{"id":89739,"date":"2020-07-26T01:42:18","date_gmt":"2020-07-25T23:42:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/2-ngfw-dlya-malogo-biznesa-raspakovka-i-nastrojka"},"modified":"2020-07-26T01:42:18","modified_gmt":"2020-07-25T23:42:18","slug":"2-ngfw-dlya-malogo-biznesa-raspakovka-i-nastrojka","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/2-ngfw-dlya-malogo-biznesa-raspakovka-i-nastrojka","title":{"rendered":"2. NGFW pre mal\u00e9 podniky. Rozbalenie a nastavenie","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"2. NGFW pre mal\u00e9 podniky. Rozbalenie a nastavenie\" src=\"\/wp-content\/uploads\/2020\/07\/b17e2b30240cfa92fa78ac24dbd126e2.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>Pokra\u010dujeme v cyklu \u010dl\u00e1nk\u016f o pr\u00e1ci s novou modelovou \u0159adou SMB CheckPoint, p\u0159ipom\u00edn\u00e1me, \u017ee jsme <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/510342\/\">prvej \u010dasti<\/a><\/noindex> popisovali vlastnosti a mo\u017enosti nov\u00fdch model\u016f, zp\u016fsoby spr\u00e1vy a administrace. Dnes se zam\u011b\u0159\u00edme na sc\u00e9n\u00e1\u0159 nasazen\u00ed vy\u0161\u0161\u00edho modelu s\u00e9rie: CheckPoint 1590 NGFW. P\u0159edlo\u017e\u00edme stru\u010dn\u00fd p\u0159ehled t\u00e9to \u010d\u00e1sti:<\/p>\n<p><\/p>\n<ol>\n<li>Rozbalen\u00ed vybaven\u00ed (popis sou\u010d\u00e1st\u00ed, fyzick\u00e9 a s\u00ed\u0165ov\u00e9 p\u0159ipojen\u00ed).<\/li>\n<li>Prvotn\u00ed inicializace za\u0159\u00edzen\u00ed.<\/li>\n<li>Prvn\u00ed nastaven\u00ed.<\/li>\n<li>Hodnocen\u00ed funk\u010dnosti. <\/li>\n<\/ol>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Rozbalen\u00ed vybaven\u00ed<\/h2>\n<p><\/p>\n<p>Spoznanie s vybaven\u00edm za\u010d\u00edna vytiahnut\u00edm vybavenia z krabice, rozobr\u00e1n\u00edm komponentov a in\u0161tal\u00e1ciou dielov, kliknite na spoiler, kde je stru\u010dne predstaven\u00fd proces<\/p>\n<p><\/p>\n<p>                        <b class=\"spoiler_title\">Dod\u00e1vka NGFW 1590<\/b><br \/>\n                        <img decoding=\"async\" alt=\"2. NGFW pre mal\u00e9 podniky. Rozbalenie a nastavenie\" src=\"\/wp-content\/uploads\/2020\/07\/868d20466d642d38d748058e9f33ae37.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p> Stru\u010dne o s\u00fa\u010dastiach:<\/p>\n<p><\/p>\n<ul>\n<li>NGFW 1590;<\/li>\n<li>Nap\u00e1jac\u00ed adapt\u00e9r;<\/li>\n<li>2 Wifi ant\u00e9ny (2.4 GHz a 5 GHz);<\/li>\n<li>2 LTE ant\u00e9ny;<\/li>\n<li>Bro\u017e\u00fary s dokument\u00e1ciou (stru\u010dn\u00fd sprievodca po prvotnom pripojen\u00ed, licen\u010dn\u00e1 dohoda at\u010f.)<\/li>\n<\/ul>\n<p>\nPokia\u013e ide o sie\u0165ov\u00e9 porty a rozhrania, tu s\u00fa v\u0161etky modern\u00e9 mo\u017enosti na prenos prev\u00e1dzky a vz\u00e1jomn\u00e9 p\u00f4sobenie, samostatne vy\u010dlenen\u00fd port pre DMZ z\u00f3nu, USB 3.0 na synchroniz\u00e1ciu s PC. <\/p>\n<p>\n<img decoding=\"async\" alt=\"2. NGFW pre mal\u00e9 podniky. Rozbalenie a nastavenie\" src=\"\/wp-content\/uploads\/2020\/07\/de1442162762a4c29dcff0d2badfcc3f.