{"id":32137,"date":"2019-10-31T21:45:21","date_gmt":"2019-10-31T18:45:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/nastrojka-ipsec-site-to-site-vpn-na-oborudovanii-palo-alto-networks\/"},"modified":"2019-10-31T21:45:21","modified_gmt":"2019-10-31T18:45:21","slug":"nastrojka-ipsec-site-to-site-vpn-na-oborudovanii-palo-alto-networks","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/nastrojka-ipsec-site-to-site-vpn-na-oborudovanii-palo-alto-networks","title":{"rendered":"Nastavenie IPSec Site-to-Site VPN na zariaden\u00ed Palo Alto Networks","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Nastavenie
\n
\nTento \u010dl\u00e1nok predstavuje pokra\u010dovanie predch\u00e1dzaj\u00faceho materi\u00e1lu<\/a><\/noindex>, ktor\u00fd sa zaoberal \u0161pecifikami konfigur\u00e1cie zariaden\u00ed Palo Alto Networks <\/b>. Tu chceme prerozpr\u00e1va\u0165 nastavenie IPSec Site-to-Site VPN<\/b> na zariadeniach Palo Alto Networks<\/b> a o mo\u017enom variante konfigur\u00e1cie pripojenia nieko\u013ek\u00fdch internetov\u00fdch poskytovate\u013eov.
\n<\/a><\/noindex>
\nNa demon\u0161tr\u00e1ciu sa pou\u017eije \u0161tandardn\u00e1 sch\u00e9ma pripojenia centr\u00e1lneho \u00faradu k pobo\u010dke. Aby sa zabezpe\u010dilo spo\u013eahliv\u00e9 internetov\u00e9 pripojenie, v centr\u00e1lnom \u00farade sa vyu\u017e\u00edva s\u00fa\u010dasn\u00e9 pripojenie dvoch poskytovate\u013eov: ISP-1 a ISP-2. Pobo\u010dka m\u00e1 pripojenie iba k jedn\u00e9mu poskytovate\u013eovi, ISP-3. Medzi firewally PA-1 a PA-2 je vybudovan\u00fdch dva tunely. Tunely pracuj\u00fa v re\u017eime Active-Standby<\/b>, Tunnel-1 je akt\u00edvny, Tunnel-2 za\u010dne pren\u00e1\u0161a\u0165 prenosy pri v\u00fdpadku Tunnel-1. Tunnel-1 vyu\u017e\u00edva pripojenie k internetov\u00e9mu poskytovate\u013eovi ISP-1, Tunnel-2 vyu\u017e\u00edva pripojenie k internetov\u00e9mu poskytovate\u013eovi ISP-2. V\u0161etky IP adresy s\u00fa generovan\u00e9 n\u00e1hodne na \u00fa\u010dely demon\u0161tr\u00e1cie a nemaj\u00fa \u017eiadny vz\u0165ah k realite.<\/p>\n

\"Nastavenie
\n
\nNa vybudovanie Site-to-Site VPN sa pou\u017eije IPSec<\/b> \u2014 s\u00fabor protokolov na zabezpe\u010denie ochrany \u00fadajov pren\u00e1\u0161an\u00fdch prostredn\u00edctvom protokolu IP. IPSec <\/b>bude fungova\u0165 s pou\u017eit\u00edm zabezpe\u010dovacieho protokolu ESP <\/b>(Encapsulating Security Payload), \u010do zabezpe\u010d\u00ed \u0161ifrovanie pren\u00e1\u0161an\u00fdch \u00fadajov.<\/p>\n

V IPSec <\/b>sa zap\u00e1ja IKE <\/b>(Internet Key Exchange) \u2014 protokol, ktor\u00fd zodpoved\u00e1 za dohodu SA (bezpe\u010dnostn\u00e9 asoci\u00e1cie), parametrov bezpe\u010dnosti, ktor\u00e9 sa pou\u017e\u00edvaj\u00fa na ochranu pren\u00e1\u0161an\u00fdch \u00fadajov. Firewally PAN podporuj\u00fa IKEv1 <\/b>a IKEv2<\/b>.<\/p>\n

