{"id":95432,"date":"2020-09-29T07:42:38","date_gmt":"2020-09-29T05:42:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/razbor-samogo-demokratichnogo-iz-sd-wan-arhitektura-nastrojka-administrirovanie-i-podvodnye-kamni"},"modified":"2020-09-29T07:42:38","modified_gmt":"2020-09-29T05:42:38","slug":"razbor-samogo-demokratichnogo-iz-sd-wan-arhitektura-nastrojka-administrirovanie-i-podvodnye-kamni","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/razbor-samogo-demokratichnogo-iz-sd-wan-arhitektura-nastrojka-administrirovanie-i-podvodnye-kamni","title":{"rendered":"Analiza celui mai accesibil dintre SD-WAN: arhitectur\u0103, configurare, administrare \u0219i capcane","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Judec\u00e2nd dup\u0103 num\u0103rul de \u00eentreb\u0103ri care ne-au \u00eenceput s\u0103 vin\u0103 \u00een leg\u0103tur\u0103 cu SD-WAN, tehnologia a \u00eenceput s\u0103 se afirme serios \u00een Rusia. V\u00e2nz\u0103torii, desigur, nu stau degeaba \u0219i \u00ee\u0219i propun concep\u021biile, iar unii curajo\u0219i pionieri deja le implementeaz\u0103 \u00een re\u021belele lor. <\/p>\n

Colabor\u0103m cu aproape to\u021bi v\u00e2nz\u0103torii \u0219i, \u00een decurs de c\u00e2\u021biva ani, am avut ocazia s\u0103 analizez arhitectura fiec\u0103rui mare dezvoltator de solu\u021bii definite prin software \u00een laboratorul nostru. Un caz aparte este SD-WAN de la Fortinet, care a \u00eencorporat pur \u0219i simplu func\u021bionalitatea de echilibrare a traficului \u00eentre canalele de comunica\u021bie \u00een software-ul firewall-urilor. Solu\u021bia este mai degrab\u0103 democratic\u0103, a\u0219a c\u0103 de obicei este luat\u0103 \u00een considerare de companiile care nu sunt \u00eenc\u0103 preg\u0103tite pentru schimb\u0103ri globale, dar doresc s\u0103 utilizeze mai eficient canalele lor de comunica\u021bie. <\/p>\n

\u00cen acest articol vreau s\u0103 explic cum se configureaz\u0103 \u0219i se utilizeaz\u0103 SD-WAN de la Fortinet, cui se potrive\u0219te aceast\u0103 solu\u021bie \u0219i cu ce capcane se pot \u00eent\u00e2lni utilizatorii. <\/a><\/noindex><\/p>\n

Cei mai proeminen\u021bi juc\u0103tori de pe pia\u021ba SD-WAN pot fi \u00eemp\u0103r\u021bi\u021bi \u00een dou\u0103 tipuri: <\/p>\n

1. Startup-uri care au creat solu\u021bii SD-WAN de la zero. Cele mai de succes dintre acestea primesc un impuls uria\u0219 \u00een dezvoltare fiind cump\u0103rate de companii mari \u2013 aceasta este povestea Cisco\/Viptela, VMWare\/VeloCloud, Nuage\/Nokia.<\/p>\n

2. Mari v\u00e2nz\u0103tori de re\u021bea care au dezvoltat solu\u021bii SD-WAN, \u00eembun\u0103t\u0103\u021bind programabilitatea \u0219i gestionabilitatea routerelor lor tradi\u021bionale \u2013 aceasta este povestea Juniper, Huawei.<\/p>\n

Fortinet a reu\u0219it s\u0103 \u00ee\u0219i g\u0103seasc\u0103 propria cale. Func\u021bionalitatea care permitea unirea interfe\u021belor acestora \u00een canale virtuale \u0219i echilibrarea \u00eenc\u0103rc\u0103turii \u00eentre ele prin algoritmi mai complec\u0219i, comparativ cu rutarea obi\u0219nuit\u0103, a fost integrat\u0103 \u00een software-ul firewall-urilor. Aceast\u0103 func\u021bionalitate a fost denumit\u0103 SD-WAN. Poate fi ceea ce a realizat Fortinet numit SD-WAN? Pe pia\u021b\u0103 se contureaz\u0103 treptat \u00een\u021belegerea c\u0103 Software-Defined \u00eenseamn\u0103 separarea Control Plane de Data Plane, controlere dedicate, orchestratori. La Fortinet nu exist\u0103 nimic din toate acestea. Gestionarea centralizat\u0103 este op\u021bional\u0103 \u0219i este oferit\u0103 prin intermediul instrumentului tradi\u021bional Fortimanager. Dar, din punctul meu de vedere, nu merit\u0103 s\u0103 c\u0103ut\u0103m adev\u0103rul abstract \u0219i s\u0103 pierdem timpul cu dispute despre termeni. \u00cen lumea real\u0103, orice abordare are avantaje \u0219i dezavantaje. Cea mai bun\u0103 solu\u021bie este s\u0103 ne \u00een\u021belegem aceste aspecte \u0219i s\u0103 alegem solu\u021biile care corespund nevoilor. <\/p>\n