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>Verzia 1590 dostala nov\u00fd dizajn, modern\u00e9 mo\u017enosti pre bezdr\u00f4tov\u00e9 pripojenie a roz\u0161\u00edrenie pam\u00e4te: 2 sloty pre Micro\/Nano SIM na LTE. (o tejto mo\u017enosti pl\u00e1nujeme podrobne p\u00edsa\u0165 v jednej z nasleduj\u00facich na\u0161ich \u010dl\u00e1nkov cyklu venuj\u00faceho sa bezdr\u00f4tov\u00fdm pripojeniam); slot pre SD kartu.\n<\/p>\n<p><\/p>\n<p>Podrobn\u00fd o mo\u017enostiach 1590 NGFW a o in\u00fdch nov\u00fdch modeloch si m\u00f4\u017eete pre\u010d\u00edta\u0165 v <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/510342\/\">1. \u010dasti<\/a><\/noindex> cyklu \u010dl\u00e1nkov o rie\u0161eniach SMB CheckPoint. My sa v\u0161ak pust\u00edme do prvotnej inicializ\u00e1cie zariadenia. \n<\/p>\n<p><\/p>\n<h2>Prvotn\u00e1 inicializ\u00e1cia<\/h2>\n<p><\/p>\n<p>Na\u0161i st\u00e1ly \u010ditatelia by u\u017e mali by\u0165 informovan\u00ed, \u017ee v s\u00e9rii 1500 SMB je pou\u017eit\u00fd nov\u00fd opera\u010dn\u00fd syst\u00e9m 80.20 Embedded, ktor\u00fd zah\u0155\u0148a aktualizovan\u00e9 rozhranie a vylep\u0161en\u00e9 mo\u017enosti.\n<\/p>\n<p><\/p>\n<p>Aby ste mohli za\u010da\u0165 inicializ\u00e1ciu zariadenia, je potrebn\u00e9:\n<\/p>\n<p><\/p>\n<ol>\n<li>Zaisti\u0165 nap\u00e1janie pre br\u00e1nu. <\/li>\n<li>Pripoji\u0165 sie\u0165ov\u00fd k\u00e1bel z v\u00e1\u0161ho PC do LAN -1 na br\u00e1ne.<\/li>\n<li>Volite\u013ene m\u00f4\u017eete zariadenie okam\u017eite pripoji\u0165 na internet pripojen\u00edm rozhrania do portu WAN.<\/li>\n<li>Prejdite na port\u00e1l Gaia Embedded: <noindex><a rel=\"nofollow\" href=\"https:\/\/192.168.1.1:4434\/\">https:\/\/192.168.1.1:4434\/<\/a><\/noindex><\/li>\n<\/ol>\n<p><\/p>\n<p>Ak ste vykonali predch\u00e1dzaj\u00face kroky, po prechode na str\u00e1nku port\u00e1lu Gaia budete musie\u0165 potvrdi\u0165 otvorenie str\u00e1nky s ned\u00f4veryhodn\u00fdm certifik\u00e1tom, po \u010dom sa spust\u00ed sprievodca nastaven\u00edm port\u00e1lu:\n<\/p>\n<p>\n<img decoding=\"async\" alt=\"2. NGFW pre mal\u00e9 podniky. Rozbalenie a nastavenie\" src=\"\/wp-content\/uploads\/2020\/07\/0f9c59f8aee0b0cb4e402ab6478ecb39.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>Priv\u00edta v\u00e1s str\u00e1nka s ozna\u010den\u00edm modelu v\u00e1\u0161ho zariadenia, prejdite do nasleduj\u00facej sekcie:\n<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pre mal\u00e9 podniky. Rozbalenie a nastavenie\" src=\"\/wp-content\/uploads\/2020\/07\/802a2d07d265f205ed7f4c289d7c83ac.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>Bude n\u00e1m pon\u00faknut\u00e9 vytvorenie \u00fa\u010dtu na autoriz\u00e1ciu, existuje mo\u017enos\u0165 zada\u0165 vysok\u00e9 po\u017eiadavky na heslo pre administr\u00e1tora a uvedieme krajinu, kde budeme pou\u017e\u00edva\u0165 br\u00e1nu.\n<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pre mal\u00e9 podniky. Rozbalenie a nastavenie\" src=\"\/wp-content\/uploads\/2020\/07\/7a1c641cb3425b35a403e97b3aca2d9c.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>Nasleduj\u00face okno sa t\u00fdka nastaven\u00ed d\u00e1tumu a \u010dasu, m\u00e1me mo\u017enos\u0165 nastavi\u0165 ho ru\u010dne alebo pou\u017ei\u0165 NTP-server spolo\u010dnosti.