{"id":29991,"date":"2019-10-31T21:33:06","date_gmt":"2019-10-31T18:33:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/check-point-chto-eto-s-chem-ego-edyat-ili-korotko-o-glavnom\/"},"modified":"2019-10-31T21:33:06","modified_gmt":"2019-10-31T18:33:06","slug":"check-point-chto-eto-s-chem-ego-edyat-ili-korotko-o-glavnom","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/check-point-chto-eto-s-chem-ego-edyat-ili-korotko-o-glavnom","title":{"rendered":"Check Point. \u00c7far\u00eb \u00ebsht\u00eb, si e p\u00ebrdorim, ose p\u00ebrmbledhje e r\u00ebnd\u00ebsishme","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Check
\nP\u00ebrsh\u00ebndetje, t\u00eb dashur lexues t\u00eb habr\u00ebs! Ky \u00ebsht\u00eb blogu korporativ i kompanis\u00eb TS Solution<\/a><\/noindex>. Ne jemi integrues sistemi dhe kryesisht specializohemi n\u00eb zgjidhjet e siguris\u00eb s\u00eb infrastruktur\u00ebs IT (Check Point<\/a><\/noindex>, Fortinet<\/a><\/noindex>) dhe sistemet e analiz\u00ebs s\u00eb t\u00eb dh\u00ebnave t\u00eb makinerive (Splunk<\/a><\/noindex>). T\u00eb fillojm\u00eb blogun ton\u00eb me nj\u00eb hyrje t\u00eb vog\u00ebl n\u00eb teknologjit\u00eb Check Point.<\/p>\n

Ne kemi reflektuar gjat\u00eb mbi k\u00ebt\u00eb artikull, sepse nuk ka asgj\u00eb t\u00eb re q\u00eb nuk mund t\u00eb gjendet n\u00eb internet. Megjithat\u00eb, pavar\u00ebsisht nga kjo sasi informacioni, kur punojm\u00eb me klient\u00ebt dhe partner\u00ebt, shpesh d\u00ebgjojm\u00eb t\u00eb nj\u00ebjtat pyetje. Prandaj, vendos\u00ebm t\u00eb shkruajm\u00eb nj\u00eb hyrje n\u00eb bot\u00ebn e teknologjive Check Point dhe t\u00eb shpjegojm\u00eb thelbin e arkitektur\u00ebs s\u00eb zgjidhjeve t\u00eb tyre. Kjo do t\u00eb b\u00ebhet brenda nj\u00eb \u2018artikulli t\u00eb vog\u00ebl\u2019, si\u00e7 do ta quanim, nj\u00eb ekskursion t\u00eb shpejt\u00eb. Do t\u00eb p\u00ebrpiqemi t\u00eb mos hyjm\u00eb n\u00eb luft\u00eb marketingu, sepse nuk jemi nj\u00eb furnizues, por thjesht nj\u00eb integrues sistemesh (edhe pse e duam shum\u00eb Check Point) dhe do t\u00eb shqyrtojm\u00eb pikat kryesore pa i krahasuar ato me prodhues t\u00eb tjer\u00eb (si Palo Alto, Cisco, Fortinet, etj.). Artikulli ka dal\u00eb mjaft voluminoz, por ndihmon p\u00ebr t\u00eb p\u00ebrjashtuar nj\u00eb pjes\u00eb t\u00eb madhe t\u00eb pyetjeve n\u00eb faz\u00ebn e njohjes me Check Point. N\u00ebse jeni t\u00eb interesuar, mir\u00ebsevini n\u00ebn kat\u2026
\n<\/a><\/noindex>
\nUTM\/NGFW<\/b><\/p>\n

Kur flasim p\u00ebr Check Point, gj\u00ebja e par\u00eb q\u00eb duhen sqaruar \u00ebsht\u00eb se \u00e7far\u00eb jan\u00eb UTM dhe NGFW, si dhe \u00e7far\u00eb i ndan ato. Ne do ta b\u00ebjm\u00eb k\u00ebt\u00eb mjaft t\u00eb shkurt\u00ebr, p\u00ebr t\u00eb mos e b\u00ebr\u00eb postimin tep\u00ebr t\u00eb gjat\u00eb (ndoshta n\u00eb t\u00eb ardhmen do ta shqyrtojm\u00eb k\u00ebt\u00eb tem\u00eb m\u00eb n\u00eb detaje).<\/p>\n

