{"id":39415,"date":"2019-10-31T22:32:08","date_gmt":"2019-10-31T19:32:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/check-point-optimizatsiya-cpu-i-ram\/"},"modified":"2019-10-31T22:32:08","modified_gmt":"2019-10-31T19:32:08","slug":"check-point-optimizatsiya-cpu-i-ram","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/check-point-optimizatsiya-cpu-i-ram","title":{"rendered":"Check Point: optimaliz\u00e1cia CPU a RAM","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Check
\nAhojte, kolegovia! Dnes by som r\u00e1d prediskutoval ve\u013emi aktu\u00e1lnu t\u00e9mu pre mnoh\u00fdch administr\u00e1torov Check Point - \u201eOptimaliz\u00e1cia CPU a RAM\u201c. Nie je nezvy\u010dajn\u00e9, \u017ee br\u00e1na a\/alebo spr\u00e1va servera spotrebov\u00e1vaj\u00fa ne\u010dakane ve\u013ea t\u00fdchto zdrojov, a bolo by dobr\u00e9 pochopi\u0165, kam sa \u201estr\u00e1caj\u00fa\u201c a ako ich efekt\u00edvnej\u0161ie vyu\u017ei\u0165. <\/p>\n

1. Anal\u00fdza<\/h3>\n

\nNa anal\u00fdzu z\u00e1\u0165a\u017ee procesora je u\u017eito\u010dn\u00e9 pou\u017ei\u0165 nasleduj\u00face pr\u00edkazy, ktor\u00e9 sa zad\u00e1vaj\u00fa v expertnom re\u017eime:
\n<\/a><\/noindex>
\ntop<\/b> zobrazuje v\u0161etky procesy, mno\u017estvo spotreb\u00favan\u00fdch prostriedkov CPU a RAM v percent\u00e1ch, uptime, prioritu procesu a in\u00e9<\/a><\/noindex> v re\u00e1lnom \u010dase<\/i>a <\/p>\n

\"Check
\n
\ncpwd_admin list<\/b> demon Check Point WatchDog, ktor\u00fd zobrazuje v\u0161etky moduly appliances, ich PID, stav a po\u010det spusten\u00ed<\/i><\/p>\n

\"Check
\n
\ncpstat -f cpu os<\/b> vyu\u017eitie CPU, ich po\u010det a rozdelenie procesorov\u00e9ho \u010dasu v percent\u00e1ch<\/i><\/p>\n

\"Check
\n
\ncpstat -f memory os<\/b> vyu\u017eitie virtu\u00e1lnej RAM, ko\u013eko celkovej akt\u00edvnej, vo\u013enej RAM a in\u00e9<\/i><\/p>\n

\"Check
\n
\nSpr\u00e1vnym pozn\u00e1mkou bude, \u017ee v\u0161etky pr\u00edkazy cpstat je mo\u017en\u00e9 zobrazi\u0165 pomocou utilitky cpview<\/b>. Na to sta\u010d\u00ed zada\u0165 pr\u00edkaz cpview z ak\u00e9hoko\u013evek re\u017eimu v SSH rel\u00e1cii.<\/p>\n

\"Check
\n\"Check
\n
\nps auxwf<\/b> dlh\u00fd zoznam v\u0161etk\u00fdch procesov, ich ID, obsaden\u00fa virtu\u00e1lnu pam\u00e4\u0165 a pam\u00e4\u0165 v RAM, CPU<\/i><\/p>\n

\"Check
\n
\nIn\u00e1 vari\u00e1cia pr\u00edkazu: <\/p>\n

ps -aF<\/b> zobraz\u00ed najn\u00e1ro\u010dnej\u0161\u00ed proces<\/i><\/p>\n

\"Check
\n
\nfw ctl affinity -l -a<\/b> rozde\u013eovanie jadier pod r\u00f4zne in\u0161tancie firewallu, tj. technol\u00f3gia CoreXL<\/i><\/p>\n

\"Check
\n
\n fw ctl pstat<\/b> anal\u00fdza RAM a celkov\u00e9 ukazovatele pripojen\u00ed, cookies, NAT<\/i><\/p>\n