V IKEv1 <\/b>VPN sa vytv\u00e1ra v dvoch f\u00e1zach: IKEv1 F\u00e1za 1 <\/b>(IKE tunel) a IKEv1 F\u00e1za 2<\/b> (IPSec tunel), \u010d\u00edm sa vytv\u00e1raj\u00fa dva tunely, z ktor\u00fdch jeden sl\u00fa\u017ei na v\u00fdmenu servisn\u00fdch inform\u00e1ci\u00ed medzi firewally, druh\u00fd \u2014 na prenos prenosu. V IKEv1 F\u00e1za 1<\/b> existuj\u00fa dva re\u017eimy prev\u00e1dzky \u2014 main mode a aggressive mode. Aggressive mode pou\u017e\u00edva menej spr\u00e1v a funguje r\u00fdchlej\u0161ie, ale nepodporuje ochranu identity partnera.<\/p>\n

IKEv2 <\/b>nahradil IKEv1<\/b>, a v porovnan\u00ed s IKEv1<\/b> je jeho hlavnou v\u00fdhodou \u2014 men\u0161ie po\u017eiadavky na \u0161\u00edrku p\u00e1sma a r\u00fdchlej\u0161ie dohodnutie SA. V IKEv2<\/b> sa pou\u017e\u00edva menej servisn\u00fdch spr\u00e1v (celkom 4), podporuje protokol EAP, MOBIKE a bol pridan\u00fd mechanizmus kontroly dostupnosti partnera, s ktor\u00fdm sa vytv\u00e1ra tunel \u2014 Liveness Check<\/b>, nahr\u00e1dzaj\u00faci Dead Peer Detection v IKEv1. Ak kontrola neprebehne, tak IKEv2 <\/b>m\u00f4\u017ee resetova\u0165 tunel a potom ho automaticky obnovi\u0165 pri prvej pr\u00edle\u017eitosti. Podrobnej\u0161ie o rozdieloch sa m\u00f4\u017eete pre\u010d\u00edta\u0165 tu<\/a><\/noindex>.<\/p>\n

Ak sa tunel vytv\u00e1ra medzi firewallmi od r\u00f4znych v\u00fdrobcov, m\u00f4\u017eu sa vyskytn\u00fa\u0165 chyby v implement\u00e1cii IKEv2<\/b>, a pre kompatibilitu s tak\u00fdmto zariaden\u00edm je mo\u017en\u00e9 pou\u017ei\u0165 IKEv1<\/b>. V ostatn\u00fdch pr\u00edpadoch je lep\u0161ie pou\u017ei\u0165 IKEv2<\/b>.<\/p>\n

F\u00e1zy nastavenia:<\/p>\n

\u2022 Nastavenie dvoch poskytovate\u013eov internetu v re\u017eime ActiveStandby<\/b><\/p>\n

Existuje nieko\u013eko sp\u00f4sobov, ako implementova\u0165 t\u00fato funkciu. Jedn\u00fdm z nich je pou\u017eitie mechanizmu Path Monitoring<\/b>, ktor\u00fd je dostupn\u00fd od verzie PAN-OS 8.0.0<\/b>. V tomto pr\u00edklade sa pou\u017e\u00edva verzia 8.0.16. T\u00e1to funkcia je podobn\u00e1 IP SLA na routeroch Cisco. V parametri statickej predvolenej trasy sa nastavuje odosielanie ping paketov na konkr\u00e9tnu IP adresu z ur\u010ditej zdrojovej adresy. V tomto pr\u00edpade rozhranie ethernet1\/1 pingne predvolen\u00fd br\u00e1nu raz za sekundu. Ak tri po sebe id\u00face pings nedostan\u00fa odpove\u010f, trasa sa pova\u017euje za nefunk\u010dn\u00fa a odstr\u00e1ni sa z routovacej tabu\u013eky. Rovnako sa nastav\u00ed trasa smerom k druh\u00e9mu poskytovate\u013eovi internetu, ale s v\u00e4\u010d\u0161ou metrikou (je z\u00e1lo\u017en\u00e1). Hne\u010f ako sa prv\u00e1 trasa odstr\u00e1ni z tabu\u013eky, firewall za\u010dne odosiela\u0165 dopravu po druhej trase \u2014 Fail-Over<\/b>. Ke\u010f prv\u00fd poskytovate\u013e za\u010dne odpoveda\u0165 na pings, jeho trasa sa vr\u00e1ti do tabu\u013eky a nahrad\u00ed druh\u00fa kv\u00f4li lep\u0161ej metrike \u2014 Fail-Back<\/b>. Proces Fail-Over<\/b> trv\u00e1 nieko\u013eko sek\u00fand v z\u00e1vislosti od nastaven\u00fdch intervalov, ale v ka\u017edom pr\u00edpade proces nie je okam\u017eit\u00fd a v tomto \u010dase sa strata dopravy. Fail-Back<\/b> prebieha bez straty dopravy. Existuje mo\u017enos\u0165 urobi\u0165 to Fail-Over<\/b> r\u00fdchlej\u0161ie pomocou BFD<\/b>, ak to poskytovate\u013e internetu poskytne. BFD <\/b>podporuje sa od modelu PA-3000 Series<\/b> a VM-100<\/b>. Ako adresu pre ping je lep\u0161ie uvies\u0165 nie br\u00e1nu poskytovate\u013ea, ale verejn\u00fa, v\u017edy dostupn\u00fa internetov\u00fa adresu.<\/p>\n