UTM \u2014 Menaxhimi i K\u00ebrc\u00ebnimeve t\u00eb Bashkuara<\/b><\/p>\n

N\u00ebse do ta p\u00ebrmbledhim, thelbi i UTM \u00ebsht\u00eb konsolidimi i disa mjeteve mbrojt\u00ebse n\u00eb nj\u00eb zgjidhje. Pra, t\u00eb gjitha jan\u00eb n\u00eb nj\u00eb kuti ose nj\u00eb lloj all inclusive. \u00c7far\u00eb kuptohet me \u201cshum\u00eb mjete mbrojt\u00ebse\u201d? Varianti m\u00eb i zakonsh\u00ebm \u00ebsht\u00eb: Firewall-i, IPS, Proxy (filtrimi i URL-ve), antivirus i rrjedh\u00ebs, anti-spam, VPN dhe k\u00ebshtu me radh\u00eb. T\u00eb gjitha k\u00ebto mblidhen brenda nj\u00eb zgjidhjeje UTM, e cila \u00ebsht\u00eb m\u00eb e leht\u00eb p\u00ebr integrim, konfigurim, administrim dhe monitorim, dhe kjo ndikon pozitivisht n\u00eb mbrojtjen e p\u00ebrgjithshme t\u00eb rrjetit. Kur u shfaq\u00ebn p\u00ebr her\u00eb t\u00eb par\u00eb zgjidhjet UTM, ato shqyrtoheshin kryesisht p\u00ebr kompani t\u00eb vogla, p\u00ebr shkak se UTM nuk p\u00ebrballeshin me volumet e m\u00ebdha t\u00eb trafikut. Kjo ndodhte p\u00ebr dy arsye:<\/p>\n

    \n
  1. Metoda e p\u00ebrpunimit t\u00eb pakove. Versionet e para t\u00eb zgjidhjeve UTM i p\u00ebrpunonin paketat nj\u00eb her\u00eb pas nj\u00eb here, nga \u00e7do \"modul\". Shembulli: fillimisht pakoja p\u00ebrpunoheshe nga muri i mbrojtjes, pastaj nga IPS, m\u00eb pas kontrollohet nga Antivirus dhe k\u00ebshtu me radh\u00eb. Natyrisht, nj\u00eb mekaniz\u00ebm i till\u00eb shkaktonte vonesa serioze n\u00eb trafik dhe konsumonte shum\u00eb burime t\u00eb sistemit (procesor, memorie).<\/li>\n
  2. \u201cPajisje\u201d e dob\u00ebt. Si\u00e7 u tha m\u00eb sip\u00ebr, p\u00ebrpunimi i nj\u00ebpasht\u00ebm i pakove hante shum\u00eb burime dhe \u201cpajisjet\u201d e asaj kohe (1995-2005) thjesht nuk mund t\u00eb p\u00ebrballonin nj\u00eb trafik t\u00eb madh.<\/li>\n<\/ol>\n

    \nPor progresi nuk ndalon. Q\u00eb at\u00ebher\u00eb, kapacitetet harduerike jan\u00eb rritur ndjesh\u00ebm, nd\u00ebrsa p\u00ebrpunimi i pakove \u00ebsht\u00eb ndryshuar (duhet pranuar q\u00eb jo t\u00eb gjith\u00eb shit\u00ebsit e kan\u00eb b\u00ebr\u00eb k\u00ebt\u00eb) dhe tani lejon analiz\u00ebn gati t\u00eb nj\u00ebkohshme n\u00eb disa modulet (MTE, IPS, AntiVirus etj.). Zgjidhjet moderne UTM mund t\u00eb \u201cp\u00ebrpunojn\u00eb\u201d dhjet\u00ebra e madje qindra gigabit n\u00eb m\u00ebnyr\u00eb t\u00eb thell\u00eb, duke lejuar p\u00ebrdorimin e tyre n\u00eb sektorin e bizneseve t\u00eb m\u00ebdha apo madje edhe n\u00eb qendrat e t\u00eb dh\u00ebnave.<\/p>\n

    M\u00eb posht\u00eb \u00ebsht\u00eb paraqitur katrori magjik i njohur i Gartner p\u00ebr zgjidhjet UTM p\u00ebr gushtin 2016:<\/p>\n

    \"Check
    \n
    \nNuk do t\u00eb komentoj shum\u00eb k\u00ebt\u00eb imazh, thjesht do t\u00eb them se n\u00eb qoshen e sip\u00ebrme t\u00eb djatht\u00eb ndodhen lider\u00ebt.<\/p>\n