\"Check
\n
\nfree -m<\/b> buffer RAM<\/i><\/p>\n

\"Check
\n
\nSamostatnej pozornosti sa oplat\u00ed venova\u0165 pr\u00edkazu netsat <\/b>a jeho vari\u00e1ci\u00e1m. Napr\u00edklad, netstat -i<\/b> m\u00f4\u017ee pom\u00f4c\u0165 rie\u0161i\u0165 \u00falohu monitorovania vyrovn\u00e1vacej pam\u00e4te. Parameter, RX dropped packets (RX-DRP) v v\u00fdstupe tohto pr\u00edkazu zvy\u010dajne rastie s\u00e1m o sebe kv\u00f4li dropom nelegit\u00edmnych protokolov (IPv6, Bad \/ Unintended VLAN tags a in\u00e9). Av\u0161ak ak sa droppy vyskytuj\u00fa z in\u00e9ho d\u00f4vodu, je potrebn\u00e9 vyu\u017ei\u0165 tento \u010dl\u00e1nkom<\/a><\/noindex>, aby ste za\u010dali vy\u0161etrovanie a pochopili, pre\u010do tento sie\u0165ov\u00fd rozhranie zahadzuje pakety. Zisten\u00edm pr\u00ed\u010diny mo\u017eno tie\u017e optimalizova\u0165 pr\u00e1cu appliances.<\/p>\n

\"Check
\n
\nAk je povolen\u00fd blade Monitoring, je mo\u017en\u00e9 tieto \u00fadaje sledova\u0165 graficky v SmartConsole, kliknut\u00edm na objekt a v\u00fdberom polo\u017eky \u201eDevice & License Information\u201c. <\/p>\n

Na trval\u00e9 pou\u017e\u00edvanie blade Monitoring sa neodpor\u00fa\u010da, ale na jeden de\u0148 pre testovanie je to celkom v poriadku.<\/p>\n

\"Check
\n
\nNavy\u0161e je mo\u017en\u00e9 prida\u0165 viac parametrov na monitorovanie, jeden z nich je ve\u013emi u\u017eito\u010dn\u00fd \u2014 Bytes Throughput (priepustnos\u0165 appliances).<\/p>\n

\"Check
\n
\nAk existuje in\u00fd monitorovac\u00ed syst\u00e9m, napr\u00edklad bezplatn\u00fd Zabbix<\/a><\/noindex>, zalo\u017een\u00fd na SNMP, ten tie\u017e bude vyhovova\u0165 na identifik\u00e1ciu t\u00fdchto probl\u00e9mov.<\/p>\n

2. \"\u00danik\" RAM s \u010dasom<\/h3>\n

\n\u010casto sa objavuje ot\u00e1zka, \u017ee \u010dasom br\u00e1na alebo spr\u00e1vcovsk\u00fd server za\u010d\u00edna \u010doraz viac a viac spotrebov\u00e1va\u0165 RAM. Chcem v\u00e1s upokoji\u0165: to je norm\u00e1lny jav pre syst\u00e9my podobn\u00e9 Linuxu. <\/p>\n

Pozhliadnut\u00edm v\u00fdstupu pr\u00edkazov free -m<\/b> a cpstat -f memory os<\/b> na appliance z expertn\u00e9ho re\u017eimu sa daj\u00fa spo\u010d\u00edta\u0165 a pozrie\u0165 v\u0161etky parametre, ktor\u00e9 sa t\u00fdkaj\u00fa RAM.<\/p>\n

Pokia\u013e ide o dostupn\u00fa pam\u00e4\u0165 na br\u00e1ne v s\u00fa\u010dasnosti Vo\u013en\u00e1 pam\u00e4\u0165<\/b> + Pam\u00e4\u0165 buffera<\/b> + Cached Memory<\/b> = +-1.5 GB<\/b>, ako obvykle.<\/p>\n