\"Nastavenie
\n
\n\u2022 Vytvorenie tunelov\u00e9ho rozhrania<\/b><\/p>\n

Doprava vn\u00fatri tunela sa pren\u00e1\u0161a cez \u0161peci\u00e1lne virtu\u00e1lne rozhrania. Na ka\u017edom z nich mus\u00ed by\u0165 nastaven\u00e1 IP adresa z tranzitnej siete. V tomto pr\u00edklade pre Tunnel-1 sa pou\u017eije podsiet 172.16.1.0\/30, a pre Tunnel-2 \u2014 podsiet 172.16.2.0\/30.
\nTunelov\u00e9 rozhranie sa vytv\u00e1ra v sekcii Network -> Interfaces -> Tunnel<\/b>Je potrebn\u00e9 zada\u0165 virtu\u00e1lny smerova\u010d a bezpe\u010dnostn\u00fa z\u00f3nu, ako aj IP adresu z pr\u00edslu\u0161nej prenosovej siete. \u010c\u00edslo rozhrania m\u00f4\u017ee by\u0165 ak\u00e9ko\u013evek.<\/p>\n

\"Nastavenie
\n
\n\"Nastavenie
\n
\nV sekcii Pokro\u010dil\u00e9 <\/b>je mo\u017en\u00e9 zada\u0165 Profil spr\u00e1vy<\/b>, ktor\u00fd povol\u00ed ping na tomto rozhran\u00ed, \u010do m\u00f4\u017ee by\u0165 u\u017eito\u010dn\u00e9 na testovanie.<\/p>\n

\"Nastavenie
\n
\n\u2022 Nastavenie profilu IKE<\/b><\/p>\n

Profil IKE<\/b> je zodpovedn\u00fd za prv\u00fa f\u00e1zu vytvorenia VPN spojenia, tu sa uv\u00e1dzaj\u00fa parametre tunela IKE F\u00e1za 1<\/b>. Profil sa vytv\u00e1ra v sekcii Sie\u0165 -> Profil siete -> IKE Crypto<\/b>. Je potrebn\u00e9 zada\u0165 algoritmus \u0161ifrovania, hashovania, skupinu Diffie-Hellman a dobu \u017eivotnosti k\u013e\u00fa\u010dov. V\u0161eobecne plat\u00ed, \u017ee \u010d\u00edm zlo\u017eitej\u0161ie s\u00fa algoritmy, t\u00fdm hor\u0161ia je v\u00fdkonnos\u0165, musia sa vybera\u0165 na z\u00e1klade konkr\u00e9tnych po\u017eiadaviek na bezpe\u010dnos\u0165. Av\u0161ak, je striktne neodpor\u00fa\u010dan\u00e9 pou\u017e\u00edva\u0165 skupinu Diffie-Hellman ni\u017e\u0161iu ako 14 na ochranu d\u00f4le\u017eit\u00fdch inform\u00e1ci\u00ed. To s\u00favis\u00ed s zranite\u013enos\u0165ou protokolu, ktor\u00fa je mo\u017en\u00e9 eliminova\u0165 len pou\u017eit\u00edm ve\u013ekosti modulov 2048 bitov a viac, alebo algoritmami eliptickej kryptografie, ktor\u00e9 sa pou\u017e\u00edvaj\u00fa v skupin\u00e1ch 19, 20, 21, 24. Tieto algoritmy maj\u00fa vy\u0161\u0161iu v\u00fdkonnos\u0165 v porovnan\u00ed s tradi\u010dnou kryptografiou. Viac inform\u00e1ci\u00ed tu<\/a><\/noindex>. A tu<\/a><\/noindex>.<\/p>\n