    NGFW \u2014 Firewall i Generat\u00ebs s\u00eb Re<\/b><\/p>\n

    Emri flet vet\u00eb \u2014 nj\u00eb firewall i generat\u00ebs s\u00eb re. Ky koncept u shfaq nd Significantly pas UTM. Idea kryesore e NGFW \u00ebsht\u00eb analiza e thelluar e paketave (DPI) n\u00ebp\u00ebrmjet nj\u00eb IPS t\u00eb integruar dhe ndarjen e aksesit n\u00eb nivelin e aplikacioneve (Kontrolli i Aplikacioneve). N\u00eb k\u00ebt\u00eb rast, IPS \u00ebsht\u00eb pik\u00ebrisht ajo q\u00eb nevojitet, p\u00ebr t\u00eb identifikuar aplikacionin n\u00eb rrjedh\u00ebn e paketimeve, q\u00eb lejon t\u00eb lejohet ose t\u00eb ndalohet. Shembull: Mund t\u00eb lejojm\u00eb funksionimin e Skype, por t\u00eb ndalojm\u00eb transferimin e skedar\u00ebve. Mund t\u00eb ndalojm\u00eb p\u00ebrdorimin e Torrent ose RDP. Gjithashtu, mb\u00ebshteten aplikacionet n\u00eb web: Mund t\u00eb lejojm\u00eb aksesin n\u00eb VK.com, por t\u00eb ndalojm\u00eb loj\u00ebrat, mesazhet ose shikimin e videove. N\u00eb thelb, cil\u00ebsia e NGFW varet nga numri i aplikacioneve q\u00eb ai mund t\u00eb identifikoj\u00eb. Shum\u00eb mendojn\u00eb se shfaqja e konceptit NGFW ishte nj\u00eb l\u00ebvizje e zakonshme marketingu, mbi t\u00eb cilin kompania Palo Alto filloi rritjen e saj t\u00eb shpejt\u00eb.<\/p>\n

    Kwadri magjik i Gartner p\u00ebr NGFW p\u00ebr maj 2016:<\/p>\n

    \"Check
    \n
    \nUTM vs NGFW<\/b><\/p>\n

    Nj\u00eb pyetje shum\u00eb e zakonshme \u00ebsht\u00eb, cila \u00ebsht\u00eb m\u00eb e mira? S\u2019ka nj\u00eb p\u00ebrgjigje t\u00eb qart\u00eb dhe nuk mund t\u00eb ket\u00eb. Sidomos duke marr\u00eb parasysh faktin se pothuajse t\u00eb gjitha zgjidhjet moderne UTM p\u00ebrmbajn\u00eb funksionalitetin NGFW dhe shumica e NGFW-ve p\u00ebrmbajn\u00eb funksione t\u00eb p\u00ebrbashk\u00ebta me UTM (Antivirus, VPN, Anti-Bot etj.). Si gjithmon\u00eb, \u201cdjalli q\u00ebndron n\u00eb detaje,\u201d ndaj s\u00eb pari duhet t\u00eb vendosni se \u00e7far\u00eb ju nevojitet konkretisht, t\u00eb p\u00ebrcaktoni buxhetin. Bazuar n\u00eb k\u00ebto vendime, mund t\u00eb zgjidhni disa opsione. Dhe gjith\u00e7ka duhet patjet\u00ebr t\u00eb testoni, pa e besuar materialin marketingu.<\/p>\n

    Ne, nga ana jon\u00eb, do t\u00eb p\u00ebrpiqemi n\u00eb disa artikuj t\u00eb flasim p\u00ebr Check Point, si mund ta provoni dhe \u00e7far\u00eb mund t\u00eb provoni n\u00eb p\u00ebrgjith\u00ebsi (praktikisht t\u00eb gjitha funksionalitetet).<\/p>\n

    Tre entitete t\u00eb Check Point<\/b><\/p>\n

    Kur punoni me Check Point, sigurisht do t\u00eb p\u00ebrballeni me tre p\u00ebrb\u00ebr\u00ebs t\u00eb k\u00ebtij produkti:<\/p>\n