Ako hovor\u00ed SR, \u010dasom sa br\u00e1na \/ spr\u00e1vcovsk\u00fd server optimalizuje a pou\u017e\u00edva \u010doraz viac pam\u00e4te, dosahuj\u00fac pribli\u017ene 80% vyu\u017eitia, a zastav\u00ed sa. M\u00f4\u017eete re\u0161tartova\u0165 zariadenie a ukazovate\u013e sa vr\u00e1ti sp\u00e4\u0165. 1.5 GB vo\u013enej RAM je pre br\u00e1nu ur\u010dite dostato\u010dn\u00e9 na plnenie v\u0161etk\u00fdch \u00faloh, a spr\u00e1va zriedka dosahuje tak\u00e9 prahov\u00e9 hodnoty.<\/p>\n

Taktie\u017e v\u00fdstupy uveden\u00fdch pr\u00edkazov uk\u00e1\u017eu, ko\u013eko m\u00e1te N\u00edzka pam\u00e4\u0165<\/b> (opera\u010dn\u00e1 pam\u00e4\u0165 v u\u017e\u00edvate\u013eskom priestore) a Vysok\u00e1 pam\u00e4\u0165<\/b> (opera\u010dn\u00e1 pam\u00e4\u0165 v jadre) pou\u017eit\u00fa.<\/p>\n

Procesy jadra (vr\u00e1tane akt\u00edvnych modulov, ako s\u00fa moduly jadra Check Point) pou\u017e\u00edvaj\u00fa iba n\u00edzku pam\u00e4\u0165. Av\u0161ak u\u017e\u00edvate\u013esk\u00e9 procesy m\u00f4\u017eu pou\u017e\u00edva\u0165 ako n\u00edzku, tak aj vysok\u00fa pam\u00e4\u0165. Navy\u0161e, n\u00edzka pam\u00e4\u0165 je pribli\u017ene rovn\u00e1 Celkov\u00e1 pam\u00e4\u0165<\/b>.<\/p>\n

Ob\u00e1va\u0165 sa treba len v pr\u00edpade, \u017ee sa v logoch za\u010dn\u00fa hromadi\u0165 chyby \"modules reboot or processes being killed to reclaim memory due to OOM (Out of memory)\"<\/b>. Vtedy je potrebn\u00e9 re\u0161tartova\u0165 br\u00e1nu a obr\u00e1ti\u0165 sa na podporu, ak re\u0161tart nepom\u00f4\u017ee.<\/p>\n

\u00dapln\u00fd popis n\u00e1jdete v sk99547 <\/a><\/noindex>a sk99593<\/a><\/noindex>.<\/p>\n

3. Optimaliz\u00e1cia<\/h3>\n

\nNi\u017e\u0161ie s\u00fa uveden\u00e9 ot\u00e1zky a odpovede na optimaliz\u00e1ciu CPU a RAM. Na tieto je potrebn\u00e9 \u00faprimne odpoveda\u0165 sam\u00e9mu sebe a po\u010d\u00fava\u0165 odpor\u00fa\u010dania.<\/p>\n

3.1. Bol appliance spr\u00e1vne vybran\u00fd? Bol realizovan\u00fd pilotn\u00fd projekt?<\/h4>\n

\nNapriek spr\u00e1vnemu sizing, sa sie\u0165 mohla jednoducho rozr\u00e1s\u0165 a toto vybavenie jednoducho nezvl\u00e1da za\u0165a\u017eenie. Druh\u00e1 mo\u017enos\u0165 je, \u017ee sizing ako tak\u00fd neexistoval.<\/p>\n

3.2. Je zapnut\u00e1 HTTPS inspekcia? Ak \u00e1no, je nastaven\u00e1 technol\u00f3gia pod\u013ea najlep\u0161\u00edch praktik? <\/h4>\n

\nObr\u00e1ti\u0165 sa na \u010dl\u00e1nok<\/a><\/noindex>, ak ste na\u0161\u00edm klientom, alebo na sk108202<\/a><\/noindex>.<\/p>\n

Poradie umiestnenia pravidiel v politike HTTPS inspekcie m\u00e1 ve\u013ek\u00fd v\u00fdznam pri optimaliz\u00e1cii otv\u00e1rania HTTPS str\u00e1nok.<\/p>\n

