{"id":39000,"date":"2019-10-31T22:27:16","date_gmt":"2019-10-31T19:27:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/shifruemsya-po-gostu-pamyatka-po-nastrojke-dinamicheskoj-marshrutizatsii-trafika\/"},"modified":"2019-10-31T22:27:16","modified_gmt":"2019-10-31T19:27:16","slug":"shifruemsya-po-gostu-pamyatka-po-nastrojke-dinamicheskoj-marshrutizatsii-trafika","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/shifruemsya-po-gostu-pamyatka-po-nastrojke-dinamicheskoj-marshrutizatsii-trafika","title":{"rendered":"\u0160ifrujeme pod\u013ea GOSTu: pamiatka k nastaveniu dynamick\u00e9ho smerovania prev\u00e1dzky","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"\u0160ifrujeme
\nAk va\u0161a spolo\u010dnos\u0165 pren\u00e1\u0161a alebo prij\u00edma prostredn\u00edctvom siete osobn\u00e9 \u00fadaje a in\u00e9 d\u00f4vern\u00e9 inform\u00e1cie chr\u00e1nen\u00e9 z\u00e1konom, je potrebn\u00e9 aplikova\u0165 \u0161ifrovanie v s\u00falade s normou GOST. Dnes v\u00e1m predstav\u00edme, ako sme implementovali tak\u00e9to \u0161ifrovanie na b\u00e1ze kryptoserveru (K\u0160) S-Terra u jedn\u00e9ho z na\u0161ich klientov. Tento pr\u00edbeh bude zauj\u00edmav\u00fd pre odborn\u00edkov na informa\u010dn\u00fa bezpe\u010dnos\u0165, ako aj in\u017einierov, projektantov a architektov. Hlb\u0161ie sa do technick\u00fdch detailov konfigur\u00e1cie v tomto pr\u00edspevku nepust\u00edme \u2014 zameriame sa na k\u013e\u00fa\u010dov\u00e9 aspekty z\u00e1kladn\u00e9ho nastavenia. Obrovsk\u00e9 mno\u017estvo dokument\u00e1cie k nastaveniu demon\u0161tr\u00e1torov opera\u010dn\u00e9ho syst\u00e9mu Linux, na ktorom je zalo\u017een\u00fd K\u0160 S-Terra, je vo vo\u013enom pr\u00edstupe na internete. Dokument\u00e1cia k nastaveniu propriet\u00e1rneho softv\u00e9ru S-Terra je tie\u017e dostupn\u00e1 na port\u00e1li<\/a><\/noindex> v\u00fdrobcu.
\n<\/a><\/noindex><\/p>\n

Slovo o projekte <\/h2>\n

\nTopol\u00f3gia siete u klienta bola \u0161tandardn\u00e1 \u2014 full mesh medzi centrom a pobo\u010dkami. Bolo potrebn\u00e9 implementova\u0165 \u0161ifrovanie kan\u00e1lov na v\u00fdmenu inform\u00e1ci\u00ed medzi v\u0161etk\u00fdmi lokalitami, ktor\u00fdch bolo 8. <\/p>\n

Vo v\u00e4\u010d\u0161ine podobn\u00fdch projektov je v\u0161etko statick\u00e9: na kryptoserveroch (K\u0160) s\u00fa nastaven\u00e9 statick\u00e9 trasy do miestnej siete, definuj\u00fa sa zoznamy IP adries (ACL) pre \u0161ifrovanie. V tomto pr\u00edpade v\u0161ak lokality nemaj\u00fa centralizovan\u00e9 riadenie a v ich miestnych sie\u0165ach sa m\u00f4\u017ee dia\u0165 \u010doko\u013evek: siete m\u00f4\u017eu by\u0165 prid\u00e1van\u00e9, odstra\u0148ovan\u00e9 a r\u00f4zne modifikovan\u00e9. Aby sa predi\u0161lo prenastavovaniu smerovania a ACL na K\u0160 pri zmene adres\u00e1cie lok\u00e1lnych siet\u00ed na lokalit\u00e1ch, bolo rozhodnut\u00e9 pou\u017ei\u0165 GRE tunelovanie a dynamick\u00e9 smerovanie OSPF, do ktor\u00e9ho s\u00fa zahrnut\u00e9 v\u0161etky K\u0160 a v\u00e4\u010d\u0161ina smerova\u010dov v jadre siete na lokalit\u00e1ch (na niektor\u00fdch lokalit\u00e1ch administr\u00e1tori infra\u0161trukt\u00fary uprednostnili pou\u017e\u00edvanie SNAT smerom na K\u0160 na jadrov\u00fdch smerova\u010doch). <\/p>\n

