.0
\n#no shutdown
\n#interface GigabitEthernet0\/1
\n#ip address 192.168.2.5 255.255.255.252
\n#no shutdown
\n#ip route 0.0.0.0 0.0.0.0 10.111.21.254<\/p>\n

GRE<\/h3>\n

\nIe\u0219im din consol\u0103 Cisco-like \u0219i trecem \u00een shell-ul debian folosind comanda sistem<\/b>. Set\u0103m propria parol\u0103 pentru utilizatorul root<\/b> comanda passwd<\/b>.
\nPe fiecare K\u0160 se configureaz\u0103 un tunel separat pentru fiecare loca\u021bie. Configurarea interfe\u021bei tunnel se efectueaz\u0103 \u00een fi\u0219ierul \/etc\/network\/interfaces<\/b>. Crearea interfe\u021bei \u00een sine este gestionat\u0103 de utilitarul IP tunnel, care face parte din setul preinstalat iproute2. Comanda pentru crearea interfe\u021bei este specificat\u0103 \u00een op\u021biunea pre-up.<\/p>\n

Exemplu de configura\u021bie pentru o interfa\u021b\u0103 tunnel tipic\u0103:
\nauto site1
\niface site1 inet static
\naddress 192.168.1.4
\nnetmask 255.255.255.254
\npre-up ip tunnel add site1 mode gre local 10.111.21.3 remote 10.111.22.3 key hfLYEg^vCh6p<\/p>\n

Aten\u021bie!<\/u><\/b> Este important de men\u021bionat c\u0103 set\u0103rile interfe\u021belor de tunel trebuie situate \u00een afara sec\u021biunii <\/p>\n

###netifcfg-begin###
\n*****
\n###netifcfg-end###<\/p>\n

\u00cen caz contrar, aceste set\u0103ri vor fi suprascrise la modificarea set\u0103rilor interfe\u021belor fizice prin consola de tip Cisco.<\/p>\n

Ruteaz\u0103 dinamic<\/h3>\n

\n\u00cen S-Terra, rutarea dinamic\u0103 este realizat\u0103 prin intermediul pachetului de programe Quagga. Pentru a configura OSPF, vom avea nevoie de activarea \u0219i configurarea demonilor zebra<\/b> \u0219i ospfd<\/b>. Demonul zebra se ocup\u0103 de interac\u021biunea dintre demonii de rutare \u0219i SO. Demonul ospfd, a\u0219a cum sugereaz\u0103 numele, se ocup\u0103 de implementarea protocolului OSPF.
\nConfigurarea OSPF se face fie prin consola demonului, fie direct prin fi\u0219ierul de configurare \/etc\/quagga\/ospfd.conf<\/b>. Fi\u0219ierul con\u021bine toate interfe\u021bele fizice \u0219i de tunel implicate \u00een rutarea dinamic\u0103, precum \u0219i re\u021belele care vor fi anun\u021bate \u0219i vor accepta anun\u021buri.<\/p>\n

Un exemplu de configura\u021bie care trebuie ad\u0103ugat\u0103 \u00een ospfd.conf<\/b>:
\ninterfa\u021b\u0103 eth0
\n!
\ninterfa\u021b\u0103 eth1
\n!
\ninterfa\u021b\u0103 site1
\n!
\ninterfa\u021b\u0103 site2
\nrouter ospf
\n ospf router-id 192.168.2.21
\n network 192.168.1.4\/31 area 0.0.0.0
\n network 192.168.1.16\/31 area 0.0.0.0
\n network 192.168.2.4\/30 area 0.0.0.0<\/p>\n

\u00cen acest caz, adresele 192.168.1.x\/31 sunt rezervate pentru re\u021belele PTP \u00eentre loca\u021bii, iar adresele 192.168.2.x\/30 sunt pentru re\u021belele de tranzit \u00eentre KSH \u0219i routerele de nucleu. <\/p>\n

Aten\u021bie!<\/b><\/u> Pentru a reduce tabela de rutare \u00een instala\u021bii mari, se pot filtra anun\u021b\u0103rile re\u021belelor de tranzit prin construc\u021bii no redistribute connected<\/b> sau redistribute connected route-map<\/b>.<\/p>\n