Voi \u00eencerca s\u0103 explic, cu capturi de ecran \u00een m\u00e2n\u0103, cum arat\u0103 \u0219i ce poate SD-WAN de la Fortinet.<\/p>\n

Cum este organizat totul <\/h3>\n

\nS\u0103 presupunem c\u0103 ave\u021bi dou\u0103 sucursale conectate \u00eentre ele prin dou\u0103 canale de transmisie a datelor. Aceste canale de transmisie sunt reunite \u00eentr-un grup, la fel cum interfe\u021bele Ethernet obi\u0219nuite sunt combinate \u00eentr-un LACP-Port-Channel. Cei cu experien\u021b\u0103 \u00ee\u0219i vor aminti de PPP Multilink \u2013 o analogie potrivit\u0103. Canalele pot fi porturi fizice, VLAN SVI sau, de asemenea, VPN<\/a> sau tuneluri GRE. <\/p>\n

VPN sau GRE sunt folosite de obicei pentru a conecta re\u021belele locale ale sucursalelor prin internet. Porturile fizice sunt utilizate \u00een cazul \u00een care exist\u0103 conexiuni L2 \u00eentre loca\u021bii sau c\u00e2nd se conecteaz\u0103 prin MPLS\/VPN dedicat, dac\u0103 accept\u0103m o leg\u0103tur\u0103 f\u0103r\u0103 Overlay \u0219i criptare. O alt\u0103 situa\u021bie \u00een care sunt utilizate porturile fizice \u00een grupul SD-WAN este echilibrarea ie\u0219irii locale a utilizatorilor c\u0103tre internet.<\/p>\n

Pe standul nostru exist\u0103 patru firewall-uri \u0219i dou\u0103 tuneluri VPN, care func\u021bioneaz\u0103 prin doi \u201eoperatori de telecomunica\u021bii\u201d. Schema arat\u0103 a\u0219a:<\/p>\n

\"Analiza
\n
\nTunelurile VPN sunt configurate \u00een modul de interfa\u021b\u0103, astfel \u00eenc\u00e2t s\u0103 arate ca \u0219i cum ar fi conexiuni Point-to-Point \u00eentre dispozitive cu adrese IP pe interfe\u021bele P2P, care pot fi urm\u0103rite \u0219i verificate pentru a ne asigura c\u0103 leg\u0103tura prin tunelul specific func\u021bioneaz\u0103. Pentru a cripta traficul \u0219i a-l trimite pe partea opus\u0103, este suficient s\u0103-l Router-i\u021bi \u00een tunel. Alternativa este filtrarea traficului pentru criptare folosind liste de subre\u021bele, ceea ce complic\u0103 foarte mult configura\u021bia pentru administrator pe m\u0103sur\u0103 ce devine mai complicat\u0103. \u00centr-o re\u021bea mare, pentru a construi VPN, se poate utiliza tehnologia ADVPN, un echivalent DMVPN de la Cisco sau DVPN de la Huawei, care simplific\u0103 configurarea.<\/p>\n

Configura\u021bia Site-to-Site VPN pentru dou\u0103 dispozitive cu rutare BGP de ambele p\u0103r\u021bi<\/b>
\n <\/p>\n

\u201eDC\u201d (Data Center)
\n\u201eBRN\u201d (Sucursala)<\/p>\n

configura\u0163ie sistem interfa\u0163\u0103
\n\u2003editeaz\u0103 "WAN1"
\n\u2003\u2003seteaz\u0103 vdom "Internet"
\n\u2003\u2003set ip 1.1.1.1 255.255.255.252
\n\u2003\u2003set allowaccess ping
\n\u2003\u2003set role wan
\n\u2003\u2003seteaz\u0103 interfa\u021ba "DC-BRD"
\n\u2003\u2003set vlanid 111
\n\u2003next
\n\u2003editeaz\u0103 "WAN2"
\n\u2003\u2003seteaz\u0103 vdom "Internet"
\n\u2003\u2003set ip 3.3.3.1 255.255.255.252
\n\u2003\u2003set allowaccess ping
\n\u2003\u2003set role lan
\n\u2003\u2003seteaz\u0103 interfa\u021ba "DC-BRD"
\n\u2003\u2003set vlanid 112
\n\u2003next
\n\u2003editeaz\u0103 "BRN-Ph1-1"
\n\u2003\u2003seteaz\u0103 vdom "Internet"
\n\u2003\u2003set ip 192.168.254.1 255.255.255.255
\n\u2003\u2003set allowaccess ping
\n\u2003\u2003set type tunnel
\n\u2003\u2003set remote-ip 192.168.254.2 255.255.255.255
\n\u2003\u2003seteaz\u0103 interfa\u021ba "WAN1"
\n\u2003next
\n\u2003editeaz\u0103 "BRN-Ph1-2"
\n\u2003\u2003seteaz\u0103 vdom "Internet"
\n\u2003\u2003set ip 192.168.254.3 255.255.255.255
\n\u2003\u2003set allowaccess ping
\n\u2003\u2003set type tunnel
\n\u2003\u2003set remote-ip 192.168.254.4 255.255.255.255
\n\u2003\u2003seteaz\u0103 interfa\u021ba "WAN2"
\n\u2003next
\nend<\/p>\n