GRE tunelovanie umo\u017enilo vyrie\u0161i\u0165 dve \u00falohy:
\n1.<\/b> Pou\u017ei\u0165 v ACL na \u0161ifrovanie IP adresu vonkaj\u0161ieho rozhrania K\u0160, v ktorom je encapsulovan\u00fd cel\u00fd traffic smeruj\u00faci na in\u00e9 lokality.
\n2.<\/b> Organizova\u0165 p-t-p tunely medzi K\u0160, ktor\u00e9 umo\u017e\u0148uj\u00fa nastavi\u0165 dynamick\u00e9 smerovanie (v na\u0161om pr\u00edpade je medzi lokalitami organizovan\u00fd poskytovate\u013esk\u00fd MPLS L3VPN).<\/p>\n

Z\u00e1kazn\u00edk si objednal implement\u00e1ciu \u0161ifrovania ako slu\u017ebu. Inak by musel nielen udr\u017eiava\u0165 kryptoprelivy alebo ich outsourcova\u0165 nejakej organiz\u00e1cii, ale aj samostatne sledova\u0165 \u017eivotn\u00fd cyklus \u0161ifrovac\u00edch certifik\u00e1tov, v\u010das ich predl\u017eova\u0165 a in\u0161talova\u0165 nov\u00e9.
\n\"\u0160ifrujeme
\nA teraz konkr\u00e9tne pripomienka \u2013 ako a \u010do sme nastavovali<\/p>\n

Subjektu kritickej informa\u010dnej infra\u0161trukt\u00fary na vedomie: nastavujeme kryptopreliv <\/h2>\n

<\/p>\n

Z\u00e1kladn\u00e9 nastavenie siete<\/h3>\n

\nPredov\u0161etk\u00fdm spust\u00edme nov\u00fd kryptopreliv a dostaneme sa do administr\u00e1torskej konzoly. Za\u010da\u0165 by sme mali zmenou hesla zabudovan\u00e9ho administr\u00e1tora \u2014 pr\u00edkaz change user password administrator<\/b>. Potom je potrebn\u00e9 vykona\u0165 proced\u00faru inicializ\u00e1cie (pr\u00edkaz initialize<\/b>) po\u010das ktorej sa zav\u00e1dzaj\u00fa licen\u010dn\u00e9 \u00fadaje a inicializuje sa gener\u00e1tor n\u00e1hodn\u00fdch \u010d\u00edsel (GNU).<\/p>\n

