{"id":29991,"date":"2019-10-31T21:33:06","date_gmt":"2019-10-31T18:33:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/check-point-chto-eto-s-chem-ego-edyat-ili-korotko-o-glavnom\/"},"modified":"2019-10-31T21:33:06","modified_gmt":"2019-10-31T18:33:06","slug":"check-point-chto-eto-s-chem-ego-edyat-ili-korotko-o-glavnom","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/check-point-chto-eto-s-chem-ego-edyat-ili-korotko-o-glavnom","title":{"rendered":"Check Point. \u00c7far\u00eb \u00ebsht\u00eb, si e ham\u00eb ose p\u00ebrmbledhje e r\u00ebnd\u00ebsishme","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Check
\nP\u00ebrsh\u00ebndetje, t\u00eb nderuar lexues t\u00eb Habr\u00ebs! Ky \u00ebsht\u00eb blogu korporativ i kompanis\u00eb TS Solution<\/a><\/noindex>. Ne jemi nj\u00eb integrator sistemesh dhe kryesisht specializohemi n\u00eb zgjidhjet e siguris\u00eb s\u00eb infrastruktur\u00ebs IT (Check Point<\/a><\/noindex>, Fortinet<\/a><\/noindex>) dhe sistemet e analiz\u00ebs s\u00eb t\u00eb dh\u00ebnave makinerike (Splunk<\/a><\/noindex>). Le ta fillojm\u00eb blogun ton\u00eb me nj\u00eb hyrje t\u00eb vog\u00ebl n\u00eb teknologjit\u00eb Check Point.<\/p>\n

Ne kemi menduar gjat\u00eb n\u00ebse duhet t\u00eb shkruajm\u00eb k\u00ebt\u00eb artikull, pasi nuk ka asgj\u00eb t\u00eb re q\u00eb nuk mund t\u00eb gjendet n\u00eb internet. Megjithat\u00eb, pavar\u00ebsisht k\u00ebtij fluksi t\u00eb informacionit, gjat\u00eb pun\u00ebs me klient\u00ebt dhe partner\u00ebt shpesh d\u00ebgjojm\u00eb t\u00eb nj\u00ebjtat pyetje. Prandaj, u vendos t\u00eb shkruajm\u00eb nj\u00eb hyrje n\u00eb bot\u00ebn e teknologjive Check Point dhe t\u00eb zbulojm\u00eb thelbin e arkitektur\u00ebs s\u00eb zgjidhjeve t\u00eb tyre. Dhe gjith\u00e7ka n\u00eb kuad\u00ebr t\u00eb nj\u00eb \u201cpostimi t\u00eb vog\u00ebl\u201d, si\u00e7 e thon\u00eb. P\u00ebr m\u00eb tep\u00ebr, do t\u00eb p\u00ebrpiqemi t\u00eb mos hyjm\u00eb n\u00eb luft\u00ebra marketingu, pasi nuk jemi nj\u00eb furnizues, por thjesht nj\u00eb integrator sistemesh (ndon\u00ebse na p\u00eblqen shum\u00eb Check Point) dhe do t\u00eb shqyrtojm\u00eb pikat kryesore pa i krahasuar me prodhues t\u00eb tjer\u00eb (si Palo Alto, Cisco, Fortinet etj.). Artikulli doli t\u00eb jet\u00eb mjaft i gjer\u00eb, por ndihmon n\u00eb eliminimin e nj\u00eb pjese t\u00eb madhe t\u00eb pyetjeve n\u00eb faz\u00ebn e njohjes me Check Point. N\u00ebse ju intereson, ju lutemi, vazhdoni m\u00eb tej...
\n<\/a><\/noindex>
\nUTM\/NGFW<\/b><\/p>\n

Duke filluar bised\u00ebn p\u00ebr Check Point, e para q\u00eb duhet t\u00eb sqarojm\u00eb \u00ebsht\u00eb se \u00e7far\u00eb \u00ebsht\u00eb UTM, NGFW dhe \u00e7far\u00eb i dallon. Do ta b\u00ebjm\u00eb k\u00ebt\u00eb n\u00eb m\u00ebnyr\u00eb shum\u00eb t\u00eb shkurt\u00ebr, p\u00ebr t\u00eb mos e b\u00ebr\u00eb postimin t\u00eb gjat\u00eb (ndoshta n\u00eb t\u00eb ardhmen do t\u00eb shqyrtojm\u00eb k\u00ebt\u00eb \u00e7\u00ebshtje pak m\u00eb n\u00eb detaj)<\/p>\n