Odpor\u00fa\u010dan\u00e9 poradie umiestnenia pravidiel:<\/p>\n

    \n
  1. Pravidl\u00e1 bypass s kateg\u00f3riami \/ URL<\/li>\n
  2. Pravidl\u00e1 inspect s kateg\u00f3riami\/URL<\/li>\n
  3. Pravidl\u00e1 inspect pre v\u0161etky ostatn\u00e9 kateg\u00f3rie<\/li>\n<\/ol>\n

    \n\"Check
    \n
    \nPodobne ako pri firewallovej politike, Check Point h\u013ead\u00e1 zhodu pod\u013ea paketov zhora nadol, preto by mali by\u0165 bypass pravidl\u00e1 umiestnen\u00e9 na vrchu, aby br\u00e1na nemusela m\u00ed\u0148a\u0165 zdroje na spracovanie v\u0161etk\u00fdch pravidiel, ak je potrebn\u00e9 tento paket presko\u010di\u0165.<\/p>\n

    3.3 Pou\u017e\u00edvaj\u00fa sa objekty address-range?<\/h4>\n

    \nObjekty s rozsahom adries, napr\u00edklad sie\u0165 192.168.0.0-192.168.5.0, spotrebuj\u00fa podstatne viac RAM ne\u017e 5 sie\u0165ov\u00fdch objektov. Vo v\u0161eobecnosti sa pova\u017euje za dobrou praxou odstra\u0148ova\u0165 nepou\u017e\u00edvan\u00e9 objekty v SmartConsole, preto\u017ee pri ka\u017edom nasaden\u00ed politiky br\u00e1na a mana\u017e\u00e9rsky server m\u00ed\u0148aj\u00fa zdroje a, \u010do je d\u00f4le\u017eit\u00e9, \u010das na overenie a aplik\u00e1ciu politiky.<\/p>\n

    3.4. Ako je nastaven\u00e1 politika Threat Prevention? <\/h4>\n

    \nPredov\u0161etk\u00fdm, Check Point odpor\u00fa\u010da vy\u010dleni\u0165 IPS do samostatn\u00e9ho profilu a vytv\u00e1ra\u0165 osobitn\u00e9 pravidl\u00e1 pre tento blade. <\/p>\n

    Napr\u00edklad, administr\u00e1tor pova\u017euje za potrebn\u00e9 chr\u00e1ni\u0165 segment DMZ iba pomocou IPS. Preto, aby br\u00e1na nem\u00ed\u0148ala zdroje na spracovanie paketov in\u00fdmi blades, je potrebn\u00e9 vytvori\u0165 pravidlo presne pre tento segment s profilom, v ktorom je zapnut\u00e9 iba IPS.<\/p>\n

    Pokia\u013e ide o nastavenie profilov, odpor\u00fa\u010da sa nastavi\u0165 ho pod\u013ea osved\u010den\u00fdch postupov uveden\u00fdch v tomto dokumente<\/a><\/noindex>(strany 17-20).<\/p>\n

    3.5. Ko\u013eko podpisov v re\u017eime Detect je nastaven\u00fdch v IPS? <\/h4>\n

    \nOdpor\u00fa\u010da sa detailne prepracova\u0165 podpisy v tom zmysle, \u017ee by sa mali vypn\u00fa\u0165 nepou\u017e\u00edvan\u00e9 (napr\u00edklad podpisy na zranite\u013enosti produktov Adobe vy\u017eaduj\u00fa ve\u013ea v\u00fdpo\u010dtov\u00e9ho v\u00fdkonu, a ak z\u00e1kazn\u00edk tak\u00e9to produkty nem\u00e1, m\u00e1 zmysel ich vypn\u00fa\u0165). \u010ealej je vhodn\u00e9 nastavi\u0165 Prevent namiesto Detect tam, kde je to mo\u017en\u00e9, preto\u017ee br\u00e1na m\u00ed\u0148a zdroje na spracovanie celej spojenia v re\u017eime Detect, v re\u017eime Prevent hne\u010f odmietne spojenie a nem\u00ed\u0148a zdroje na \u00fapln\u00e9 spracovanie paketu.<\/p>\n