config vpn ipsec phase1-interface
\n\u2003editeaz\u0103 "BRN-Ph1-1"
\n\u2003\u2003seteaz\u0103 interfa\u021ba "WAN1"
\n\u2003\u2003set local-gw 1.1.1.1
\n\u2003\u2003set peertype any
\n\u2003\u2003set net-device disable
\n\u2003\u2003set proposal aes128-sha1
\n\u2003\u2003set dhgrp 2
\n\u2003\u2003set remote-gw 2.2.2.1
\n\u2003\u2003set psksecret ***
\n\u2003next
\n\u2003editeaz\u0103 "BRN-Ph1-2"
\n\u2003\u2003seteaz\u0103 interfa\u021ba "WAN2"
\n\u2003\u2003set local-gw 3.3.3.1
\n\u2003\u2003set peertype any
\n\u2003\u2003set net-device disable
\n\u2003\u2003set proposal aes128-sha1
\n\u2003\u2003set dhgrp 2
\n\u2003\u2003set remote-gw 4.4.4.1
\n\u2003\u2003set psksecret ***
\n\u2003next
\nend<\/p>\n

config vpn ipsec phase2-interface
\n\u2003editeaz\u0103 "BRN-Ph2-1"
\n\u2003\u2003seteaz\u0103 numele fazei1 "BRN-Ph1-1"
\n\u2003\u2003set proposal aes256-sha256
\n\u2003\u2003set dhgrp 2
\n\u2003next
\n\u2003editeaz\u0103 "BRN-Ph2-2"
\n\u2003\u2003seteaz\u0103 numele fazei1 "BRN-Ph1-2"
\n\u2003\u2003set proposal aes256-sha256
\n\u2003\u2003set dhgrp 2
\n\u2003next
\nend<\/p>\n

config router static
\n\u2003edit 1
\n\u2003\u2003set gateway 1.1.1.2
\n\u2003\u2003seteaz\u0103 dispozitivul "WAN1"
\n\u2003next
\n\u2003edit 3
\n\u2003\u2003set gateway 3.3.3.2
\n\u2003\u2003seteaz\u0103 dispozitivul "WAN2"
\n\u2003next
\nend<\/p>\n

config router bgp
\n\u2003set as 65002
\n\u2003set router-id 10.1.7.1
\n\u2003set ebgp-multipath enable
\n\u2003config neighbor
\n\u2003\u2003editeaz\u0103 "192.168.254.2"
\n\u2003\u2003\u2003set remote-as 65003
\n\u2003\u2003next
\n\u2003\u2003editeaz\u0103 "192.168.254.4"
\n\u2003\u2003\u2003set remote-as 65003
\n\u2003\u2003next
\n\u2003end<\/p>\n

\u2003config network
\n\u2003\u2003edit 1
\n\u2003\u2003\u2003set prefix 10.1.0.0 255.255.0.0
\n\u2003\u2003next
\nend <\/p>\n

configura\u0163ie sistem interfa\u0163\u0103
\n\u2003editeaz\u0103 "WAN1"
\n\u2003\u2003seteaz\u0103 vdom "Internet"
\n\u2003\u2003set ip 2.2.2.1 255.255.255.252
\n\u2003\u2003set allowaccess ping
\n\u2003\u2003set role wan
\n\u2003\u2003seteaz\u0103 interfa\u021ba "BRN-BRD"
\n\u2003\u2003set vlanid 111
\n\u2003next
\n\u2003editeaz\u0103 "WAN2"
\n\u2003\u2003seteaz\u0103 vdom "Internet"
\n\u2003\u2003set ip 4.4.4.1 255.255.255.252
\n\u2003\u2003set allowaccess ping
\n\u2003\u2003set role wan
\n\u2003\u2003seteaz\u0103 interfa\u021ba "BRN-BRD"
\n\u2003\u2003set vlanid 114
\n\u2003next
\n\u2003editeaz\u0103 "DC-Ph1-1"
\n\u2003\u2003seteaz\u0103 vdom "Internet"
\n\u2003\u2003set ip 192.168.254.2 255.255.255.255
\n\u2003\u2003set allowaccess ping
\n\u2003\u2003set type tunnel
\n\u2003\u2003set remote-ip 192.168.254.1 255.255.255.255
\n\u2003\u2003seteaz\u0103 interfa\u021ba "WAN1"
\n\u2003next
\n\u2003editeaz\u0103 "DC-Ph1-2"
\n\u2003\u2003seteaz\u0103 vdom "Internet"
\n\u2003\u2003set ip 192.168.254.4 255.255.255.255
\n\u2003\u2003set allowaccess ping
\n\u2003\u2003set type tunnel
\n\u2003\u2003set remote-ip 192.168.254.3 255.255.255.255
\n\u2003\u2003seteaz\u0103 interfa\u021ba "WAN2"
\n\u2003next
\nend<\/p>\n