\n<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pre mal\u00e9 podniky. Rozbalenie a nastavenie\" src=\"\/wp-content\/uploads\/2020\/07\/b1162711e3f1e73e4bb7090eccbfde84.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>\u010eal\u0161\u00edm krokom je ur\u010denie mena zariadenia a uvedenie dom\u00e9ny spolo\u010dnosti pre spr\u00e1vnu funkciu br\u00e1ny na internete.\n<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pre mal\u00e9 podniky. Rozbalenie a nastavenie\" src=\"\/wp-content\/uploads\/2020\/07\/5bc4e62401fa71b6e2f42550f3c88965.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>\u010eal\u0161\u00edm krokom je v\u00fdber sp\u00f4sobu spr\u00e1vy NGFW, tu by sme mali poznamena\u0165:<\/p>\n<p><\/p>\n<ol>\n<li>Miestna spr\u00e1va. T\u00e1to dostupn\u00e1 mo\u017enos\u0165 pre miestnu spr\u00e1vu br\u00e1ny prostredn\u00edctvom webovej str\u00e1nky Gaia Portal.<\/li>\n<li>Centr\u00e1lna spr\u00e1va. Tento sp\u00f4sob spr\u00e1vy zah\u0155\u0148a synchroniz\u00e1ciu s vyhraden\u00fdm spr\u00e1vcovsk\u00fdm serverom CheckPoint, synchroniz\u00e1ciu s cloudom Smart1-Cloud alebo s SMP (slu\u017eba spr\u00e1vy pre SMB).<\/li>\n<\/ol>\n<p><\/p>\n<p>V r\u00e1mci tohto \u010dl\u00e1nku sa zameriame na sp\u00f4sob spr\u00e1vy miestnej spr\u00e1vy, m\u00f4\u017eete uvies\u0165 met\u00f3du, ktor\u00fa potrebujete. Na obozn\u00e1menie sa s procesom synchroniz\u00e1cie s vyhraden\u00fdm spr\u00e1vcovsk\u00fdm serverom sa odpor\u00fa\u010da <noindex><a rel=\"nofollow\" href=\"https:\/\/www.youtube.com\/watch?v=v5SugzYFBhE&amp;list=PLqio-3dnMW5_2cStMfIezwcAzzDCjX86C&amp;index=7\"> odkaz<\/a><\/noindex> z vzdel\u00e1vacieho cyklu CheckPoint Getting Started, ktor\u00fd pripravila spolo\u010dnos\u0165 TS Solution. \n<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pre mal\u00e9 podniky. Rozbalenie a nastavenie\" src=\"\/wp-content\/uploads\/2020\/07\/c39e8ede7b45aecc40adf83dc32f0bc6.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>\u010ealej sa zobraz\u00ed okno s ur\u010den\u00edm re\u017eimu \u010dinnosti rozhran\u00ed na br\u00e1ne:\n<\/p>\n<p><\/p>\n<ul>\n<li>Re\u017eim Switch predpoklad\u00e1 dostupnos\u0165 podsiete od jedn\u00e9ho rozhrania k podsieti druh\u00e9ho rozhrania. <\/li>\n<li>Re\u017eim Disable Switch pr\u00edslu\u0161ne vyp\u00edna re\u017eim Switch, ka\u017ed\u00fd port smeruje traffic ako pre samostatn\u00fd fragment siete.<\/li>\n<\/ul>\n<p><\/p>\n<p>Je taktie\u017e navrhnut\u00e9 zada\u0165 pool DHCP adries, ktor\u00e9 bud\u00fa pou\u017eit\u00e9 pri pripojen\u00ed k lok\u00e1lnym rozhraniam br\u00e1ny.\n<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pre mal\u00e9 podniky. Rozbalenie a nastavenie\" src=\"\/wp-content\/uploads\/2020\/07\/d0a03e50f8b138e0518af07d9f6671a2.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>\u010eal\u0161\u00edm krokom je nastavenie \u010dinnosti br\u00e1ny v bezdr\u00f4tovom re\u017eime, pl\u00e1nujeme podrobne rozobra\u0165 tento aspekt v jednom \u010dl\u00e1nku cyklu, preto sme konfigur\u00e1ciu nastaven\u00ed odlo\u017eili. M\u00f4\u017eete v\u0161ak vytvori\u0165 nov\u00fd bezdr\u00f4tov\u00fd pr\u00edstupov\u00fd bod, zada\u0165 heslo na pripojenie k nemu a ur\u010di\u0165 re\u017eim \u010dinnosti bezdr\u00f4tov\u00e9ho kan\u00e1la (2.4 GHz alebo 5 GHz).