    3.6. Ak\u00e9 s\u00faboru spracov\u00e1vaj\u00fa blades Threat Emulation, Threat Extraction, Anti-Virus?<\/h4>\n

    \nNem\u00e1 zmysel emulova\u0165 a analyzova\u0165 s\u00fabory s pr\u00edponami, ktor\u00e9 si va\u0161i pou\u017e\u00edvatelia nestiahnu, alebo ich pova\u017eujete za nepotrebn\u00e9 vo va\u0161ej sieti (napr\u00edklad, bat a exe s\u00fabory je mo\u017en\u00e9 \u013eahko zablokova\u0165 pomocou blesh Content Awareness na \u00farovni firewallu, tak\u017ee zdroje zariadenia bud\u00fa vy\u017eadova\u0165 menej). Navy\u0161e, v nastaveniach Threat Emulation m\u00f4\u017eete vybra\u0165 Environment (opera\u010dn\u00fd syst\u00e9m) na emul\u00e1ciu hrozieb v pieskovisku, a nastavi\u0165 Environment Windows 7, ke\u010f v\u0161etci pou\u017e\u00edvatelia pracuj\u00fa s verziou 10, tie\u017e nem\u00e1 zmysel.<\/p>\n

    3.7. S\u00fa pravidl\u00e1 firewallu a pravidl\u00e1 na \u00farovni aplik\u00e1cie umiestnen\u00e9 v s\u00falade s best practices? <\/h4>\n

    \nAk m\u00e1 pravidlo ve\u013ea hitov (zhod), odpor\u00fa\u010da sa umiestni\u0165 ich na vrchol, zatia\u013e \u010do pravidl\u00e1 s mal\u00fdm po\u010dtom hitov by mali by\u0165 na spodku. Hlavn\u00e9 je dba\u0165 na to, aby sa navz\u00e1jom nekryli a neprekr\u00fdvali. Odpor\u00fa\u010dan\u00e1 architekt\u00fara pravidiel firewallu je:<\/p>\n

    \"Check
    \n
    \nVysvetlenia: <\/p>\n

    First Rules \u2014 sem sa umiest\u0148uj\u00fa pravidl\u00e1 s najv\u00e4\u010d\u0161\u00edm po\u010dtom zh\u00f4d
    \nNoise Rule \u2014 pravidlo na odstr\u00e1nenie parazitn\u00e9ho trafi\u010den\u00ed, ako je NetBIOS
    \nStealth Rule \u2014 z\u00e1kaz pr\u00edstupov k br\u00e1nam a mana\u017ementom pre v\u0161etk\u00fdch okrem t\u00fdch zdrojov, ktor\u00e9 boli uveden\u00e9 v pravidl\u00e1ch Authentication to Gateway Rules
    \nClean-Up, Last a Drop Rules sa zvy\u010dajne kombinuj\u00fa do jedn\u00e9ho pravidla na z\u00e1kaz v\u0161etk\u00e9ho, \u010do nebolo predt\u00fdm povolen\u00e9<\/p>\n

    Tieto best practices s\u00fa op\u00edsan\u00e9 v sk106597<\/a><\/noindex>.<\/p>\n

    3.8. Ak\u00e9 nastavenia s\u00fa pri vytvoren\u00fdch slu\u017eb\u00e1ch spr\u00e1vcami? <\/h4>\n

    \nNapr\u00edklad, ak sa vytv\u00e1ra nejak\u00e1 TCP slu\u017eba na konkr\u00e9tnom porte, m\u00e1 zmysel v Advanced nastaveniach slu\u017eby zru\u0161i\u0165 za\u010diarknutie \u201cMatch for Any\u201d. V tomto pr\u00edpade sa t\u00e1to slu\u017eba dostane konkr\u00e9tne pod pravidlo, v ktorom je uveden\u00e1, a nebude sa z\u00fa\u010dast\u0148ova\u0165 v pravidl\u00e1ch, kde je v st\u013apci Slu\u017eby uveden\u00e9 Any.<\/p>\n