\"Nastavenie
\n
\n\u2022 Nastavenie profilu IPSec<\/b><\/p>\n

Druh\u00e1 f\u00e1za vytvorenia VPN spojenia \u2014 IPSec tunel. Parametre SA pre\u0148 sa nastavuj\u00fa v Sie\u0165 -> Profil siete -> Profil \u0161ifrovania IPSec<\/b>. Tu je potrebn\u00e9 zada\u0165 protokol IPSec \u2014 AH <\/b>alebo ESP<\/b>, ako aj parametre SA <\/b> \u2014 algoritmy hashovania, \u0161ifrovania, skupiny Diffie-Hellman a dobu \u017eivotnosti k\u013e\u00fa\u010dov. Parametre SA v IKE Crypto Profile a IPSec Crypto Profile sa nemusia zhodova\u0165.<\/p>\n

\"Nastavenie
\n
\n\u2022 Nastavenie br\u00e1ny IKE<\/b><\/p>\n

Br\u00e1na IKE<\/b> \u2014 je objekt, ktor\u00fd ozna\u010duje smerova\u010d alebo firewall, s ktor\u00fdm je budovan\u00fd VPN tunel. Pre ka\u017ed\u00fd tunel treba vytvori\u0165 svoj Br\u00e1na IKE<\/b>. V tomto pr\u00edpade sa vytv\u00e1raj\u00fa dva tunely, po jeden cez ka\u017ed\u00e9ho poskytovate\u013ea internetov\u00fdch slu\u017eieb. Uv\u00e1dza sa pr\u00edslu\u0161n\u00e9 odch\u00e1dzaj\u00face rozhranie a jeho IP adresa, IP adresa partnera a spolo\u010dn\u00fd k\u013e\u00fa\u010d. Ako alternat\u00edvu k spolo\u010dn\u00e9mu k\u013e\u00fa\u010du je mo\u017en\u00e9 pou\u017ei\u0165 certifik\u00e1ty.<\/p>\n

\"Nastavenie
\n
\nTu sa uv\u00e1dza predt\u00fdm vytvoren\u00fd Profil IKE Crypto<\/b>. Parametre druh\u00e9ho objektu Br\u00e1na IKE<\/b> s\u00fa podobn\u00e9, s v\u00fdnimkou IP adries. Ak je firewall Palo Alto Networks umiestnen\u00fd za NAT smerova\u010dom, je potrebn\u00e9 povoli\u0165 mechanizmus NAT Traversal<\/b>.<\/p>\n

\"Nastavenie
\n
\n\u2022 Nastavenie IPSec tunela<\/b><\/p>\n

IPSec tunel<\/b> je objekt, v ktorom s\u00fa uveden\u00e9 parametre IPSec tunela, ako nazna\u010duje n\u00e1zov. Tu je potrebn\u00e9 zada\u0165 tunelov\u00e9 rozhranie a predt\u00fdm vytvoren\u00e9 objekty Br\u00e1na IKE<\/b>, IPSec Crypto Profile<\/b>. Pre zabezpe\u010denie automatick\u00e9ho prechodu smerovania na z\u00e1lo\u017en\u00fd tunel je potrebn\u00e9 povoli\u0165 Tunnel Monitor<\/b>. Je to mechanizmus, ktor\u00fd kontroluje, \u010di je peer \u017eiv\u00fd pomocou ICMP prev\u00e1dzky. Ako cie\u013eov\u00fa adresu je potrebn\u00e9 zada\u0165 IP adresu tunelov\u00e9ho rozhrania peera, s ktor\u00fdm sa vytv\u00e1ra tunel. V profile s\u00fa uveden\u00e9 \u010dasova\u010de a akcie pri strate spojenia. Wait Recover<\/b> \u2013 \u010daka\u0165, k\u00fdm sa spojenie obnov\u00ed, Fail Over<\/b> \u2014 odosla\u0165 prev\u00e1dzku inou trasou, ak tak\u00e1 existuje. Nastavenie druh\u00e9ho tunela je plne analogick\u00e9, uv\u00e1dza sa druh\u00e9 tunelov\u00e9 rozhranie a IKE Gateway.<\/p>\n

\"Nastavenie
\n
\n\"Nastavenie
\n
\n\u2022 Nastavenie smerovania<\/b><\/p>\n

V tomto pr\u00edklade sa pou\u017e\u00edva statick\u00e9 smerovanie. Na firewall PA-1 je potrebn\u00e9, okrem dvoch predvo\u013ebov\u00fdch tr\u00e1s, uvies\u0165 dve trasy do podsiete 10.10.10.0\/24 v pobo\u010dke. Jedna trasa pou\u017e\u00edva Tunnel-1, druh\u00e1 Tunnel-2. Trasa cez Tunnel-1 je hlavn\u00e1, preto\u017ee m\u00e1 ni\u017e\u0161iu metriku. Mechanizmus Path Monitoring<\/b> pre tieto trasy nie je pou\u017eit\u00fd. Prepn\u00fa\u0165 zodpoved\u00e1 Tunnel Monitor<\/b>.<\/p>\n