Pozor!<\/u><\/b> Pri inicializ\u00e1cii kryptoprelivu S-Terra sa nastavuje bezpe\u010dnostn\u00e1 politika, pri ktorej bezpe\u010dnostn\u00e9 rozhrania prelivu neprij\u00edmaj\u00fa pakety. Je nevyhnutn\u00e9 bu\u010f vytvori\u0165 vlastn\u00fa politiku, alebo pomocou pr\u00edkazu run csconf_mgr activate<\/b> vykona\u0165 aktiv\u00e1ciu predin\u0161talovanej povolenej politiky.
\n\u010ealej je potrebn\u00e9 nastavi\u0165 adres\u00e1ciu extern\u00fdch a intern\u00fdch rozhran\u00ed, ako aj predvolen\u00fa trasu. Pr\u00e1cu s konfigur\u00e1ciou siete kryptoprelivu a nastaven\u00edm \u0161ifrovania je vhodn\u00e9 vykon\u00e1va\u0165 cez konzolu podobn\u00fa Cisco. T\u00e1to konzola je ur\u010den\u00e1 na zad\u00e1vanie pr\u00edkazov, ktor\u00e9 s\u00fa podobn\u00e9 pr\u00edkazom Cisco IOS. Konfigur\u00e1cia vytvoren\u00e1 pomocou konzoly podobnej Cisco sa potom konvertuje do pr\u00edslu\u0161n\u00fdch konfigura\u010dn\u00fdch s\u00faborov, s ktor\u00fdmi pracuj\u00fa d\u00e9moni opera\u010dn\u00e9ho syst\u00e9mu. Prechod do konzoly podobnej Cisco z administr\u00e1torskej konzoly je mo\u017en\u00e9 vykona\u0165 pr\u00edkazom configure<\/b>.<\/p>\n

Zmen\u00edme hesl\u00e1 zabudovan\u00e9mu pou\u017e\u00edvate\u013eovi cscons a enable: <\/p>\n

>enable
\nHeslo: csp (predin\u0161talovan\u00e9)
\n#configure terminal
\n#username cscons privilege 15 secret 0 #enable secret 0 \u041d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c \u0431\u0430\u0437\u043e\u0432\u0443\u044e \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e:<\/p>\n

#interface GigabitEthernet0\/0
\n#ip address 10.111.21.3 255.255.255.0
\n#no shutdown
\n#interface GigabitEthernet0\/1
\n#ip address 192.168.2.5 255.255.255.252
\n#no shutdown
\n#ip route 0.0.0.0 0.0.0.0 10.111.21.254<\/p>\n

GRE<\/h3>\n

\nVyst\u00fapime z konzoly podobnej Cisco a prejdeme do debian shell pr\u00edkazom syst\u00e9m<\/b>. Nastav\u00edme vlastn\u00e9 heslo pre pou\u017e\u00edvate\u013ea root<\/b> pr\u00edkazom passwd<\/b>.
\nNa ka\u017edom kryptoprelive sa nastavuje samostatn\u00fd tunel pre ka\u017ed\u00fa lokalitu. Nastavenie tunelov\u00e9ho rozhrania sa vykon\u00e1va v s\u00fabore \/etc\/network\/interfaces<\/b>. Za vytvorenie samotn\u00e9ho rozhrania zodpoved\u00e1 utilita IP tunnel, ktor\u00e1 patr\u00ed do predin\u0161talovanej sady iproute2. Pr\u00edkaz na vytvorenie rozhrania sa zapisuje do mo\u017enosti pre-up.<\/p>\n

Pr\u00edklad konfigur\u00e1cie typick\u00e9ho tunelov\u00e9ho rozhrania:
\nauto site1
\niface site1 inet static
\naddress 192.168.1.4
\nnetmask 255.255.255.254
\npre-up ip tunnel add site1 mode gre local 10.111.21.3 remote 10.111.22.3 key hfLYEg^vCh6p<\/p>\n

Pozor!<\/u><\/b> Je potrebn\u00e9 poznamena\u0165, \u017ee nastavenia tunelov\u00fdch rozhran\u00ed by mali by\u0165 umiestnen\u00e9 mimo sekcie <\/p>\n

###netifcfg-begin###
\n*****
\n###netifcfg-end###<\/p>\n

V opa\u010dnom pr\u00edpade bud\u00fa tieto nastavenia zmazan\u00e9 pri zmene sie\u0165ov\u00fdch nastaven\u00ed fyzick\u00fdch rozhran\u00ed cez konzolu podobn\u00fa Cisco.<\/p>\n