\n<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pre mal\u00e9 podniky. Rozbalenie a nastavenie\" src=\"\/wp-content\/uploads\/2020\/07\/5039a036b3645b1d02d39835c6c107c4.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>\u010eal\u0161\u00edm krokom bude nastavenie pr\u00edstupu k br\u00e1ne pre administr\u00e1torov spolo\u010dnosti. Pr\u00e1va pr\u00edstupu s\u00fa predvolene povolen\u00e9, ak sa pripojenie uskuto\u010d\u0148uje z:<\/p>\n<p><\/p>\n<ol>\n<li>Vn\u00fatornej siete spolo\u010dnosti <\/li>\n<li>D\u00f4veryhodnej bezdr\u00f4tovej siete <\/li>\n<li>VPN tunela<\/li>\n<\/ol>\n<p><\/p>\n<p>Mo\u017enos\u0165 pripojenia k br\u00e1ne cez Internet je predvolene vypnut\u00e1, predstavuje vysok\u00e9 riziko a mala by by\u0165 od\u00f4vodnen\u00e1 na aktiv\u00e1ciu, inak sa odpor\u00fa\u010da necha\u0165 ako v na\u0161om pr\u00edklade. Tie\u017e existuje mo\u017enos\u0165 ur\u010di\u0165, ktor\u00e9 presne IP adresy bud\u00fa povolen\u00e9 na pripojenie k br\u00e1ne.<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pre mal\u00e9 podniky. Rozbalenie a nastavenie\" src=\"\/wp-content\/uploads\/2020\/07\/b3bd7f25aeb71b75392595f7efad22b6.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>\u010eal\u0161ie okno sa t\u00fdka aktiv\u00e1cie licenci\u00ed, pri prvej inicializ\u00e1cii zariadenia budete ma\u0165 predstaven\u00e9 30-d\u0148ov\u00e9 sk\u00fa\u0161obn\u00e9 obdobie. Existuj\u00fa dva dostupn\u00e9 sp\u00f4soby aktiv\u00e1cie: <\/p>\n<p><\/p>\n<ol>\n<li> Ak je pripojenie k internetu, licencia sa aktivuje automaticky.<\/li>\n<li> Ak aktivujete licenciu offline, je potrebn\u00e9 vykona\u0165 nasledovn\u00e9: stiahnu\u0165 licenciu z UserCenter, zaregistrova\u0165 va\u0161e zariadenie na \u0161peci\u00e1lnom <noindex><a rel=\"nofollow\" href=\"https:\/\/smbregistration.checkpoint.com\">port\u00e1li<\/a><\/noindex>. V oboch pr\u00edpadoch budete musie\u0165 manu\u00e1lne importova\u0165 stiahnut\u00fa licenciu.<\/li>\n<\/ol>\n<p><img decoding=\"async\" alt=\"2. NGFW pre mal\u00e9 podniky. Rozbalenie a nastavenie\" src=\"\/wp-content\/uploads\/2020\/07\/e0eb47e8dab7d4ece07e0e44a6e4bd35.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>Nakoniec posledn\u00e9 okno sprievodcu nastaven\u00edm pon\u00faka v\u00fdber zapnut\u00fdch bledov, pri\u010dom bled QOS sa zap\u00edna a\u017e po prvej inicializ\u00e1cii. Na konci by ste mali z\u00edska\u0165 okno dokon\u010denia, ktor\u00e9 sumarizuje va\u0161e nastavenia.<\/p>\n<h2>Po\u010diato\u010dn\u00e9 nastavenie<\/h2>\n<p><\/p>\n<p> Najprv odpor\u00fa\u010dame skontrolova\u0165 stav licenci\u00ed, od toho bude z\u00e1visie\u0165 \u010fal\u0161ie nastavenie. Prejdite na kartu \u201cHOME\u201d \u2192 \u201cLicense\u201d:<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pre mal\u00e9 podniky. Rozbalenie a nastavenie\" src=\"\/wp-content\/uploads\/2020\/07\/ffafde17f0545d500176d8ba8a82ec65.