    \"Check
    \n<\/p>\n

      \n
    1. Security Gateway (SG)<\/b> \u2014 vet\u00eb porta e siguris\u00eb, e cila zakonisht vendoset n\u00eb perimetrin e rrjetit dhe kryen funksione si fire\u00eball, antivirus n\u00eb koh\u00eb reale, anti-bot, IPS etj.<\/li>\n
    2. Security Management Server (SMS)<\/b> \u2014 serveri i menaxhimit t\u00eb portave. Praktikisht t\u00eb gjitha konfigurimet n\u00eb port\u00eb (SG) kryhen p\u00ebrmes k\u00ebtij serveri. SMS gjithashtu mund t\u00eb sh\u00ebrbej\u00eb si server log dhe t\u00eb p\u00ebrpunoj\u00eb ato me sistemin e tij t\u00eb integruar p\u00ebr analiz\u00ebn dhe korelacionin e ngjarjeve \u2014 Smart Event (i ngjash\u00ebm me SIEM p\u00ebr Check Point), por p\u00ebr k\u00ebt\u00eb do t\u00eb flasim m\u00eb von\u00eb. SMS p\u00ebrdoret p\u00ebr menaxhimin e centralizuar t\u00eb disa porteve (numri i porteve varet nga modeli i SMS ose nga licenca), megjithat\u00eb ju duhet ta p\u00ebrdorni at\u00eb, edhe n\u00ebse keni vet\u00ebm nj\u00eb port. Duhet theksuar se Check Point ishte nj\u00eb nga t\u00eb par\u00ebt q\u00eb p\u00ebrdor\u00ebn nj\u00eb sistem t\u00eb k\u00ebtij lloji t\u00eb menaxhimit t\u00eb centralizuar, i njohur p\u00ebr shum\u00eb vite si \u201cstandardi i art\u00eb\u201d sipas raporteve t\u00eb kompanis\u00eb Gartner. Ka edhe nj\u00eb shaka: \u201cN\u00ebse Cisco do t\u00eb kishte nj\u00eb sistem t\u00eb mir\u00eb menaxhimi, at\u00ebher\u00eb Check Point nuk do t\u00eb kishte ekzistuar kurr\u00eb.\u201d<\/li>\n
    3. Smart Console<\/b> \u2014 konsola klientike p\u00ebr lidhjen me serverin e menaxhimit (SMS). Zakonisht instalohet n\u00eb kompjuterin e administratorit. P\u00ebrmes k\u00ebsaj konsol\u00eb kryhen t\u00eb gjitha ndryshimet n\u00eb serverin e menaxhimit, dhe vet\u00ebm pas k\u00ebsaj mund t\u00eb aplikohet konfigurimi n\u00eb portat e siguris\u00eb (Install Policy).\n

      \"Check\n<\/li>\n<\/ol>\n

      \nSistemi operativ Check Point<\/b><\/p>\n

      Duke folosit sistemin operativ Check Point, menj\u00ebher\u00eb kujtohen tri: IPSO, SPLAT dhe GAIA.<\/p>\n

        \n
      1. IPSO<\/b> \u2014 sistemi operativ i kompanis\u00eb Ipsilon Networks, e cila i p\u00ebrkiste kompanis\u00eb Nokia. N\u00eb vitin 2009, Check Point e bleu k\u00ebt\u00eb biznes. Nuk po zhvillohet m\u00eb.<\/li>\n
      2. SPLAT<\/b> \u2014 zhvillimi i brendsh\u00ebm i Check Point, i bazuar n\u00eb thelbin RedHat. Nuk po zhvillohet m\u00eb.<\/li>\n
      3. Gaia<\/b> \u2014 sistemi operativ aktual nga Check Point, i cili erdhi si rezultat i bashkimit t\u00eb IPSO dhe SPLAT, duke p\u00ebrfshir\u00eb t\u00eb gjitha gj\u00ebrat m\u00eb t\u00eb mira. U shfaq n\u00eb vitin 2012 dhe vazhdon t\u00eb zhvillohet aktivisht.<\/li>\n<\/ol>\n

        \nDuke folur p\u00ebr Gaia, duhet th\u00ebn\u00eb se aktualisht versioni m\u00eb i p\u00ebrhapur \u00ebsht\u00eb R77.30. Versioni R80, i cili ndryshon duksh\u00ebm nga i m\u00ebparshmi (si n\u00eb funksionalitet ashtu edhe n\u00eb menaxhim), u shfaq relativisht koh\u00ebt e fundit. Tematika e dallimeve t\u00eb tyre do t\u2019i dedikojm\u00eb nj\u00eb postimi t\u00eb ve\u00e7ant\u00eb. Nj\u00eb tjet\u00ebr moment i r\u00ebnd\u00ebsish\u00ebm \u2014 aktualisht certifikata e FSTEK ekziston vet\u00ebm p\u00ebr versionin R77.10 dhe po zhvillohet certifikimi i versionit R77.30.<\/p>\n

        Varianta e ekzekutimit (Check Point Appliance, Virtual machine, OpenServer)<\/b><\/p>\n

        Nuk ka asgj\u00eb t\u00eb habitshme, si shumica e ofruesve, Check Point ka disa variante produkti:<\/p>\n