Dynamick\u00e9 smerovanie<\/h3>\n

\nV S-Terra je dynamick\u00e9 smerovanie implementovan\u00e9 prostredn\u00edctvom bal\u00edka programov Quagga. Na konfigur\u00e1ciu OSPF budeme potrebova\u0165 povolenie a nastavenie d\u00e9monov zebra<\/b> a ospfd<\/b>. D\u00e9mon zebra zodpoved\u00e1 za interakciu medzi d\u00e9monmi smerovania a opera\u010dn\u00fdm syst\u00e9mom. D\u00e9mon ospfd, ako nazna\u010duje n\u00e1zov, zodpoved\u00e1 za implement\u00e1ciu protokolu OSPF.
\nNastavenie OSPF sa vykon\u00e1va bu\u010f prostredn\u00edctvom konzoly d\u00e9mona, alebo priamo cez konfigura\u010dn\u00fd s\u00fabor \/etc\/quagga\/ospfd.conf<\/b>. Do s\u00faboru sa prid\u00e1vaj\u00fa v\u0161etky fyzick\u00e9 a tunelov\u00e9 rozhrania z\u00fa\u010dast\u0148uj\u00face sa na dynamickom smerovan\u00ed, ako aj sa vyhlasuj\u00fa siete, ktor\u00e9 bud\u00fa ozn\u00e1men\u00e9 a prij\u00edma\u0165 ozn\u00e1menia.<\/p>\n

Pr\u00edklad konfigur\u00e1cie, ktor\u00fa je potrebn\u00e9 prida\u0165 do ospfd.conf<\/b>:
\ninterface eth0
\n!
\ninterface eth1
\n!
\ninterface site1
\n!
\ninterface site2
\nrouter ospf
\n ospf router-id 192.168.2.21
\n network 192.168.1.4\/31 area 0.0.0.0
\n network 192.168.1.16\/31 area 0.0.0.0
\n network 192.168.2.4\/30 area 0.0.0.0<\/p>\n

V tomto pr\u00edpade s\u00fa adresy 192.168.1.x\/31 vyhraden\u00e9 pre tunelov\u00e9 ptp-siete medzi lokalitami, adresy 192.168.2.x\/30 \u2014 pre tranzitn\u00e9 siete medzi K\u0160 a jadrov\u00fdmi smerova\u010dmi. <\/p>\n

Pozor!<\/b><\/u> Na zn\u00ed\u017eenie smerovac\u00edch tabuliek vo ve\u013ek\u00fdch in\u0161tal\u00e1ci\u00e1ch je mo\u017en\u00e9 filtrova\u0165 oznamovanie samotn\u00fdch tranzitn\u00fdch siet\u00ed pomocou kon\u0161trukci\u00ed no redistribute connected<\/b> alebo redistribute connected route-map<\/b>.<\/p>\n

Po nastaven\u00ed d\u00e9monov je potrebn\u00e9 zmeni\u0165 stav sp\u00fa\u0161\u0165ania d\u00e9monov v \/etc\/quagga\/daemons<\/b>. V mo\u017enostiach zebra<\/b> a ospfd<\/b> no opravi\u0165 na yes. Spusti\u0165 d\u00e9mon quagga a nastavi\u0165 jeho automatick\u00e9 sp\u00fa\u0161\u0165anie pri \u0161tarte K\u0160 pr\u00edkazom update-rc.d quagga enable<\/b>.<\/p>\n

Ak je nastavenie GRE-tunelov a OSPF vykonan\u00e9 spr\u00e1vne, mali by sa na K\u0160 a jadrov\u00fdch smerova\u010doch objavi\u0165 trasy v sieti ostatn\u00fdch lokal\u00edt, a t\u00fdm vznik\u00e1 sie\u0165ov\u00e1 konektivita medzi miestnymi sie\u0165ami.<\/p>\n