    \"Check
    \n
    \nPokia\u013e ide o slu\u017eby, stoj\u00ed za to spomen\u00fa\u0165, \u017ee niekedy m\u00f4\u017ee by\u0165 potrebn\u00e9 jemne doladi\u0165 \u010dasov\u00e9 limity. Toto nastavenie umo\u017en\u00ed rozumnej\u0161ie vyu\u017e\u00edva\u0165 zdroje br\u00e1ny, aby sa neudr\u017eiavali zbyto\u010dne dlh\u00e9 TCP\/UDP rel\u00e1cie pre protokoly, ktor\u00e9 nepotrebuj\u00fa dlh\u00e9 \u010dasov\u00e9 limity. Napr\u00edklad, na obr\u00e1zku ni\u017e\u0161ie, som presunul \u010dasov\u00fd limit slu\u017ebe domain-udp zo 40 sek\u00fand na 30 sek\u00fand.<\/p>\n

    \"Check
    \n<\/p>\n

    3.9. Je pou\u017e\u00edvan\u00fd SecureXL a ak\u00fd je percentu\u00e1lny v\u00fdkonov\u00fd n\u00e1rast? <\/h4>\n

    \nKvalitu pr\u00e1ce SecureXL m\u00f4\u017eete skontrolova\u0165 pomocou hlavn\u00fdch pr\u00edkazov v expertnom re\u017eime na br\u00e1ne. fwaccel stat<\/b> a fw accel stats -s<\/b>. Potom je potrebn\u00e9 presk\u00fama\u0165, ak\u00fd typ trafiku je ur\u00fdchlen\u00fd, a ak\u00e9 \u0161abl\u00f3ny (templates) m\u00f4\u017eeme e\u0161te vytvori\u0165. <\/p>\n

    Predvolen\u00e9 Drop Templates nie s\u00fa zapnut\u00e9, ich aktiv\u00e1cia pozit\u00edvne ovplyvn\u00ed v\u00fdkon SecureXL. Na to sa prihl\u00e1ste do nastaven\u00ed br\u00e1ny a prejdite na kartu Optimaliz\u00e1cie:<\/p>\n

    \"Check
    \n
    \nTie\u017e pri pr\u00e1ci s klastrom na optimaliz\u00e1ciu CPU m\u00f4\u017eete vypn\u00fa\u0165 synchroniz\u00e1ciu nekritick\u00fdch slu\u017eieb, ako s\u00fa UDP DNS, ICMP a \u010fal\u0161ie. Na to prejdite do nastaven\u00ed slu\u017eby \u2192 Roz\u0161\u00edren\u00e9 \u2192 Synchroniz\u00e1cia pripojen\u00ed je povolen\u00e1 na klietke.<\/p>\n

    \"Check
    \n
    \nV\u0161etky Best Practice s\u00fa pop\u00edsan\u00e9 v     sk98348<\/a><\/noindex>.<\/p>\n

    3.10. Ako sa pou\u017e\u00edva CoreXL? <\/h4>\n

    \nTechnol\u00f3gia CoreXL, ktor\u00e1 umo\u017e\u0148uje vyu\u017eitie viacer\u00fdch CPU pre firewall instances (moduly firewallu), jednozna\u010dne pom\u00e1ha optimalizova\u0165 v\u00fdkon zariadenia. Najprv pr\u00edkaz fw ctl affinity -l -a <\/b>zobraz\u00ed pou\u017e\u00edvan\u00e9 firewall instances a procesory pridelen\u00e9 pre SND (modul, ktor\u00fd distribuuje prenos na firewallov\u00e9 entity). Ak nie s\u00fa v\u0161etky procesory nasaden\u00e9, m\u00f4\u017eete ich prida\u0165 pr\u00edkazom cpconfig <\/b>na br\u00e1ne.
    \nTie\u017e je dobr\u00fd n\u00e1pad nain\u0161talova\u0165     hotfix <\/a><\/noindex>na aktiv\u00e1ciu Multi-Queue. Multi-Queue rie\u0161i probl\u00e9m, ke\u010f je procesor s SND vyu\u017e\u00edvan\u00fd na vysok\u00e9 percento, zatia\u013e \u010do firewall instances na in\u00fdch procesoroch s\u00fa ne\u010dinn\u00e9. Potom by SND mohol vytv\u00e1ra\u0165 viacero front pre jedno NIC a nastavova\u0165 r\u00f4zne priority pre r\u00f4zny prenos na \u00farovni jadra. T\u00fdm p\u00e1dom by sa procesory CPU pou\u017e\u00edvali efekt\u00edvnej\u0161ie. Met\u00f3dy s\u00fa tie\u017e pop\u00edsan\u00e9 v sk98348<\/a><\/noindex>.<\/p>\n