config vpn ipsec phase1-interface
\n\u2003 editeaz\u0103 "DC-Ph1-1"
\n\u2003\u2003 seteaz\u0103 interfa\u021ba "WAN1"
\n\u2003\u2003 set local-gw 2.2.2.1
\n\u2003\u2003 set peertype any
\n\u2003\u2003 set net-device disable
\n\u2003\u2003 set proposal aes128-sha1
\n\u2003\u2003 set dhgrp 2
\n\u2003\u2003 set remote-gw 1.1.1.1
\n\u2003\u2003 set psksecret ***
\n\u2003 next
\n\u2003 editeaz\u0103 "DC-Ph1-2"
\n\u2003\u2003 seteaz\u0103 interfa\u021ba "WAN2"
\n\u2003\u2003 set local-gw 4.4.4.1
\n\u2003\u2003 set peertype any
\n\u2003\u2003 set net-device disable
\n\u2003\u2003 set proposal aes128-sha1
\n\u2003\u2003 set dhgrp 2
\n\u2003\u2003 set remote-gw 3.3.3.1
\n\u2003\u2003 set psksecret ***
\n\u2003 next
\nend<\/p>\n

config vpn ipsec phase2-interface
\n\u2003 editeaz\u0103 "DC-Ph2-1"
\n\u2003\u2003 seteaz\u0103 numele fazei1 "DC-Ph1-1"
\n\u2003\u2003 set proposal aes128-sha1
\n\u2003\u2003 set dhgrp 2
\n\u2003 next
\n\u2003 editeaz\u0103 "DC2-Ph2-2"
\n\u2003\u2003 seteaz\u0103 numele fazei1 "DC-Ph1-2"
\n\u2003\u2003 set proposal aes128-sha1
\n\u2003\u2003 set dhgrp 2
\n\u2003 next
\nend<\/p>\n

config router static
\n\u2003edit 1
\n\u2003\u2003set gateway 2.2.2.2
\n\u2003\u2003seteaz\u0103 dispozitivul "WAN1"
\n\u2003next
\n\u2003edit 3
\n\u2003\u2003set gateway 4.4.4.2
\n\u2003\u2003seteaz\u0103 dispozitivul "WAN2"
\n\u2003next
\nend<\/p>\n

config router bgp
\n\u2003 set as 65003
\n\u2003 set router-id 10.200.7.1
\n\u2003 set ebgp-multipath enable
\n\u2003 config neighbor
\n\u2003\u2003 editeaz\u0103 "192.168.254.1"
\n\u2003\u2003\u2003 set remote-as 65002
\n\u2003\u2003 next
\n\u2003\u2003editeaz\u0103 "192.168.254.3"
\n\u2003\u2003\u2003set remote-as 65002
\n\u2003\u2003 next
\n\u2003 end<\/p>\n

\u2003 config network
\n\u2003\u2003 edit 1
\n\u2003\u2003\u2003 set prefix 10.200.0.0 255.255.0.0
\n\u2003 \u2003next
\n end <\/p>\n

<\/code><\/p>\n

Furnizez configura\u021bia \u00eentr-un format textual, deoarece, \u00een opinia mea, este mai convenabil s\u0103 configurezi VPN-ul \u00een acest mod. Majoritatea set\u0103rilor sunt identice de ambele p\u0103r\u021bi, iar \u00een format text pot fi copiate \u0219i lipite. Dac\u0103 fac acela\u0219i lucru \u00een interface-ul web, este u\u0219or s\u0103 gre\u0219easc\u0103, uit\u00e2nd s\u0103 bifeze o caset\u0103 sau introduc\u00e2nd o valoare gre\u0219it\u0103. <\/p>\n

Dup\u0103 ce am ad\u0103ugat interfe\u021bele \u00een grup<\/p>\n

\"Analiza
\n
\ntoate rutele \u0219i politicile de securitate pot face referire la el, \u0219i nu la interfe\u021bele incluse \u00een acesta. Cel pu\u021bin, trebuie s\u0103 permit\u0103 traficul din re\u021belele interne c\u0103tre SD-WAN. Atunci c\u00e2nd se creeaz\u0103 reguli pentru acestea, se pot aplica m\u0103suri de protec\u021bie, cum ar fi IPS, antivirus \u0219i decriptarea HTTPS.<\/p>\n

\"Analiza
\n
\nPentru grup se configureaz\u0103 regulile SD-WAN. Acestea sunt reguli care definesc algoritmul de echilibrare pentru traficul specific. Ele sunt asem\u0103n\u0103toare cu politicile de rutare \u00een rutarea bazat\u0103 pe politici, doar c\u0103 rezultatul \u00een cazul \u00een care traficul cade sub o politic\u0103 este setarea nu o interfa\u021b\u0103 next-hop sau de ie\u0219ire obi\u0219nuit\u0103, ci interfe\u021bele ad\u0103ugate \u00een grupul SD-WAN plus algoritmul de echilibrare a traficului \u00eentre aceste interfe\u021be. <\/p>\n

Traficul poate fi separat din fluxul general pe baza informa\u021biilor L3-L4, dup\u0103 aplica\u021biile recunoscute, servicii de internet (URL \u0219i IP), precum \u0219i pe baza utilizatorilor identifica\u021bi ai sta\u021biilor de lucru \u0219i laptopurilor. Dup\u0103 aceea, pentru traficul selectat, se poate aloca unul dintre urm\u0103toarele algoritmi de balansare:<\/p>\n