\u0160ifrujeme pren\u00e1\u0161an\u00fd traffic <\/h3>\n

\nAko u\u017e bolo nap\u00edsan\u00e9, obvykle pri \u0161ifrovan\u00ed medzi lokalitami uv\u00e1dzame rozsahy IP adries (ACL), medzi ktor\u00fdmi sa \u0161ifruje prev\u00e1dzka: ak sa zdrojov\u00e9 a cie\u013eov\u00e9 adresy nach\u00e1dzaj\u00fa v t\u00fdchto rozsahoch, prev\u00e1dzka medzi nimi sa \u0161ifruje. V tomto projekte je v\u0161ak \u0161trukt\u00fara dynamick\u00e1 a adresy sa m\u00f4\u017eu meni\u0165. Ke\u010f\u017ee sme u\u017e nastavili GRE tunelovanie, ako adresy zdroja a cie\u013ea pre \u0161ifrovanie prev\u00e1dzky m\u00f4\u017eeme uvies\u0165 extern\u00e9 adresy K\u0160 \u2013 ve\u010f na \u0161ifrovanie prich\u00e1dza prev\u00e1dzka, u\u017e zapuzdren\u00e1 protokolom GRE. In\u00fdmi slovami, \u0161ifruje sa v\u0161etko, \u010do prich\u00e1dza do K\u0160 z lok\u00e1lnej siete jednej lokality smerom k sie\u0165am, ktor\u00e9 boli ozn\u00e1men\u00e9 in\u00fdmi lokalitami. A u\u017e v r\u00e1mci ka\u017edej z lokal\u00edt m\u00f4\u017ee prebieha\u0165 ak\u00e9ko\u013evek presmerovanie. T\u00fdmto sp\u00f4sobom, pri ak\u00fdchko\u013evek zmen\u00e1ch v lok\u00e1lnych sie\u0165ach, sta\u010d\u00ed administr\u00e1torovi upravi\u0165 ozn\u00e1menia, ktor\u00e9 id\u00fa z jeho siete smerom k K\u0160, a stane sa dostupnou pre ostatn\u00e9 lokality.<\/p>\n

\u0160ifrovanie v K\u0160 S-Terra sa vykon\u00e1va prostredn\u00edctvom protokolu IPSec. Pou\u017e\u00edvame algoritmus \u201eKuznechik\u201c v s\u00falade s GOST R 34.12-2015, a pre kompatibilitu so star\u0161\u00edmi verziami je mo\u017en\u00e9 pou\u017ei\u0165 GOST 28147-89. Autentifik\u00e1cia m\u00f4\u017ee by\u0165 technicky vykonan\u00e1 bu\u010f na preddefinovan\u00fdch k\u013e\u00fa\u010doch (PSK), alebo na certifik\u00e1toch. Av\u0161ak v priemyselnej prev\u00e1dzke je potrebn\u00e9 pou\u017e\u00edva\u0165 certifik\u00e1ty vydan\u00e9 pod\u013ea GOST R 34.10-2012.<\/p>\n

Pr\u00e1ca so certifik\u00e1tmi, kontajnermi a CRL sa vykon\u00e1va pomocou utilitky cert_mgr<\/b>. Najprv pomocou pr\u00edkazu cert_mgr create<\/b> je potrebn\u00e9 vytvori\u0165 kontajner s\u00fakromn\u00e9ho k\u013e\u00fa\u010da a \u017eiados\u0165 o certifik\u00e1t, ktor\u00e1 bude zaslan\u00e1 do Centra spr\u00e1vy certifik\u00e1tov. Po obdr\u017ean\u00ed certifik\u00e1tu je potrebn\u00e9 ho spolu s kore\u0148ov\u00fdm certifik\u00e1tom UC a CRL (ak sa pou\u017e\u00edva) importova\u0165 pr\u00edkazom cert_mgr import<\/b>. Uisti\u0165 sa, \u017ee v\u0161etky certifik\u00e1ty a CRL boli nain\u0161talovan\u00e9, je mo\u017en\u00e9 pr\u00edkazom cert_mgr show<\/b>.<\/p>\n