Dup\u0103 configurarea demonilor, este necesar s\u0103 schimba\u021bi statutul de pornire al demonilor \u00een \/etc\/quagga\/daemons<\/b>. La op\u021biuni, schimba\u021bi \"no\" \u00een \"yes\". Rula\u021bi demonul quagga \u0219i seta\u021bi-l s\u0103 porneasc\u0103 automat la pornirea KSH cu comanda zebra<\/b> \u0219i ospfd<\/b> update-rc.d quagga enable Dac\u0103 configurarea tunelurilor GRE \u0219i OSPF este realizat\u0103 corect, atunci pe KSH \u0219i routerele de nucleu ar trebui s\u0103 apar\u0103 rute \u00een re\u021belele altor loca\u021bii \u0219i, prin urmare, se va stabili conectivitatea \u00eentre re\u021belele locale.<\/b>.<\/p>\n

Cript\u0103m traficul transmis<\/p>\n

Cript\u0103m traficul transmis <\/h3>\n

\nA\u0219a cum s-a men\u021bionat anterior, de obicei, atunci c\u00e2nd cript\u0103m \u00eentre site-uri, specific\u0103m intervalele de adrese IP (ACL) \u00eentre care traficul este criptat: dac\u0103 adresele de surs\u0103 \u0219i destina\u021bie se \u00eencadreaz\u0103 \u00een aceste intervale, traficul \u00eentre ele este criptat. Cu toate acestea, \u00een acest proiect, structura este dinamic\u0103 \u0219i adresele se pot schimba. Deoarece am configurat deja tunelarea GRE, ca adrese de surs\u0103 \u0219i destina\u021bie pentru criptarea traficului putem specifica adresele externe ale KH - deoarece pentru criptare vine traficul deja \u00eencapsulat \u00een protocolul GRE. Cu alte cuvinte, se cripteaz\u0103 tot ceea ce ajunge \u00een KH din re\u021beaua local\u0103 a unui site c\u0103tre re\u021belele care au fost anun\u021bate de alte site-uri. Iar \u00een interiorul fiec\u0103rui site poate avea loc orice redirec\u021bionare. Astfel, \u00een cazul unei modific\u0103ri a re\u021belelor locale, administratorului \u00eei este suficient s\u0103 modifice anun\u021burile care vin din re\u021beaua sa c\u0103tre KH, iar aceasta va deveni accesibil\u0103 pentru alte site-uri.<\/p>\n

Criptarea \u00een KH S-Terra se realizeaz\u0103 prin intermediul protocolului IPSec. Folosim algoritmul \u201eCrisantem\u0103\u201d conform GOST R 34.12-2015, iar pentru compatibilitatea cu versiunile mai vechi se poate aplica GOST 28147-89. Autentificarea se poate realiza tehnic at\u00e2t pe chei predefinite (PSK), c\u00e2t \u0219i pe certificate. Cu toate acestea, \u00een exploatarea industrial\u0103 este necesar s\u0103 se utilizeze certificate emise conform GOST R 34.10-2012.<\/p>\n

Lucrul cu certificate, containere \u0219i CRL se realizeaz\u0103 cu ajutorul utilitarului cert_mgr<\/b>. Primul lucru de f\u0103cut este s\u0103 folosim comanda cert_mgr create<\/b> pentru a forma un container al cheii private \u0219i o cerere de certificat care va fi trimis\u0103 Centrului de gestionare a certificatelor. Dup\u0103 primirea certificatului, acesta, \u00eempreun\u0103 cu certificatul r\u0103d\u0103cin\u0103 al CA \u0219i CRL (dac\u0103 se utilizeaz\u0103), trebuie importat cu comanda cert_mgr import<\/b>. Pentru a verifica c\u0103 toate certificatele \u0219i CRL s-au instalat, se poate folosi comanda cert_mgr show<\/b>.<\/p>\n

. Dup\u0103 instalarea cu succes a certificatelor, trecem la consola de tip Cisco-like pentru configurarea IPSec.
\nCre\u0103m o politic\u0103 IKE, \u00een care specific\u0103m algoritmii doriti \u0219i parametrii canalului securizat care vor fi oferi\u021bi partenerului pentru negociere. <\/p>\n

#crypto isakmp policy 1000
\n#encr gost341215k
\n#hash gost341112-512-tc26
\n#authentication sign
\n#group vko2
\n#lifetime 3600<\/p>\n

Aceast\u0103 politic\u0103 se aplic\u0103 \u00een construc\u021bia primei etape a IPSec. Rezultatul trecerii cu succes a primei etape este stabilirea SA (Asocia\u021biei de Securitate).
\nApoi va trebui s\u0103 stabilim lista adreselor IP de surs\u0103 \u0219i destina\u021bie (ACL) pentru criptare, s\u0103 form\u0103m un set de transform\u0103ri (transform set), s\u0103 cre\u0103m o hart\u0103 criptografic\u0103 (crypto map) \u0219i s\u0103 o leg\u0103m la interfa\u021ba extern\u0103 a KSH. <\/p>\n