\"Nastavenie
\n
\nPodobn\u00e9 trasy pre podsiet 192.168.30.0\/24 je potrebn\u00e9 nastavi\u0165 na PA-2.<\/p>\n

\"Nastavenie
\n
\n\u2022 Nastavenie sie\u0165ov\u00fdch pravidiel<\/b><\/p>\n

Na fungovanie tunela s\u00fa potrebn\u00e9 tri pravidl\u00e1:<\/p>\n

    \n
  1. Na fungovanie Path Monitor<\/b> je potrebn\u00e9 povoli\u0165 ICMP na vonkaj\u0161\u00edch rozhraniach.<\/li>\n
  2. Pre IPSec <\/b>povoli\u0165 aplik\u00e1cie ike <\/b>a ipsec <\/b>na vonkaj\u0161\u00edch rozhraniach.<\/li>\n
  3. Povoli\u0165 prev\u00e1dzku medzi vn\u00fatorn\u00fdmi podsietami a tunelov\u00fdmi rozhraniami.<\/li>\n<\/ol>\n

    \n\"Nastavenie
    \n
    \nZ\u00e1ver<\/b><\/p>\n

    V tomto \u010dl\u00e1nku sa zaober\u00e1me variantom nastavenia redundantn\u00e9ho internetov\u00e9ho pripojenia a Site-to-Site VPN<\/b>. D\u00fafame, \u017ee inform\u00e1cie boli u\u017eito\u010dn\u00e9 a \u010ditate\u013e z\u00edskal predstavu o technol\u00f3gi\u00e1ch pou\u017e\u00edvan\u00fdch v Palo Alto Networks<\/b>. Ak m\u00e1te ot\u00e1zky k nastaveniu a \u017eelania na t\u00e9my bud\u00facich \u010dl\u00e1nkov \u2014 p\u00ed\u0161te ich do koment\u00e1rov, radi na ne odpovieme.
    \n
    Zdroj:     habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u0414\u0430\u043d\u043d\u0430\u044f \u0441\u0442\u0430\u0442\u044c\u044f \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0435\u043d\u0438\u0435 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0433\u043e \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0430, \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u044f\u043c \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f Palo Alto Networks . \u0417\u0434\u0435\u0441\u044c \u043c\u044b \u0445\u043e\u0442\u0438\u043c \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u0442\u044c \u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 IPSec Site-to-Site VPN \u043d\u0430 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0438 Palo Alto Networks \u0438 \u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u043c \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u0435 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432. \u0414\u043b\u044f \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u0431\u0443\u0434\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u0430\u044f \u0441\u0445\u0435\u043c\u0430 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0433\u043e\u043b\u043e\u0432\u043d\u043e\u0433\u043e \u043e\u0444\u0438\u0441\u0430 \u043a \u0444\u0438\u043b\u0438\u0430\u043b\u0443. \u0414\u043b\u044f \u0442\u043e\u0433\u043e, \u0447\u0442\u043e\u0431\u044b \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0442\u044c \u043e\u0442\u043a\u0430\u0437\u043e\u0443\u0441\u0442\u043e\u0439\u0447\u0438\u0432\u043e\u0435 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435, \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23973,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-32137","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Nastavenie IPSec Site-to-Site VPN na zariadeniach Palo Alto Networks | ProHoster","description":"Tento \u010dl\u00e1nok.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/nastrojka-ipsec-site-to-site-vpn-na-oborudovanii-palo-alto-networks","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 IPSec Site-to-Site VPN \u043d\u0430 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0438 Palo Alto Networks | ProHoster","og:description":"\u0414\u0430\u043d\u043d\u0430\u044f \u0441\u0442\u0430\u0442\u044c\u044f.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/nastrojka-ipsec-site-to-site-vpn-na-oborudovanii-palo-alto-networks","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:45:21+00:00","article:modified_time":"2019-10-31T18:45:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"32137","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 09:27:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:04:40","updated":"2026-01-21 09:27:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/32137","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=32137"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/32137\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/23973"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=32137"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=32137"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=32137"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}