    Na z\u00e1ver by som chcel poveda\u0165, \u017ee to nie s\u00fa v\u0161etky Best Practices na optimaliz\u00e1ciu pr\u00e1ce Check Point, ale s\u00fa to najpopul\u00e1rnej\u0161ie. Ak m\u00e1te z\u00e1ujem o audit va\u0161ej bezpe\u010dnostnej politiky alebo chcete vyrie\u0161i\u0165 probl\u00e9m s\u00favisiaci s Check Pointom, pros\u00edm, kontaktujte n\u00e1s na sales@tssolution.ru. <\/p>\n

    \u010eakujem za pozornos\u0165!
    \n
    Zdroj:     habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u0417\u0434\u0440\u0430\u0432\u0441\u0442\u0432\u0443\u0439\u0442\u0435, \u043a\u043e\u043b\u043b\u0435\u0433\u0438! \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u044f \u0445\u043e\u0442\u0435\u043b \u0431\u044b \u043e\u0431\u0441\u0443\u0434\u0438\u0442\u044c \u043e\u0447\u0435\u043d\u044c \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0443\u044e \u0434\u043b\u044f \u043c\u043d\u043e\u0433\u0438\u0445 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 Check Point \u0442\u0435\u043c\u0443 \u00ab\u041e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u044f CPU \u0438 RAM\u00bb. \u041d\u0435\u0440\u0435\u0434\u043a\u0438 \u0441\u043b\u0443\u0447\u0430\u0438, \u043a\u043e\u0433\u0434\u0430 \u0448\u043b\u044e\u0437 \u0438\/\u0438\u043b\u0438 \u043c\u0435\u043d\u0435\u0434\u0436\u043c\u0435\u043d\u0442 \u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u043e\u0442\u0440\u0435\u0431\u043b\u044f\u044e\u0442 \u043d\u0435\u043e\u0436\u0438\u0434\u0430\u043d\u043d\u043e \u043c\u043d\u043e\u0433\u043e \u044d\u0442\u0438\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432, \u0438 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c \u0431\u044b \u043f\u043e\u043d\u044f\u0442\u044c, \u043a\u0443\u0434\u0430 \u043e\u043d\u0438 \u201c\u0443\u0442\u0435\u043a\u0430\u044e\u0442\u201d, \u0438 \u043f\u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0433\u0440\u0430\u043c\u043e\u0442\u043d\u0435\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u0445. 1. \u0410\u043d\u0430\u043b\u0438\u0437 \u0414\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430 \u043f\u043e\u043b\u0435\u0437\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":39416,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-39415","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Check Point: optimaliz\u00e1cia CPU a RAM | ProHoster","description":"Ahojte kolegovia!","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/check-point-optimizatsiya-cpu-i-ram","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Check Point: \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u044f CPU \u0438 RAM | ProHoster","og:description":"\u0417\u0434\u0440\u0430\u0432\u0441\u0442\u0432\u0443\u0439\u0442\u0435, \u043a\u043e\u043b\u043b\u0435\u0433\u0438!","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/check-point-optimizatsiya-cpu-i-ram","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:32:08+00:00","article:modified_time":"2019-10-31T19:32:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"39415","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 01:55:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:50:24","updated":"2026-01-24 01:55:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/39415","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=39415"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/39415\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/39416"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=39415"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=39415"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=39415"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}