Definim ACL:
\n#ip access-list extended site1
\n#permit gre host 10.111.21.3 host 10.111.22.3<\/p>\n

Setul de transform\u0103ri (la fel ca pentru prima faz\u0103, folosim algoritmul de criptare \u201eGrasshopper\u201d \u00een modul de generare a imita\u021biei):<\/p>\n

#crypto ipsec transform-set GOST esp-gost341215k-mac<\/p>\n

Cre\u0103m harta criptografic\u0103, specific\u0103m ACL, transform set \u0219i adresa peer-ului:<\/p>\n

#crypto map MAIN 100 ipsec-isakmp
\n#match address site1
\n#set transform-set GOST
\n#set peer 10.111.22.3<\/p>\n

Leg\u0103m harta criptografic\u0103 la interfa\u021ba extern\u0103 a KSH:<\/p>\n

#interface GigabitEthernet0\/0
\n#ip address 10.111.21.3 255.255.255.0
\n#crypto map MAIN<\/p>\n

Pentru criptarea canalelor cu alte platforme, este necesar s\u0103 repet\u0103m procedura de creare a ACL \u0219i a h\u0103r\u021bii criptografice, schimb\u00e2nd numele ACL, adresele IP \u0219i num\u0103rul h\u0103r\u021bii criptografice.<\/p>\n

Aten\u021bie! <\/u><\/b>\u00cen cazul \u00een care nu se utilizeaz\u0103 verificarea certificatelor prin CRL, acest lucru trebuie specificat clar:<\/p>\n

#crypto pki trustpoint s-terra_technological_trustpoint
\n#revocation-check none<\/p>\n

Monitoriz\u0103m \u201estarea\u201d sistemului<\/h2>\n

\n\u00cen KSH S-Terra, pentru monitorizare se folose\u0219te demonul standard snmpd. Pe l\u00e2ng\u0103 parametrii tipici pentru Linux, S-Terra \u201edin cutie\u201d suport\u0103 furnizarea datelor despre tunelurile IPSec conform CISCO-IPSEC-FLOW-MONITOR-MIB, ceea ce folosim pentru a monitoriza starea tunelurilor IPSec. De asemenea, este suportat\u0103 func\u021bionalitatea OID-urilor personalizate care furnizeaz\u0103 ca valori rezultatele execut\u0103rii scriptului. Aceast\u0103 posibilitate ne permite s\u0103 urm\u0103rim termenele de expirare ale certificatelor. Scriptul scris parseaz\u0103 ie\u0219irea comenzii cert_mgr show<\/b> \u0219i rezult\u0103 \u00een num\u0103rul de zile p\u00e2n\u0103 la expirarea certificatelor locale \u0219i de r\u0103d\u0103cin\u0103. Aceast\u0103 metod\u0103 este esen\u021bial\u0103 \u00een administrarea unui num\u0103r mare de KSH.
\n\"Cript\u0103m
\n<\/p>\n

Care este avantajul acestei cript\u0103ri<\/h2>\n

\nToat\u0103 func\u021bionalitatea descris\u0103 mai sus este suportat\u0103 \u201edin cutie\u201d de K\u0218 S-Terra. Aceasta \u00eenseamn\u0103 c\u0103 nu a fost necesar\u0103 instalarea unor module suplimentare care ar putea influen\u021ba certificarea criptog\u0103rzilor \u0219i acreditarea \u00eentregului sistem informa\u021bional. Canalele dintre site-uri pot fi oricum, chiar \u0219i prin internet. <\/p>\n

Datorit\u0103 faptului c\u0103 la schimbarea infrastructurii interne nu este necesar\u0103 reconfigurarea criptog\u0103rzilor, sistemul func\u021bioneaz\u0103 ca un serviciu<\/b>, ceea ce este foarte convenabil pentru client: \u00ee\u0219i poate localiza serviciile (client \u0219i server) la orice adrese, iar toate modific\u0103rile vor fi transmise dinamic \u00eentre echipamentele de criptare. <\/p>\n