\"Analiza
\n
\n\u00cen lista Preferin\u021be Interfa\u021b\u0103, se aleg interfe\u021bele deja ad\u0103ugate \u00een bundle care vor gestiona acest tip de trafic. Ad\u0103ug\u00e2nd nu toate interfe\u021bele, se poate limita pe care anume canale circul\u0103, de exemplu, emailul, dac\u0103 nu dori\u021bi s\u0103-l \u00eenc\u0103rca\u021bi pe canale costisitoare cu SLA ridicat. \u00cen FortiOS 6.4.1 a ap\u0103rut posibilitatea de a grupa interfe\u021bele ad\u0103ugate \u00een bundle SD-WAN \u00een zone, cre\u00e2nd, de exemplu, o zon\u0103 pentru comunica\u021bia cu loca\u021biile \u00eendep\u0103rtate \u0219i alta pentru accesul local la internet utiliz\u00e2nd NAT. Da, da, traficul care se duce \u00een internetul obi\u0219nuit poate fi, de asemenea, balansat.<\/p>\n

Despre algoritmii de balansare
\n<\/h3>\n

\n\u00cen ceea ce prive\u0219te modul \u00een care Fortigate (firewall de la Fortinet) poate distribui traficul \u00eentre canale, exist\u0103 dou\u0103 op\u021biuni interesante, nu foarte comune pe pia\u021b\u0103:<\/p>\n

Cel mai mic cost (SLA)<\/b> \u2013 dintre toate interfe\u021bele care \u00eendeplinesc SLA \u00een acel moment, este ales cel cu cel mai mic cost (cost) stabilit manual de administrator; acest mod este potrivit pentru traficul \u201evoluminos\u201d, cum ar fi backup-ul \u0219i transferul de fi\u0219iere. <\/p>\n

Cea mai bun\u0103 calitate (SLA)<\/b> \u2013 acest algoritm, pe l\u00e2ng\u0103 \u00eent\u00e2rzieri, jitter \u0219i pierderi de pachete obi\u0219nuite, poate utiliza pentru evaluarea calit\u0103\u021bii canalelor \u0219i \u00eenc\u0103rcarea curent\u0103 a canalului; acest mod este potrivit pentru traficul \u201esensibil\u201d, cum ar fi VoIP (telefonie IP) \u0219i videoconferin\u021be.<\/p>\n

Pentru aceste algoritmi este necesar\u0103 configurarea m\u0103sur\u0103torului de performan\u021b\u0103 a canalului de comunica\u021bie \u2013 Performance SLA. Acest m\u0103sur\u0103tor monitorizeaz\u0103 periodic informa\u021biile privind respectarea SLA: pierderile (packet loss), \u00eent\u00e2rzierea (latency) \u0219i jitter-ul (jitter) \u00een canalul de comunica\u021bie \u0219i poate \u201edeclara necorespunz\u0103toare\u201d acele canale care, \u00een acel moment, nu \u00eendeplinesc valorile pragului de calitate \u2013 pierd prea multe pachete sau au o \u00eent\u00e2rziere prea mare. \u00cen plus, m\u0103sur\u0103torul urm\u0103re\u0219te statutul canalului \u0219i poate s\u0103-l elimine temporar din bundle, \u00een cazul pierderii repetate a r\u0103spunsurilor (failures before inactive). La restabilire, dup\u0103 ce au venit c\u00e2teva r\u0103spunsuri consecutive (restore link after), m\u0103sur\u0103torul va readuce automat canalul \u00een bundle \u0219i datele vor \u00eencepe din nou s\u0103 fie transmise prin el.<\/p>\n

Iat\u0103 cum arat\u0103 configura\u021bia \u201em\u0103sur\u0103torului\u201d: <\/p>\n

\"Analiza
\n
\n\u00cen interfa\u021ba web, ca protocol pentru teste sunt disponibile ICMP-Echo-request, HTTP-GET \u0219i DNS request. \u00cen linia de comand\u0103, op\u021biunile sunt pu\u021bin mai numeroase: sunt disponibile op\u021biunile TCP-echo \u0219i UDP-echo, precum \u0219i un protocol specializat de m\u0103surare a calit\u0103\u021bii \u2013 TWAMP.<\/p>\n

\"Analiza
\n
\nRezultatele m\u0103sur\u0103torilor pot fi vizualizate \u0219i \u00een interfa\u021ba web: <\/p>\n

\"Analiza
\n
\n\u0218i \u00een linia de comand\u0103: <\/p>\n

\"Analiza
\n<\/p>\n

Troubleshooting<\/h3>\n

\nDac\u0103 a\u021bi creat o regul\u0103 \u0219i totul nu func\u021bioneaz\u0103 a\u0219a cum era de a\u0219teptat, ar trebui s\u0103 verifica\u021bi valoarea Hit Count \u00een lista SD-WAN Rules. Aceasta v\u0103 va ar\u0103ta dac\u0103 traficul se \u00eencadreaz\u0103 \u00een aceast\u0103 regul\u0103:<\/p>\n