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>Ak s\u00fa licencie aktivovan\u00e9, odpor\u00fa\u010dame ihne\u010f aktualizova\u0165 na najnov\u0161\u00ed aktu\u00e1lny firmware, na to prejdite na kartu \u201cDEVICE\u201d \u2192 \u201cSystem Operations\u201d:<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pre mal\u00e9 podniky. Rozbalenie a nastavenie\" src=\"\/wp-content\/uploads\/2020\/07\/ba7484d0e39800db7a122c3dda5db6b1.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>Aktualiz\u00e1cie syst\u00e9mu s\u00fa v polo\u017eke Firmware Upgrade. V na\u0161om pr\u00edpade je nain\u0161talovan\u00e1 aktu\u00e1lna a najnov\u0161ia verzia firmv\u00e9ru.\n<\/p>\n<p><\/p>\n<p>\u010ealej navrhujem stru\u010dne op\u00edsa\u0165 mo\u017enosti a nastavenia bledov syst\u00e9mu. Logicky ich m\u00f4\u017eeme rozdeli\u0165 na politiky \u00farovne Access (Firewall, Application Control, URL Filtering) a Threat Prevention (IPS, Antivirus, Anti-Bot, Threat Emulation).<\/p>\n<p><\/p>\n<p>Prejdeme na kartu Access Policy \u2192 Blade Control:<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pre mal\u00e9 podniky. Rozbalenie a nastavenie\" src=\"\/wp-content\/uploads\/2020\/07\/381db11e773c4a61d30df502f6a0abb0.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>Predvolene je pou\u017eit\u00fd re\u017eim STANDARD, ktor\u00fd povoluje: odch\u00e1dzaj\u00faci prenos do Internetu, prenos v r\u00e1mci lok\u00e1lnej siete, av\u0161ak blokuje prich\u00e1dzaj\u00faci prenos z Internetu.\n<\/p>\n<p><\/p>\n<p>Pokia\u013e ide o bleydy APPLICATIONS &amp; URL FILTERING, predvolene je nastaven\u00e1 blok\u00e1cia webov\u00fdch str\u00e1nok s vysokou \u00farov\u0148ou nebezpe\u010denstva a blok\u00e1cia aplik\u00e1ci\u00ed na zdie\u013eanie (Torrent, File Storage at\u010f.). Okrem toho je mo\u017en\u00e9 manu\u00e1lne blokova\u0165 kateg\u00f3rie webov\u00fdch str\u00e1nok.<\/p>\n<p><\/p>\n<p>Upozor\u0148ujeme na mo\u017enos\u0165 pre pou\u017e\u00edvate\u013esk\u00fd prenos \u201eLimit bandwidth consuming applications\u201c s mo\u017enos\u0165ou obmedzi\u0165 r\u00fdchlos\u0165 odch\u00e1dzaj\u00faceho\/prich\u00e1dzaj\u00faceho prenosu pre skupiny aplik\u00e1ci\u00ed. \n<\/p>\n<p><\/p>\n<p>\u010ealej otvor\u00edme pododdelenie Policy, kde s\u00fa predvolene pravidl\u00e1 generovan\u00e9 automaticky pod\u013ea predt\u00fdm pop\u00edsan\u00fdch nastaven\u00ed. \n<\/p>\n<p><\/p>\n<p>Pododdelenie NAT predvolene funguje v re\u017eime Global Hide Nat Automatic, t.j. v\u0161etky intern\u00e9 hosty bud\u00fa ma\u0165 pr\u00edstup na internet prostredn\u00edctvom verejnej IP adresy. Existuje mo\u017enos\u0165 manu\u00e1lne nastavi\u0165 pravidl\u00e1 NAT pre publikovanie va\u0161ich webov\u00fdch aplik\u00e1ci\u00ed alebo slu\u017eieb. \n<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pre mal\u00e9 podniky. Rozbalenie a nastavenie\" src=\"\/wp-content\/uploads\/2020\/07\/3c7f69f0ac7c34358cc2f3561d0f31e3.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>\u010ealej je tu sekcia, ktor\u00e1 sa t\u00fdka autentifik\u00e1cie pou\u017e\u00edvate\u013eov v sieti, pon\u00fakaj\u00fa sa dve mo\u017enosti: Active Directory Queries (integr\u00e1cia s va\u0161\u00edm AD) a Browser-Based-Authentication (pou\u017e\u00edvate\u013e zad\u00e1va dom\u00e9nov\u00e9 prihlasovacie \u00fadaje na port\u00e1li).