UTM \u2014 Menaxhimi i Rreziqeve t\u00eb Bashkuara<\/b><\/p>\n

N\u00ebse flasim shkurtimisht, thelbi i UTM \u00ebsht\u00eb konsolidimi i disa mjeteve mbrojt\u00ebse n\u00eb nj\u00eb zgjidhje. Pra, gjith\u00e7ka n\u00eb nj\u00eb kuti ose nj\u00eb far\u00eb all inclusive. \u00c7far\u00eb n\u00ebnkuptohet me \u201cseveral means of protection\u201d? Varianti m\u00eb i zakonsh\u00ebm \u00ebsht\u00eb: Nj\u00eb Firewall, IPS, Proxy (filtrimi i URL-ve), Antivirus i rrjedh\u00ebs, Anti-Spam, VPN etj. T\u00eb gjitha k\u00ebto bashkohen n\u00eb kuad\u00ebr t\u00eb nj\u00eb zgjidhjeje UTM, q\u00eb e b\u00ebn m\u00eb t\u00eb leht\u00eb integrimin, konfigurimin, administrimin dhe monitorimin, dhe kjo ndikon pozitivisht n\u00eb sigurin\u00eb e p\u00ebrgjithshme t\u00eb rrjetit. Kur zgjidhjet UTM sapo kishin dal\u00eb, ato shqyrtoheshin ekskluzivisht p\u00ebr kompanit\u00eb e vogla, pasi UTM nuk p\u00ebrballoheshin me volumen t\u00eb madh trafiku. Kjo ndodhi p\u00ebr dy arsye:<\/p>\n

    \n
  1. M\u00ebnyra e p\u00ebrpunimit t\u00eb pakove. Versionet e para t\u00eb zgjidhjeve UTM i p\u00ebrpunonin paketat nj\u00eb nga nj\u00eb, nga \u00e7do \u201cmodul\u201d. Shembuj: s\u00eb pari paketa p\u00ebrpunoheshin nga nd\u00ebrfaqja e rrjetit, pastaj IPS, m\u00eb pas kontrollohet nga Antivirus dhe k\u00ebshtu me radh\u00eb. Natyrisht, nj\u00eb mekaniz\u00ebm i till\u00eb sjell\u00eb vonesa t\u00eb m\u00ebdha n\u00eb trafik dhe ndikon shum\u00eb n\u00eb p\u00ebrdorimin e burimeve t\u00eb sistemit (procesori, memorie).<\/li>\n
  2. Harduer i dob\u00ebt. Si\u00e7 u tha m\u00eb lart, p\u00ebrpunimi i paketave n\u00eb m\u00ebnyr\u00eb t\u00eb nj\u00ebpasnjishme konsumonte shum\u00eb burime dhe \u201chardueri\u201d i atyre viteve (1995-2005) thjesht nuk arriti t\u00eb p\u00ebrballonte volum t\u00eb madh trafiku.<\/li>\n<\/ol>\n

    \nPor progresi nuk ndalon. Q\u00eb at\u00ebher\u00eb, kapacitetet harduerike jan\u00eb rritur ndjesh\u00ebm dhe p\u00ebrpunimi i paketave ka ndryshuar (duhet pranuar se jo t\u00eb gjitha ofruesit kan\u00eb b\u00ebr\u00eb k\u00ebt\u00eb) dhe \u00ebsht\u00eb lejuar analiza pothuajse e menj\u00ebhershme n\u00eb disa module (MFA, IPS, Antivirus etj.). Zgjidhjet moderne UTM mund t\u00eb \u201cp\u00ebrpunojn\u00eb\u201d dhjet\u00ebra e madje qindra gigabitet n\u00eb modin e analiz\u00ebs s\u00eb thell\u00eb, q\u00eb i lejon ato t\u00eb p\u00ebrdoren n\u00eb segmentin e bizneseve t\u00eb m\u00ebdha ose madje t\u00eb qendrave t\u00eb t\u00eb dh\u00ebnave.<\/p>\n

    M\u00eb posht\u00eb \u00ebsht\u00eb katrori magjik i Gartnerit p\u00ebr zgjidhjet UTM p\u00ebr gusht 2016:<\/p>\n

    \"Check
    \n
    \nNuk do t\u00eb komentoj shum\u00eb k\u00ebt\u00eb imazh, thjesht do t\u00eb them se n\u00eb cepin e sip\u00ebrm t\u00eb djatht\u00ebs jan\u00eb lider\u00ebt.<\/p>\n