. Po \u00faspe\u0161nej in\u0161tal\u00e1cii certifik\u00e1tov prech\u00e1dzame do Cisco-like konzoly na konfigur\u00e1ciu IPSec.
\nVytv\u00e1rame IKE politiku, v ktorej s\u00fa uveden\u00e9 po\u017eadovan\u00e9 algoritmy a parametre vytv\u00e1ran\u00e9ho zabezpe\u010den\u00e9ho kan\u00e1la, ktor\u00e9 bud\u00fa navrhnut\u00e9 partnerovi na dohodu. <\/p>\n

#crypto isakmp policy 1000
\n#encr gost341215k
\n#hash gost341112-512-tc26
\n#authentication sign
\n#group vko2
\n#lifetime 3600<\/p>\n

T\u00e1to politika sa uplat\u0148uje pri budovan\u00ed prvej f\u00e1zy IPSec. V\u00fdsledkom \u00faspe\u0161n\u00e9ho prechodu prvej f\u00e1zy je vytvorenie SA (Security Association).
\n\u010ealej je potrebn\u00e9 ur\u010di\u0165 zoznam IP adries zdroja a pr\u00edjemcu (ACL) pre \u0161ifrovanie, vytvori\u0165 sadu transform\u00e1ci\u00ed (transform set), vytvori\u0165 kryptografick\u00fa mapu (crypto map) a priradi\u0165 ju k vonkaj\u0161iemu rozhraniu K\u0160. <\/p>\n

Definujeme ACL:
\n#ip access-list extended site1
\n#permit gre host 10.111.21.3 host 10.111.22.3<\/p>\n

Sada transform\u00e1ci\u00ed (rovnako ako pre prv\u00fa f\u00e1zu, pou\u017eijeme \u0161ifrovac\u00ed algoritmus \u201eK\u00f4ra\u201c v re\u017eime generovania imita\u010dky):<\/p>\n

#crypto ipsec transform-set GOST esp-gost341215k-mac<\/p>\n

Vytv\u00e1rame kryptomapu, uv\u00e1dzame ACL, transform set a adresu p\u00e1ru:<\/p>\n

#crypto map MAIN 100 ipsec-isakmp
\n#match address site1
\n#set transform-set GOST
\n#set peer 10.111.22.3<\/p>\n

Prira\u010fujeme kryptomapu k vonkaj\u0161iemu rozhraniu K\u0160:<\/p>\n

#interface GigabitEthernet0\/0
\n#ip address 10.111.21.3 255.255.255.0
\n#crypto map MAIN<\/p>\n

Pre \u0161ifrovanie kan\u00e1lov s in\u00fdmi platformami je potrebn\u00e9 zopakova\u0165 postup vytvorenia ACL a kryptomapy, pri\u010dom zmen\u00edme n\u00e1zov ACL, IP adresy a \u010d\u00edslo kryptomapy.<\/p>\n

Pozor! <\/u><\/b>V pr\u00edpade, \u017ee sa nevyu\u017e\u00edva overovanie certifik\u00e1tov pomocou CRL, je to potrebn\u00e9 v\u00fdslovne uvies\u0165:<\/p>\n

#crypto pki trustpoint s-terra_technological_trustpoint
\n#revocation-check none<\/p>\n