\n<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pre mal\u00e9 podniky. Rozbalenie a nastavenie\" src=\"\/wp-content\/uploads\/2020\/07\/123734ef6cde261992e6e369271c797f.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>Osobitn\u00fa pozornos\u0165 treba venova\u0165 SSL-in\u0161pekcii, podiel celkov\u00e9ho HTTPS prenosu v glob\u00e1lnej sieti akt\u00edvne rastie. Pozrime sa, ak\u00e9 mo\u017enosti pon\u00faka CheckPoint pre SMB rie\u0161enia, preto mus\u00edme prejs\u0165 do sekcie SSL-Inspection \u2192 Policy:\n<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pre mal\u00e9 podniky. Rozbalenie a nastavenie\" src=\"\/wp-content\/uploads\/2020\/07\/a3da719f47a7aee7ca98e3f6e043282c.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>V nastaveniach je mo\u017enos\u0165 in\u0161pekcie HTTPS prenosu, bude potrebn\u00e9 importova\u0165 certifik\u00e1t a nain\u0161talova\u0165 ho do centra d\u00f4veryhodn\u00fdch certifik\u00e1tov na koncov\u00fdch pou\u017e\u00edvate\u013esk\u00fdch zariadeniach. \n<\/p>\n<p><\/p>\n<p>Pohodlnou mo\u017enos\u0165ou pova\u017eujeme re\u017eim BYPASS pre prednastaven\u00e9 kateg\u00f3rie, \u010do v\u00fdrazne \u0161etr\u00ed \u010das pri zap\u00ednan\u00ed in\u0161pekcie. \n<\/p>\n<p><\/p>\n<p>Po nastaven\u00ed pravidiel na \u00farovni Firewall \/ Application by sme mali prejs\u0165 k dola\u010fovaniu bezpe\u010dnostn\u00fdch polit\u00edk (Threat Prevention), na to prejdeme do pr\u00edslu\u0161nej sekcie:\n<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pre mal\u00e9 podniky. Rozbalenie a nastavenie\" src=\"\/wp-content\/uploads\/2020\/07\/30b4cbd037f8517e81c2557dbdc5fd98.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>Na otvorenej str\u00e1nke vid\u00edme povolen\u00e9 bledy, stavy aktualiz\u00e1ci\u00ed podpisov a datab\u00e1z. Taktie\u017e n\u00e1m pon\u00fakaj\u00fa vybra\u0165 profil na ochranu sie\u0165ov\u00e9ho perimetra, zobrazuj\u00fa sa pr\u00edslu\u0161n\u00e9 nastavenia.\n<\/p>\n<p><\/p>\n<p>Samostatn\u00e1 sekcia \u201eIPS Protections\u201c umo\u017e\u0148uje konfigurova\u0165 akciu na ur\u010dit\u00fa bezpe\u010dnostn\u00fa signat\u00faru.\n<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pre mal\u00e9 podniky. Rozbalenie a nastavenie\" src=\"\/wp-content\/uploads\/2020\/07\/9718b22b843742b6916dceb342e24a8d.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>Ned\u00e1vno sme vo svojom blogu p\u00edsali <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/511012\/\">o glob\u00e1lnej zranite\u013enosti<\/a><\/noindex> pre Windows Server \u2014 SigRed. Skontrolujeme jej pr\u00edtomnos\u0165 v Gaia Embedded 80.20, zadan\u00edm dotazu \u201eCVE-2020-1350\u201c.<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pre mal\u00e9 podniky. Rozbalenie a nastavenie\" src=\"\/wp-content\/uploads\/2020\/07\/7af359b881b41e382b98ddb7fda53403.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNa t\u00fato signat\u00faru bola zisten\u00e1 udalos\u0165, na ktor\u00fa je mo\u017en\u00e9 aplikova\u0165 jednu z akci\u00ed. (predvolen\u00e9 Prevent pre \u00farove\u0148 nebezpe\u010denstva \u2014 Critical). S rie\u0161en\u00edm SMB nebudete ochudobnen\u00ed o aktualiz\u00e1cie a podporu, je to komplexn\u00e9 rie\u0161enie NGFW pre pobo\u010dky do 200 os\u00f4b od CheckPoint.