    NGFW \u2014 Zjarri i Brezit t\u00eb Re<\/b><\/p>\n

    Emri flet vet\u00eb \u2014 zjarri i brezit t\u00eb ri. Ky koncept doli shum\u00eb m\u00eb von\u00eb sesa UTM. Ideja kryesore e NGFW \u00ebsht\u00eb analiza e thell\u00eb e paketave (DPI) p\u00ebrmes IPS t\u00eb integruar dhe ndarjen e qasjes n\u00eb nivelin e aplikacioneve (Kontrolli i Aplikacioneve). N\u00eb k\u00ebt\u00eb rast, IPS \u00ebsht\u00eb e nevojshme p\u00ebr t\u00eb identifikuar nj\u00eb ose m\u00eb shum\u00eb aplikacione n\u00eb flukset e paketave, q\u00eb lejon t\u00eb lejohet ose t\u00eb ndalohet p\u00ebrdorimi i tij. Shembuj: Mund t\u00eb lejojm\u00eb funksionimin e Skype, por t\u00eb ndalojm\u00eb transferimin e skedar\u00ebve. Mund t\u00eb ndalojm\u00eb p\u00ebrdorimin e Torrent ose RDP. Po ashtu, aplikacionet n\u00eb internet mb\u00ebshteten: Mund t\u00eb lejojm\u00eb qasje n\u00eb VK.com, por t\u00eb ndalojm\u00eb loj\u00ebrat, mesazhet ose shikimin e videove. N\u00eb thelb, cil\u00ebsia e NGFW varet nga numri i aplikacioneve q\u00eb ai mund t\u00eb identifikoj\u00eb. Shum\u00eb mendojn\u00eb se shfaqja e konceptit NGFW ishte nj\u00eb l\u00ebvizje e zakonshme marketingu n\u00eb t\u00eb cilin kompania Palo Alto filloi t\u00eb rritet shpejt.<\/p>\n

    Katrori magjik i Gartnerit p\u00ebr NGFW p\u00ebr maj 2016:<\/p>\n

    \"Check
    \n
    \nUTM vs NGFW<\/b><\/p>\n

    Nj\u00eb pyetje shum\u00eb e zakonshme \u00ebsht\u00eb, cila \u00ebsht\u00eb m\u00eb e mira? Nuk ka nj\u00eb p\u00ebrgjigje t\u00eb qart\u00eb p\u00ebr k\u00ebt\u00eb dhe nuk mund t\u00eb ket\u00eb. Sidomos duke marr\u00eb parasysh faktin se pothuajse t\u00eb gjitha zgjidhjet moderne UTM p\u00ebrmbajn\u00eb funksionalitetin NGFW dhe shumica e NGFW p\u00ebrmbajn\u00eb funskionet q\u00eb i takojn\u00eb UTM (Antivirus, VPN, Anti-Bot etj.). Si\u00e7 thon\u00eb gjithmon\u00eb, \"djalli q\u00ebndron tek detajet\", prandaj t\u00eb par\u00ebn duhet t\u00eb vendosni se \u00e7far\u00eb ju nevojitet konkretisht, t\u00eb p\u00ebrcaktoni buxhetin. N\u00eb baz\u00eb t\u00eb k\u00ebtyre vendimeve mund t\u00eb zgjidhni disa variante. Dhe t\u00eb gjitha duhet t\u00eb testohen patjet\u00ebr, pa besuar materialet marketingu.<\/p>\n

    Ne, nga ana jon\u00eb, n\u00eb kuad\u00ebr t\u00eb disa artikujve do t\u00eb p\u00ebrpiqemi t\u00eb flasim p\u00ebr Check Point, si mund ta provoni dhe \u00e7far\u00eb n\u00eb p\u00ebrgjith\u00ebsi mund t\u00eb provoni (praktikisht gjith\u00eb funksionalitetin).<\/p>\n

    Tre entitete t\u00eb Check Point<\/b><\/p>\n

    Kur punoni me Check Point, do t\u00eb p\u00ebrballeni me tre p\u00ebrb\u00ebr\u00ebs t\u00eb k\u00ebtij produkti:<\/p>\n