Monitorujeme \u201ezdravie\u201c syst\u00e9mu<\/h2>\n

\nV K\u0160 S-Terra pre monitoring sa pou\u017e\u00edva \u0161tandardn\u00fd d\u00e9mon snmpd. Okrem typick\u00fdch parametrov pre Linux, S-Terra \u201ez krabice\u201c podporuje poskytovanie \u00fadajov o IPSec tuneloch pod\u013ea CISCO-IPSEC-FLOW-MONITOR-MIB, \u010do vyu\u017e\u00edvame na sledovanie stavu IPSec tunelov. Podporuje sa aj funkcia vlastn\u00fdch OID, ktor\u00e9 poskytuj\u00fa ako hodnoty v\u00fdsledky vykonania skriptu. T\u00e1to mo\u017enos\u0165 n\u00e1m umo\u017e\u0148uje sledova\u0165 lehoty vypr\u0161ania certifik\u00e1tov. Nap\u00edsan\u00fd skript parsuje v\u00fdstup pr\u00edkazu cert_mgr show<\/b> a v\u00fdsledkom je po\u010det dn\u00ed do vypr\u0161ania lok\u00e1lnych a kore\u0148ov\u00fdch certifik\u00e1tov. Tento postup je nenahradite\u013en\u00fd pri spr\u00e1ve ve\u013ek\u00e9ho po\u010dtu K\u0160.
\n\"\u0160ifrujeme
\n<\/p>\n

V \u010dom je podstata tohto \u0161ifrovania<\/h2>\n

\nCel\u00e1 v\u00fd\u0161e uveden\u00e1 funkcionalita je podporovan\u00e1 \u00about of the box\u00bb K\u0160 S-Terra. To znamen\u00e1, \u017ee nebolo potrebn\u00e9 in\u0161talova\u0165 \u017eiadne \u010fal\u0161ie moduly, ktor\u00e9 by mohli ovplyvni\u0165 certifik\u00e1ciu kryptogateways a akredit\u00e1ciu cel\u00e9ho informa\u010dn\u00e9ho syst\u00e9mu. Kan\u00e1ly medzi lokalitami m\u00f4\u017eu by\u0165 ak\u00e9ko\u013evek, aj cez internet. <\/p>\n

V\u010faka tomu, \u017ee pri zmene vn\u00fatornej infra\u0161trukt\u00fary nie je potrebn\u00e9 op\u00e4tovne nastavova\u0165 kryptogateways, syst\u00e9m funguje ako slu\u017eba<\/b>, \u010do je ve\u013emi v\u00fdhodn\u00e9 pre z\u00e1kazn\u00edka: svoje slu\u017eby (klientske a serverov\u00e9) m\u00f4\u017ee umiestni\u0165 na ak\u00fdchko\u013evek adres\u00e1ch, a v\u0161etky zmeny sa dynamicky prenes\u00fa medzi \u0161ifrovac\u00edm zariaden\u00edm. <\/p>\n

Nechybne, \u0161ifrovanie v d\u00f4sledku re\u017eijn\u00fdch n\u00e1kladov (overhead) ovplyv\u0148uje r\u00fdchlos\u0165 prenosu d\u00e1t, ale nepatrne \u2014 priepustnos\u0165 kan\u00e1la m\u00f4\u017ee klesn\u00fa\u0165 maxim\u00e1lne o 5\u201410 %. T\u00fdmto technol\u00f3gia bola testovan\u00e1 a preuk\u00e1zala dobr\u00e9 v\u00fdsledky aj na satelitn\u00fdch kan\u00e1loch, ktor\u00e9 s\u00fa pomerne nestabiln\u00e9 a maj\u00fa n\u00edzku priepustnos\u0165. <\/p>\n