\"Analiza
\n
\nPe pagina de configurare a m\u0103sur\u0103torului \u00een sine, pute\u021bi vedea schimbarea parametrilor canalului \u00een timp. Linia cu puncte indic\u0103 valoarea pragului parametrului.<\/p>\n

\"Analiza
\n
\n\u00cen interfa\u021ba web, pute\u021bi vedea cum se distribuie traficul \u00een func\u021bie de volumul de date transmise\/primite \u0219i de num\u0103rul de sesiuni:<\/p>\n

\"Analiza
\n
\n\u00cen plus, exist\u0103 o oportunitate excelent\u0103 de a urm\u0103ri trecerea pachetelor cu o detaliere maxim\u0103. Atunci c\u00e2nd lucra\u021bi \u00een re\u021beaua real\u0103, \u00een configura\u021bia dispozitivului se acumuleaz\u0103 o mul\u021bime de politici de rutare, de firewall \u0219i de distribu\u021bie a traficului pe porturile SD-WAN. Toate acestea interac\u021bioneaz\u0103 \u00eentre ele \u00eentr-un mod complex, iar de\u0219i furnizorul aduce scheme detaliate ale algoritmilor de procesare a pachetelor, este foarte important s\u0103 ave\u021bi posibilitatea de a nu construi \u0219i verifica teorii, ci de a vedea unde dispare cu adev\u0103rat traficul.<\/p>\n

De exemplu, urm\u0103torul set de comenzi<\/p>\n

diagnostic\u0103 flux de depanare filtru saddr 10.200.64.15
\ndiagnostic\u0103 flux de depanare filtru daddr 10.1.7.2
\ndiagnostic\u0103 flux de depanare arat\u0103 nume-func\u021bie
\nactivare depanare diagnostic\u0103
\nurmeaz\u0103 diagnostic\u0103 2<\/code><\/p>\n

Va permite urm\u0103rirea a dou\u0103 pachete cu adresa surs\u0103 10.200.64.15 \u0219i adresa destinatarului 10.1.7.2.
\nPinging 10.7.1.2 from 10.200.64.15 twice and checking the output in the console.<\/p>\n

First packet:<\/p>\n

\"Analiza
\n
\nSecond packet:<\/p>\n

\"Analiza
\n
\nHere is the first packet received by the firewall:
\nid=20085 trace_id=475 func=print_pkt_detail line=5605 msg=\"vd-Internet:0 a primit un pachet(proto=1, 10.200.64.15:42->10.1.7.2:2048) de la DMZ-Office. tip=8, cod=0, id=42, seq=0.\"
\nVDOM \u2013 Internet, Proto=1 (ICMP), DMZ-Office \u2013 numele interfe\u021bei L3. <\/b>Tip=8 \u2013 Echo.<\/code><\/p>\n

A new session was created for it:
\nmsg=\"alocare o sesiune nou\u0103-0006a627\"<\/code><\/p>\n

And a match was found in the routing policy settings
\nmsg=\"Se potrive\u0219te politica de rutare id=2136539137: la 10.1.7.2 prin ifindex-110\"<\/code><\/p>\n

It turns out that the packet needs to be sent through one of the VPN tunnels:
\n\"g\u0103se\u0219te o rut\u0103: flag=04000000 gw-192.168.254.1 prin DC-Ph1-1\"<\/code><\/p>\n

A permissive rule is found in the firewall policies:
\nmsg=\"Permis de Politic\u0103-3:\"<\/code><\/p>\n

The packet is encrypted and sent into the VPN tunnel:
\nfunc=ipsecdev_hard_start_xmit line=789 msg=\"intr\u0103 \u00een interfa\u021ba IPsec-DC-Ph1-1\"
\nfunc=_ipsecdev_hard_start_xmit line=666 msg=\"tunelul IPsec-DC-Ph1-1\"
\nfunc=esp_output4 line=905 msg=\"IPsec criptare\/autentificare\"<\/code><\/p>\n

The encrypted packet is sent to the gateway address for this WAN interface:
\nmsg=\"trimite la 2.2.2.2 prin intf-WAN1\"<\/code><\/p>\n

For the second packet, everything happens similarly, but it is sent to another VPN tunnel and exits through another firewall port:
\nfunc=ipsecdev_hard_start_xmit line=789 msg=\"intrare \u00een interfa\u021ba IPsec-DC-Ph1-2\"
\nfunc=_ipsecdev_hard_start_xmit line=666 msg=\"tunel IPsec-DC-Ph1-2\"
\nfunc=esp_output4 line=905 msg=\"IPsec criptare\/autentificare\"
\nfunc=ipsec_output_finish line=622 msg=\"trimite c\u0103tre 4.4.4.2 prin intf-WAN2\"<\/code><\/p>\n

Advantages of the solution
\n<\/h3>\n

\nReliable functionality and user-friendly interface. <\/b>The set of features available in FortiOS prior to the emergence of SD-WAN has been fully retained. In other words, we have not a newly developed software, but a mature system from a trusted firewall vendor. With a traditional set of networking features and an easy-to-learn web interface. How many SD-WAN vendors have, let's say, Remote-Access VPN functionality on their end devices?<\/p>\n