          \n
        1. Appliance<\/b> \u2014 pajisje softuerike dhe harduerike, pra, nj\u00eb \u201cgj\u00eb\u201d e vet. Ka shum\u00eb modele q\u00eb ndryshojn\u00eb n\u00eb performanc\u00eb, funksionalitet dhe nd\u00ebrtim (ka mund\u00ebsi p\u00ebr rrjetet industriale).\n

          \"Check<\/li>\n

        2. Makin\u00eb Virtuale<\/b> \u2014 makin\u00ebn virtuale Check Point me sistemin operativ Gaia. Mb\u00ebshteten hipervizor\u00ebt ESXi, Hyper-V, KVM. Licencohen sipas numrit t\u00eb b\u00ebrthamave t\u00eb procesorit.<\/li>\n
        3. OpenServer<\/b> \u2014 instalimi i Gaia direkt n\u00eb server si sistemin operativ kryesor (nj\u00ebsoj si \u201cBare metal\u201d). Mb\u00ebshtetet vet\u00ebm nj\u00eb \u201charduer\u201d i caktuar. Ka rekomandime p\u00ebr k\u00ebt\u00eb harduer, t\u00eb cilat duhet t\u00eb respektohen, p\u00ebrndryshe mund t\u00eb b\u00ebhen probleme me drejtp\u00ebrs\u00ebdrejti dhe suporti teknik mund t\u00eb refuzoj\u00eb sh\u00ebrbimin.<\/li>\n<\/ol>\n

          \nMund\u00ebsi implementimi (Ndar\u00eb ose t\u00eb Pavarur)<\/b><\/p>\n

          Pak m\u00eb lart, kemi diskutuar se \u00e7far\u00eb \u00ebsht\u00eb porta (SG) dhe serveri i menaxhimit (SMS). Tani do t\u00eb diskutojm\u00eb opsionet e tyre t\u00eb mund\u00ebsis\u00eb. Ka dy m\u00ebnyra t\u00eb r\u00ebnd\u00ebsishme:<\/p>\n

            \n
          1. T\u00eb Pavarur (SG+SMS)<\/b> \u2014 opsioni kur si porta ashtu edhe serveri i menaxhimit instalohen brenda nj\u00eb pajisjeje (ose nj\u00eb makine virtuale).\n

            \"Check
            \n
            \nKy ky\u00e7 n\u00eb p\u00ebrdorim kur keni vet\u00ebm nj\u00eb port\u00eb q\u00eb ka ngarkes\u00eb t\u00eb ul\u00ebt nga trafiku i p\u00ebrdoruesve. Ky variant \u00ebsht\u00eb m\u00eb ekonomik, pasi nuk ka nevoj\u00eb p\u00ebr blerjen e nj\u00eb serveri menaxhimi (SMS). Megjithat\u00eb, n\u00eb rast ngarkese t\u00eb madhe t\u00eb port\u00ebs, mund t\u00eb p\u00ebrjetoni nj\u00eb sistem menaxhimi \"t\u00eb ngadalt\u00eb\". Prandaj, p\u00ebrpara se\u00e7 ndiheni se zgjidhni nj\u00eb zgjidhje Standalone, \u00ebsht\u00eb m\u00eb mir\u00eb t\u00eb konsultoheni ose madje ta testoni k\u00ebt\u00eb variant.<\/p>\n<\/li>\n

          2. Distribuar<\/b> \u2014 serveri i menaxhimit instalohet ndaras nga porta.\n

            \"Check
            \n
            \nVariant optimal p\u00ebr sa i p\u00ebrket komoditetit dhe performanc\u00ebs. P\u00ebrdoret kur \u00ebsht\u00eb e nevojshme t\u00eb menaxhohen disa porta nj\u00ebkoh\u00ebsisht, p\u00ebr shembull nj\u00eb q\u00ebndrore dhe deg\u00ebt. N\u00eb k\u00ebt\u00eb rast nevojitet blerja e nj\u00eb serveri menaxhimi (SMS), i cili gjithashtu mund t\u00eb jet\u00eb n\u00eb form\u00eb appliance (pajisjesh) ose si nj\u00eb makin\u00eb virtuale.<\/li>\n<\/ol>\n

            \nSi\u00e7 e p\u00ebrmenda m\u00eb sip\u00ebr, Check Point ka nj\u00eb sistem t\u00eb vetin SIEM \u2014 Smart Event. Do ta p\u00ebrdorni vet\u00ebm n\u00eb rast t\u00eb instalimit t\u00eb Distribuar.<\/p>\n

            Modi t\u00eb funksionimit (Bridge, Routed)<\/b>
            \nPorta e siguris\u00eb (SG) mund t\u00eb punoj\u00eb n\u00eb dy m\u00ebnyra kryesore:<\/p>\n