Igor Vinokhodov, in\u017einier 2. l\u00ednie administr\u00e1cie \u00abRostelecom-Solar\u00bb<\/i>
\n
Zdroj: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0415\u0441\u043b\u0438 \u0432\u0430\u0448\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u0435\u0440\u0435\u0434\u0430\u0451\u0442 \u0438\u043b\u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u043f\u043e \u0441\u0435\u0442\u0438 \u043f\u0435\u0440\u0441\u0434\u0430\u043d\u043d\u044b\u0435 \u0438 \u0434\u0440\u0443\u0433\u0443\u044e \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e, \u043f\u043e\u0434\u043b\u0435\u0436\u0430\u0449\u0443\u044e \u0437\u0430\u0449\u0438\u0442\u0435 \u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0438 \u0441 \u0437\u0430\u043a\u043e\u043d\u043e\u0434\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e\u043c, \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e \u0413\u041e\u0421\u0422\u0443. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0435\u043c, \u043a\u0430\u043a \u0432\u043d\u0435\u0434\u0440\u0438\u043b\u0438 \u0442\u0430\u043a\u043e\u0435 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0430 \u0431\u0430\u0437\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0448\u043b\u044e\u0437\u0430 (\u041a\u0428) S-Terra \u0443 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u043e\u0432. \u042d\u0442\u0430 \u0438\u0441\u0442\u043e\u0440\u0438\u044f \u0431\u0443\u0434\u0435\u0442 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0430 \u0418\u0411-\u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0430\u043c, \u043f\u0440\u043e\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0430\u043c \u0438 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u043e\u0440\u0430\u043c. \u0413\u043b\u0443\u0431\u043e\u043a\u043e \u043f\u043e\u0433\u0440\u0443\u0436\u0430\u0442\u044c\u0441\u044f \u0432 \u043d\u044e\u0430\u043d\u0441\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":29260,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-39000","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u0160ifrujeme pod\u013ea GOST: pr\u00edru\u010dka na nastavenie dynamick\u00e9ho smerovania prev\u00e1dzky | ProHoster","description":"Ak va\u0161a spolo\u010dnos\u0165.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/shifruemsya-po-gostu-pamyatka-po-nastrojke-dinamicheskoj-marshrutizatsii-trafika","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0428\u0438\u0444\u0440\u0443\u0435\u043c\u0441\u044f \u043f\u043e \u0413\u041e\u0421\u0422\u0443: \u043f\u0430\u043c\u044f\u0442\u043a\u0430 \u043f\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 | ProHoster","og:description":"\u0415\u0441\u043b\u0438 \u0432\u0430\u0448\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/shifruemsya-po-gostu-pamyatka-po-nastrojke-dinamicheskoj-marshrutizatsii-trafika","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:27:16+00:00","article:modified_time":"2019-10-31T19:27:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"39000","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-04 15:17:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:58:40","updated":"2026-02-04 15:17:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/39000","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=39000"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/39000\/revisions"}],"predecessor-version":[{"id":156680,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/39000\/revisions\/156680"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/29260"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=39000"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=39000"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=39000"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

T\u00fdmto m\u00f4\u017eeme pova\u017eova\u0165 nastavenie za dokon\u010den\u00e9. Vo v\u00fdstupe pr\u00edkazov konzoly podobnej Cisco show crypto isakmp sa<\/b> a show crypto ipsec sa<\/b> by mali by\u0165 zobrazen\u00e9 vybudovan\u00e9 prv\u00e9 a druh\u00e9 f\u00e1zy IPSec. T\u00fato inform\u00e1ciu m\u00f4\u017eeme z\u00edska\u0165 aj pomocou pr\u00edkazu sa_mgr show<\/b>, vykonan\u00e9ho z debian shell. Vo v\u00fdstupe pr\u00edkazu cert_mgr show<\/b> by mali by\u0165 certifik\u00e1ty vzdialen\u00fdch platforiem. Stav tak\u00fdchto certifik\u00e1tov bude remote<\/b>. V pr\u00edpade, \u017ee tunely sa nevytv\u00e1raj\u00fa, je potrebn\u00e9 nahliadnu\u0165 do logu VPN<\/a>-slu\u017eby, ktor\u00e1 sa uchov\u00e1va v s\u00fabore \/var\/log\/cspvpngate.log<\/b>. Kompletn\u00fd zoznam logovac\u00edch s\u00faborov s popisom ich obsahu je uveden\u00fd v dokument\u00e1cii.<\/p>\n