Security at level 80. <\/b>FortiGate is among the top solutions in firewalling. There are many resources online for configuring and administering firewalls, and the job market has plenty of security specialists already familiar with the vendor's solutions.<\/p>\n

Zero cost for SD-WAN functionality. <\/b>Building an SD-WAN network on FortiGate costs the same as building a regular WAN network on it, since no additional licenses are required to implement SD-WAN functionality. <\/p>\n

Low entry price. <\/b>Fortigate offers a good range of devices for different performance levels. The most basic and affordable models are quite suitable for setting up an office or a point of sale, say, for 3-5 employees. Many vendors lack such low-performance and affordable models. <\/p>\n

Performan\u021b\u0103 ridicat\u0103. <\/b>Reducing SD-WAN functionality to traffic balancing allowed the company to release a specialized SD-WAN ASIC, which means that the operation of SD-WAN does not decrease the performance of the firewall as a whole. <\/p>\n

The ability to implement an entire office on Fortinet equipment. <\/b>Aceasta este o pereche de firewalls, switch-uri \u0219i puncte de acces Wi-Fi. Este u\u0219or \u0219i convenabil s\u0103 gestionezi un astfel de birou \u2013 switch-urile \u0219i punctele de acces se \u00eenregistreaz\u0103 pe firewalls \u0219i sunt gestionate de acestea. Iat\u0103 cum ar putea ar\u0103ta, de exemplu, un port al switch-ului din interfa\u021ba firewall-ului, care este gestionat de acest switch:<\/p>\n

\"Analiza
\n
\nLipsa controlerelor ca punct unic de e\u0219ec. <\/b>Acesta este un punct pe care \u00eel subliniaz\u0103 \u00eensu\u0219i furnizorul, dar poate fi numit un avantaj doar par\u021bial, deoarece pentru furnizorii care au controlere, asigurarea redundan\u021bei acestora nu cost\u0103 mult, de cele mai multe ori fiind vorba de o cantitate mic\u0103 de resurse de calcul \u00een medii de virtualizare.<\/p>\n

Ce trebuie s\u0103 avem \u00een vedere
\n<\/h3>\n

\nLipsa separ\u0103rii Control Plane \u0219i Data Plane<\/b>. Acest lucru \u00eenseamn\u0103 c\u0103 re\u021beaua trebuie configurat\u0103 fie manual, fie cu ajutorul instrumentelor tradi\u021bionale de gestionare \u2014 FortiManager. La furnizorii care au realizat aceast\u0103 separare, re\u021beaua se construie\u0219te singur\u0103. Administratorul poate fi nevoit doar s\u0103 corecteze topologia acesteia, s\u0103 interzic\u0103 ceva, nu mai mult. Totu\u0219i, avantajul FortiManager este c\u0103 acesta poate gestiona nu doar firewalls, ci \u0219i switch-uri \u0219i puncte de acces Wi-Fi, adic\u0103 practic \u00eentreaga re\u021bea. <\/p>\n

Cre\u0219tere condi\u021bionat\u0103 a gestionabilit\u0103\u021bii. <\/b>Din cauza faptului c\u0103 pentru automatizarea configur\u0103rii re\u021belei se utilizeaz\u0103 instrumente tradi\u021bionale, gestionabilitatea re\u021belei cu implementarea SD-WAN cre\u0219te nesemnificativ. Pe de alt\u0103 parte, noua func\u021bionalitate devine disponibil\u0103 mai rapid, deoarece furnizorul o lanseaz\u0103 mai \u00eent\u00e2i doar pentru sistemul de operare al firewalls (ceea ce ofer\u0103 imediat posibilitatea de a o utiliza), iar apoi completeaz\u0103 sistemul de gestionare cu interfe\u021bele necesare.<\/p>\n

O parte din func\u021bionalitate poate fi disponibil\u0103 din linia de comand\u0103, dar nu \u0219i din interfa\u021ba web. <\/b>Nu este at\u00e2t de grav s\u0103 intri ocazional \u00een linia de comand\u0103 pentru a configura ceva, c\u00e2t este de grav s\u0103 nu vezi \u00een interfa\u021ba web c\u0103 ceva a fost deja configurat din linia de comand\u0103. Dar acest lucru se refer\u0103 de obicei la cele mai noi func\u021bii \u0219i treptat, cu actualiz\u0103rile FortiOS, capacit\u0103\u021bile interfe\u021bei web sunt aduse la zi.<\/p>\n

Cui se potrive\u0219te<\/h3>\n

\nCelor care nu au foarte multe filiale.<\/b> Implementarea unei solu\u021bii SD-WAN cu componente centrale complexe \u00een re\u021bele cu 8-10 sucursale poate s\u0103 nu merite costul \u2013 va fi necesar s\u0103 cheltui\u021bi bani pe licen\u021be pentru dispozitivele SD-WAN \u0219i resursele de virtualizare pentru g\u0103zduirea componentelor centrale. De obicei, o companie mic\u0103 are foarte pu\u021bine resurse de calcul disponibile. \u00cen cazul Fortinet, este suficient s\u0103 achizi\u021biona\u021bi firewall-uri. <\/p>\n