Desigur, criptarea din cauza cheltuielilor suplimentare (overhead) influen\u021beaz\u0103 viteza de transmitere a datelor, dar nesemnificativ \u2013 l\u0103\u021bimea de band\u0103 a canalului poate sc\u0103dea cu maxim 5-10%. Totu\u0219i, tehnologia a fost testat\u0103 \u0219i a ar\u0103tat rezultate bune chiar \u0219i pe canale prin satelit, care sunt destul de instabile \u0219i au o l\u0103\u021bime de band\u0103 sc\u0103zut\u0103. <\/p>\n

Igor Vinohodov, inginer de a doua linie de administrare \u201eRostelecom-Solar\u201d<\/i>
\n
Sursa: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0415\u0441\u043b\u0438 \u0432\u0430\u0448\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u0435\u0440\u0435\u0434\u0430\u0451\u0442 \u0438\u043b\u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u043f\u043e \u0441\u0435\u0442\u0438 \u043f\u0435\u0440\u0441\u0434\u0430\u043d\u043d\u044b\u0435 \u0438 \u0434\u0440\u0443\u0433\u0443\u044e \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e, \u043f\u043e\u0434\u043b\u0435\u0436\u0430\u0449\u0443\u044e \u0437\u0430\u0449\u0438\u0442\u0435 \u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0438 \u0441 \u0437\u0430\u043a\u043e\u043d\u043e\u0434\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e\u043c, \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e \u0413\u041e\u0421\u0422\u0443. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0435\u043c, \u043a\u0430\u043a \u0432\u043d\u0435\u0434\u0440\u0438\u043b\u0438 \u0442\u0430\u043a\u043e\u0435 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0430 \u0431\u0430\u0437\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0448\u043b\u044e\u0437\u0430 (\u041a\u0428) S-Terra \u0443 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u043e\u0432. \u042d\u0442\u0430 \u0438\u0441\u0442\u043e\u0440\u0438\u044f \u0431\u0443\u0434\u0435\u0442 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0430 \u0418\u0411-\u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0430\u043c, \u043f\u0440\u043e\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0430\u043c \u0438 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u043e\u0440\u0430\u043c. \u0413\u043b\u0443\u0431\u043e\u043a\u043e \u043f\u043e\u0433\u0440\u0443\u0436\u0430\u0442\u044c\u0441\u044f \u0432 \u043d\u044e\u0430\u043d\u0441\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":29260,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-39000","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Criptare conform GOST: ghid pentru configurarea rut\u0103rii dinamice a traficului | ProHoster","description":"Dac\u0103 compania dumneavoastr\u0103.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/shifruemsya-po-gostu-pamyatka-po-nastrojke-dinamicheskoj-marshrutizatsii-trafika","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0428\u0438\u0444\u0440\u0443\u0435\u043c\u0441\u044f \u043f\u043e \u0413\u041e\u0421\u0422\u0443: \u043f\u0430\u043c\u044f\u0442\u043a\u0430 \u043f\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 | ProHoster","og:description":"\u0415\u0441\u043b\u0438 \u0432\u0430\u0448\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/shifruemsya-po-gostu-pamyatka-po-nastrojke-dinamicheskoj-marshrutizatsii-trafika","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:27:16+00:00","article:modified_time":"2019-10-31T19:27:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"39000","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-04 15:17:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:58:40","updated":"2026-02-04 15:17:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/39000","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=39000"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/39000\/revisions"}],"predecessor-version":[{"id":156680,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/39000\/revisions\/156680"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/29260"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=39000"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=39000"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=39000"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

Configurarea poate fi considerat\u0103 finalizat\u0103. \u00cen ie\u0219irea comenzilor din consola de tip Cisco-like show crypto isakmp sa<\/b> \u0219i show crypto ipsec sa<\/b> trebuie s\u0103 fie reflectate primele \u0219i a doua faz\u0103 IPSec. Acelea\u0219i informa\u021bii pot fi ob\u021binute folosind comanda sa_mgr show<\/b>, executat\u0103 din shell-ul debian. \u00cen ie\u0219irea comenzii cert_mgr show<\/b> trebuie s\u0103 apar\u0103 certificatele platformelor externe. Starea acestor certificate va fi remote<\/b>. \u00cen cazul \u00een care tunelurile nu se construiesc, este necesar s\u0103 consult\u0103m log-ul VPN<\/a>-serviciului, care este stocat \u00een fi\u0219ierul \/var\/log\/cspvpngate.log<\/b>. Lista complet\u0103 a fi\u0219ierelor de log cu descrierea con\u021binutului lor este disponibil\u0103 \u00een documenta\u021bie.<\/p>\n