    \"Check
    \n<\/p>\n

      \n
    1. Security Gateway (SG)<\/b> \u2014 vet\u00eb porta e siguris\u00eb, e cila zakonisht vendoset n\u00eb perimeter t\u00eb rrjetit dhe kryen funksionet e nj\u00eb firewalli, antivirusit t\u00eb rrjedh\u00ebs, anti-botit, IPS etj.<\/li>\n
    2. Security Management Server (SMS)<\/b> \u2014 serveri i menaxhimit t\u00eb porteve. Praktikisht t\u00eb gjitha konfigurimet n\u00eb port\u00ebn (SG) realizohen p\u00ebrmes k\u00ebtij serveri. SMS gjithashtu mund t\u00eb veproj\u00eb si server log dhe t\u00eb procesoj\u00eb log-et e tij me sistemin e integruar t\u00eb analiz\u00ebs dhe korrelacionit t\u00eb ngjarjeve \u2014 Smart Event (ngjash\u00ebm me SIEM p\u00ebr Check Point), por p\u00ebr k\u00ebt\u00eb m\u00eb von\u00eb. SMS p\u00ebrdoret p\u00ebr menaxhimin qendror t\u00eb disa porteve (numri i porteve varet nga modeli i SMS, ose nga licenca), megjithat\u00eb ju jeni t\u00eb detyruar ta p\u00ebrdorni at\u00eb, edhe n\u00ebse keni vet\u00ebm nj\u00eb port\u00eb. Duhet theksuar se Check Point ishte nj\u00eb nga t\u00eb par\u00ebt q\u00eb filluan t\u00eb aplikojn\u00eb nj\u00eb sistem t\u00eb till\u00eb t\u00eb menaxhimit qendror, i cili p\u00ebr shum\u00eb vite rresht \u00ebsht\u00eb njohur si \"standard i art\u00eb\" sipas raporteve t\u00eb kompanis\u00eb Gartner. Ka madje nj\u00eb shaka: \"N\u00ebse Cisco do t\u00eb kishte nj\u00eb sistem menaxhimi normal, Check Point nuk do t\u00eb kishte lindur kurr\u00eb\".<\/li>\n
    3. Smart Console<\/b> \u2014 konsola klientit p\u00ebr t'u lidhur me serverin e menaxhimit (SMS). Zakonisht instalohet n\u00eb kompjuterin e administratorit. P\u00ebrmes k\u00ebsaj konsole realizohen t\u00eb gjitha ndryshimet n\u00eb serverin e menaxhimit, dhe vet\u00ebm pas k\u00ebsaj mund t\u00eb aplikohet konfigurimi n\u00eb portat e siguris\u00eb (Install Policy).\n

      \"Check\n<\/li>\n<\/ol>\n

      \nSistemi operativ Check Point<\/b><\/p>\n

      Duke folur p\u00ebr sistemin operativ Check Point mund t\u00eb p\u00ebrmendim menj\u00ebher\u00eb tre: IPSO, SPLAT dhe GAIA.<\/p>\n

        \n
      1. IPSO<\/b> \u2014 sistemi operative e Ipsilon Networks, e cila i p\u00ebrkiste kompanis\u00eb Nokia. N\u00eb vitin 2009, Check Point e bleu k\u00ebt\u00eb biznes. Nuk vazhdon t\u00eb zhvillohet.<\/li>\n
      2. SPLAT<\/b> \u2014 zhvillim i brendsh\u00ebm i Check Point, i bazuar n\u00eb b\u00ebrtham\u00ebn RedHat. Nuk vazhdon t\u00eb zhvillohet.<\/li>\n
      3. Gaia<\/b> \u2014 sistemi operativ aktual nga Check Point, i cili u shfaq si rezultat i bashkimit t\u00eb IPSO dhe SPLAT, duke p\u00ebrfshir\u00eb t\u00eb gjitha t\u00eb mirat. U shfaq n\u00eb vitin 2012 dhe vazhdon t\u00eb zhvillohet aktivisht.<\/li>\n<\/ol>\n

        \nDuke folur p\u00ebr Gaia, duhet t\u00eb themi se versioni m\u00eb i p\u00ebrhapur deri m\u00eb tani \u00ebsht\u00eb R77.30. Pas pak kohe u shfaq versioni R80, i cili ndryshon ndjesh\u00ebm nga e kaluara (si n\u00eb aspektin e funksionalitetit ashtu edhe n\u00eb menaxhim). K\u00ebsaj teme do t'i kushtojm\u00eb nj\u00eb postim t\u00eb ve\u00e7ant\u00eb. Nj\u00eb pik\u00eb tjet\u00ebr e r\u00ebnd\u00ebsishme \u2014 p\u00ebr momentin, vet\u00ebm versioni R77.10 ka certifikat\u00ebn FSTEK dhe \u00ebsht\u00eb duke u certifikuar versioni R77.30.<\/p>\n

        Mund\u00ebsit\u00eb e zbatimit (Check Point Appliance, Virtual machine, OpenServer)<\/b><\/p>\n

        Nuk ka asgj\u00eb t\u00eb \u00e7uditshme, si shum\u00eb furnizues, Check Point ka disa mund\u00ebsi produkti:<\/p>\n