<\/p>\n<h2>Hodnotenie funk\u010dnosti<\/h2>\n<p>\nNa z\u00e1ver \u010dl\u00e1nku by som chcel zd\u00f4razni\u0165 existenciu n\u00e1strojov na rie\u0161enie probl\u00e9mov po po\u010diato\u010dnej inicializ\u00e1cii a nastaven\u00ed rie\u0161enia SMB. M\u00f4\u017eete prejs\u0165 do sekcie \"HOME\" \u2192 \"Tools\". Mo\u017en\u00e9 mo\u017enosti:<\/p>\n<ul>\n<li>monitorovanie syst\u00e9mov\u00fdch zdrojov;<\/li>\n<li>tabu\u013eka smerovania;<\/li>\n<li>kontrola dostupnosti cloudov\u00fdch slu\u017eieb CheckPoint;<\/li>\n<li>generovanie CPinfo;<\/li>\n<\/ul>\n<p><\/p>\n<p>Rovnako s\u00fa k dispoz\u00edcii vstavan\u00e9 sie\u0165ov\u00e9 pr\u00edkazy: Ping, Traceroute, Traffic Capture.\n<\/p>\n<p><img decoding=\"async\" alt=\"2. NGFW pre mal\u00e9 podniky. Rozbalenie a nastavenie\" src=\"\/wp-content\/uploads\/2020\/07\/d3f2b1c24bd7f9f882ad78f8838ac8e0.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<p>T\u00fdmto sp\u00f4sobom sme dnes presk\u00famali a \u0161tudovali po\u010diato\u010dn\u00e9 pripojenie a nastavenie NGFW 1590, podobn\u00e9 kroky budete vykon\u00e1va\u0165 pre cel\u00fa radu s\u00e9rie 1500 SMB Checkpoint. Dostupn\u00e9 mo\u017enosti n\u00e1m uk\u00e1zali vysok\u00fa variabilitu nastaven\u00ed a podporu modern\u00fdch met\u00f3d ochrany prev\u00e1dzky na perimetri siete. <\/p>\n<p>\nDnes rie\u0161enia CheckPoint na ochranu mal\u00fdch kancel\u00e1ri\u00ed a pobo\u010diek (do 200 os\u00f4b) disponuj\u00fa \u0161irok\u00fdm s\u00faborom prostriedkov a vyu\u017e\u00edvaj\u00fa najnov\u0161ie technol\u00f3gie (cloudov\u00e9 riadenie, podpora SIM kariet, roz\u0161\u00edrenie pam\u00e4te pomocou SD kariet a pod.). Pokra\u010dujte v sledovan\u00ed a \u010d\u00edtan\u00ed \u010dl\u00e1nkov od TS Solution, pl\u00e1nujeme \u010fal\u0161\u00ed vydan\u00fd diel o NGFW CheckPoint rodiny SMB, do skor\u00e9ho videnia!<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/358508\/\">Ve\u013ek\u00e1 zbierka materi\u00e1lov o Check Point od TS Solution<\/a><\/noindex>. Sledujte aktualiz\u00e1cie (<noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/tssolution\">Telegram<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.facebook.com\/groups\/tssolution.info\/\">Facebook<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/vk.com\/ts_solution\">VK<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/blog\">Blog TS Solution<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/zen.yandex.ru\/id\/5c7d2162fa818600ae386a52\">Yandex.Zen<\/a><\/noindex>).<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/511462\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u0446\u0438\u043a\u043b \u0441\u0442\u0430\u0442\u0435\u0439 \u043f\u043e \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u043d\u043e\u0432\u044b\u043c \u043c\u043e\u0434\u0435\u043b\u044c\u043d\u044b\u043c \u0440\u044f\u0434\u043e\u043c SMB CheckPoint, \u043d\u0430\u043f\u043e\u043c\u043d\u0438\u043c \u0447\u0442\u043e \u0432 \u043f\u0435\u0440\u0432\u043e\u0439 \u0447\u0430\u0441\u0442\u0438 \u043c\u044b \u043e\u043f\u0438\u0441\u0430\u043b\u0438 