Celor care au foarte multe sucursale mici. <\/b>La mul\u021bi furnizori, pre\u021bul minim al solu\u021biei per sucursal\u0103 este destul de ridicat \u0219i poate deveni neinteresant din perspectiva afacerii clientului final. Fortinet ofer\u0103 dispozitive mici la un pre\u021b foarte atractiv. <\/p>\n

Celor care nu sunt preg\u0103ti\u021bi s\u0103 fac\u0103 un pas at\u00e2t de \u00eensemnat. <\/b>Implementarea SD-WAN cu controllere, rutare proprietar\u0103, o nou\u0103 abordare \u00een planificarea \u0219i managementul re\u021belei poate fi un pas prea serios pentru anumi\u021bi clien\u021bi. Da, o astfel de implementare va ajuta \u00een final la optimizarea utiliz\u0103rii canalelor de comunica\u021bie \u0219i a muncii administratorilor, dar mai \u00eent\u00e2i va trebui s\u0103 \u00eenve\u021be multe lucruri noi. Cei care nu sunt \u00eenc\u0103 preg\u0103ti\u021bi s\u0103 schimbe paradigma, dar doresc s\u0103 ob\u021bin\u0103 c\u00e2t mai mult din canalele lor de comunica\u021bie, vor g\u0103si solu\u021bia Fortinet foarte potrivit\u0103.
\n
Sursa: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0421\u0443\u0434\u044f \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u0432\u043e\u043f\u0440\u043e\u0441\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0430\u043c \u0441\u0442\u0430\u043b\u0438 \u043f\u0440\u0438\u043b\u0435\u0442\u0430\u0442\u044c \u043f\u043e SD-WAN, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f \u043d\u0430\u0447\u0430\u043b\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u0440\u0438\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0432 \u0420\u043e\u0441\u0441\u0438\u0438. \u0412\u0435\u043d\u0434\u043e\u0440\u044b, \u0435\u0441\u0442\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e, \u043d\u0435 \u0434\u0440\u0435\u043c\u043b\u044e\u0442 \u0438 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0442 \u0441\u0432\u043e\u0438 \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438, \u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u043c\u0435\u043b\u044c\u0447\u0430\u043a\u0438 \u043f\u0435\u0440\u0432\u043e\u043f\u0440\u043e\u0445\u043e\u0434\u0446\u044b \u0443\u0436\u0435 \u0432\u043d\u0435\u0434\u0440\u044f\u044e\u0442 \u0438\u0445 \u0443 \u0441\u0435\u0431\u044f \u043d\u0430 \u0441\u0435\u0442\u0438. \u041c\u044b \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u043c \u043f\u043e\u0447\u0442\u0438 \u0441\u043e \u0432\u0441\u0435\u043c\u0438 \u0432\u0435\u043d\u0434\u043e\u0440\u0430\u043c\u0438, \u0438 \u0437\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043b\u0435\u0442 \u0432 \u043d\u0430\u0448\u0435\u0439 \u043b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u044f \u0443\u0441\u043f\u0435\u043b \u043f\u043e\u043a\u043e\u043f\u0430\u0442\u044c\u0441\u044f \u0432 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0435 \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u043a\u0440\u0443\u043f\u043d\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":95433,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-95432","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Analiza celui mai accesibil dintre SD-WAN: arhitectura, configurarea, administrarea \u0219i capcanele ascunse | ProHoster","description":"Judec\u00e2nd dup\u0103 num\u0103rul de \u00eentreb\u0103ri pe care le-am \u00eenceput s\u0103 le primim cu privire la SD-WAN, tehnologia a \u00eenceput s\u0103 prind\u0103 av\u00e2nt \u00een Rusia.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/razbor-samogo-demokratichnogo-iz-sd-wan-arhitektura-nastrojka-administrirovanie-i-podvodnye-kamni","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0430\u0437\u0431\u043e\u0440 \u0441\u0430\u043c\u043e\u0433\u043e \u0434\u0435\u043c\u043e\u043a\u0440\u0430\u0442\u0438\u0447\u043d\u043e\u0433\u043e \u0438\u0437 SD-WAN: \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0430, \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430, \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0438 \u043f\u043e\u0434\u0432\u043e\u0434\u043d\u044b\u0435 \u043a\u0430\u043c\u043d\u0438 | ProHoster","og:description":"\u0421\u0443\u0434\u044f \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u0432\u043e\u043f\u0440\u043e\u0441\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0430\u043c \u0441\u0442\u0430\u043b\u0438 \u043f\u0440\u0438\u043b\u0435\u0442\u0430\u0442\u044c \u043f\u043e SD-WAN, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f \u043d\u0430\u0447\u0430\u043b\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u0440\u0438\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0432 \u0420\u043e\u0441\u0441\u0438\u0438.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/razbor-samogo-demokratichnogo-iz-sd-wan-arhitektura-nastrojka-administrirovanie-i-podvodnye-kamni","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-29T05:42:38+00:00","article:modified_time":"2020-09-29T05:42:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"95432","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:05:30","updated":"2026-02-04 14:42:07","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/95432","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=95432"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/95432\/revisions"}],"predecessor-version":[{"id":156763,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/95432\/revisions\/156763"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/95433"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=95432"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=95432"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=95432"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}