          \n
        1. Appliance<\/b> \u2014 pajisje softuerike dhe harduerike, dometh\u00ebn\u00eb \u201ckuti\u201d e saj. Ka shum\u00eb modele, t\u00eb cilat ndryshojn\u00eb n\u00eb performanc\u00eb, funksionalitet dhe zbatim (ka mund\u00ebsi p\u00ebr rrjetet industriale).\n

          \"Check<\/li>\n

        2. Virtual Machine<\/b> \u2014 makina virtuale Check Point me sistemin operativ Gaia. Mb\u00ebshteten hipervizor\u00ebt ESXi, Hyper-V, KVM. Licencohen sipas numrit t\u00eb b\u00ebrthamave t\u00eb procesorit.<\/li>\n
        3. OpenServer<\/b> \u2014 instalimi i Gaia direkt n\u00eb server si sistemin e tij kryesor (nj\u00eb \u201cBare metal\u201d). Mb\u00ebshtetet vet\u00ebm nj\u00eb \u201charduer\u201d t\u00eb caktuar. Ka rekomandime p\u00ebr k\u00ebt\u00eb harduer q\u00eb duhet ndjekur, p\u00ebrndryshe mund t\u00eb ket\u00eb probleme me drejtuesit dhe mb\u00ebshtetja teknike mund t'ju refuzoj\u00eb sh\u00ebrbimin.<\/li>\n<\/ol>\n

          \nMund\u00ebsit\u00eb e implementimit (Distributed ose Standalone)<\/b><\/p>\n

          Pak m\u00eb sip\u00ebr kemi diskutuar \u00e7far\u00eb \u00ebsht\u00eb gateway (SG) dhe serveri i menaxhimit (SMS). Tani do t\u00eb diskutojm\u00eb opsionet e tyre t\u00eb implementimit. Ka dy m\u00ebnyra kryesore:<\/p>\n

            \n
          1. Standalone (SG+SMS)<\/b> \u2014 opsioni kur si gateway ashtu edhe serveri i menaxhimit instalohen n\u00eb nj\u00eb pajisje (ose makin\u00eb virtuale) t\u00eb vetme.\n

            \"Check
            \n
            \nKy ky\u00e7ja \u00ebsht\u00eb e p\u00ebrshtatshme kur keni vet\u00ebm nj\u00eb kalim, i cili nuk \u00ebsht\u00eb i ngarkuar shum\u00eb me trafik t\u00eb p\u00ebrdoruesve. Ky opsion \u00ebsht\u00eb m\u00eb ekonomik, pasi nuk ka nevoj\u00eb t\u00eb blini nj\u00eb server menaxhimi (SMS). Megjithat\u00eb, n\u00ebse kalimi \u00ebsht\u00eb n\u00ebn ngarkes\u00eb t\u00eb madhe, mund t\u00eb merrni nj\u00eb sistem menaxhimi \"t\u00eb ngadalsh\u00ebm\". Prandaj, para se t\u00eb zgjidhni nj\u00eb zgjidhje Standalone, \u00ebsht\u00eb m\u00eb mir\u00eb t\u00eb konsultoheni ose madje t\u00eb testi k\u00ebt\u00eb opsion.<\/p>\n<\/li>\n

          2. Distribuar<\/b> \u2014 serveri i menaxhimit instalohet ve\u00e7mas nga kalimi.\n

            \"Check
            \n
            \nOpsioni optimal n\u00eb aspektin e, komoditetit dhe performanc\u00ebs. P\u00ebrdoret kur \u00ebsht\u00eb e nevojshme t\u00eb menaxhoni disa kalime n\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb, si p\u00ebr shembull kalimi qendror dhe filialet. N\u00eb k\u00ebt\u00eb rast, k\u00ebrkohet blerja e nj\u00eb serveri menaxhimi (SMS), i cili gjithashtu mund t\u00eb jet\u00eb n\u00eb form\u00ebn e appliance (hardueri) ose t\u00eb nj\u00eb maune virtuale.<\/li>\n<\/ol>\n

            \nSi\u00e7 e p\u00ebrmenda pak m\u00eb lart, Check Point ka sistemin e vet SIEM \u2014 Smart Event. Mund ta p\u00ebrdorni vet\u00ebm n\u00eb rast se b\u00ebni nj\u00eb instalim t\u00eb Distribuar.<\/p>\n

            Modet e funksionimit (Bridge, Routed)<\/b>
            \nKalimi i siguris\u00eb (SG) mund t\u00eb punoj\u00eb n\u00eb dy moda kryesore:<\/p>\n