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u0438\u0441\u0442\u0438\u043a\u0438 \u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043d\u043e\u0432\u044b\u0445 \u043c\u043e\u0434\u0435\u043b\u0435\u0439, \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0441\u0442\u0430\u0440\u0448\u0435\u0439 \u043c\u043e\u0434\u0435\u043b\u0438 \u0441\u0435\u0440\u0438\u0438: CheckPoint 1590 NGFW. \u041f\u0440\u0438\u043b\u043e\u0436\u0438\u043c \u043a\u0440\u0430\u0442\u043a\u043e\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u043e\u0439 \u0447\u0430\u0441\u0442\u0438: \u0420\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0430 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f (\u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0442\u0443\u044e\u0449\u0438\u0445, \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u0438 \u0441\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435). \u041f\u0435\u0440\u0432\u0438\u0447\u043d\u0430\u044f \u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430. \u041f\u0435\u0440\u0432\u0438\u0447\u043d\u0430\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430. [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":89740,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-89739","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/2-ngfw-dlya-malogo-biznesa-raspakovka-i-nastrojka\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd472. NGFW \u0434\u043b\u044f \u043c\u0430\u043b\u043e\u0433\u043e \u0431\u0438\u0437\u043d\u0435\u0441\u0430. \u0420\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0430 \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/2-ngfw-dlya-malogo-biznesa-raspakovka-i-nastrojka\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-07-25T23:42:18+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-07-25T23:42:18+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd472. NGFW pre mal\u00e9 podniky. Rozbalenie a nastavenie | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/2-ngfw-dlya-malogo-biznesa-raspakovka-i-nastrojka","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd472. NGFW \u0434\u043b\u044f \u043c\u0430\u043b\u043e\u0433\u043e \u0431\u0438\u0437\u043d\u0435\u0441\u0430. \u0420\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0430 \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 | ProHoster","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/2-ngfw-dlya-malogo-biznesa-raspakovka-i-nastrojka","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-07-25T23:42:18+00:00","article:modified_time":"2020-07-25T23:42:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"89739","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:05:27","updated":"2022-10-01 11:43:06","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/89739","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=89739"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/89739\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/89740"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=89739"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=89739"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=89739"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}