{"id":31004,"date":"2019-10-31T21:38:50","date_gmt":"2019-10-31T18:38:50","guid":{"rendered":"https:\/\/prohoster.info\/blog\/testirovanie-pokazhet-kak-podgotovitsya-k-vnedreniyu-cisco-ise-i-ponyat-kakie-fichi-sistemy-vam-nuzhny\/"},"modified":"2019-10-31T21:38:50","modified_gmt":"2019-10-31T18:38:50","slug":"testirovanie-pokazhet-kak-podgotovitsya-k-vnedreniyu-cisco-ise-i-ponyat-kakie-fichi-sistemy-vam-nuzhny","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/testirovanie-pokazhet-kak-podgotovitsya-k-vnedreniyu-cisco-ise-i-ponyat-kakie-fichi-sistemy-vam-nuzhny","title":{"rendered":"Testimi do t\u00eb tregoj\u00eb se si t\u00eb p\u00ebrgatiteni p\u00ebr zbatimin e Cisco ISE dhe t\u00eb kuptoni se cilat ve\u00e7ori t\u00eb sistemit ju nevojiten","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Testimi
\n
\nSa shpesh bleni di\u00e7ka impulsivisht, duke iu n\u00ebnshtruar reklamave t\u00eb jasht\u00ebzakonshme, e pastaj ajo gj\u00eb q\u00eb e d\u00ebshironit fillimisht \u00ebsht\u00eb pluhurosur n\u00eb dollap, n\u00eb katin e posht\u00ebm apo n\u00eb garazhd deri n\u00eb pastrimin e radh\u00ebs ose duke u zhvendosur? Si rezultat, ndiheni t\u00eb zhg\u00ebnjyer p\u00ebr pritjet e pabazuara dhe parat\u00eb e harxhuara pa q\u00ebllim. \u00cbsht\u00eb shum\u00eb m\u00eb keq kur di\u00e7ka e till\u00eb ndodh n\u00eb biznes. Shpesh her\u00eb, truket e marketingut jan\u00eb aq t\u00eb mira sa kompanit\u00eb blejn\u00eb nj\u00eb zgjidhje t\u00eb shtrenjt\u00eb pa e par\u00eb t\u00ebr\u00ebsisht se si do t\u00eb p\u00ebrdoret. Nd\u00ebrkoh\u00eb, provimi i sistemit ndihmon n\u00eb kuptimin se si ta p\u00ebrgatisim infrastruktur\u00ebn p\u00ebr integrim, cilat funksionalitete dhe n\u00eb \u00e7far\u00eb sasi duhet t\u00eb implementohen. K\u00ebshtu, mund t\u00eb shmangim shum\u00eb probleme nga zgjedhja e produktit \"n\u00eb err\u00ebsir\u00eb\". P\u00ebr m\u00eb tep\u00ebr, implementimi pas nj\u00eb \"piloti\" t\u00eb mir\u00eb do t\u00eb sjell\u00eb shum\u00eb m\u00eb pak stres p\u00ebr inxhinier\u00ebt dhe m\u00eb pak flok\u00eb t\u00eb thinjura. Le t\u00eb shohim pse testimi pilot \u00ebsht\u00eb kaq i r\u00ebnd\u00ebsish\u00ebm p\u00ebr nj\u00eb projekt t\u00eb suksessh\u00ebm, duke marr\u00eb si shembull nj\u00eb mjet t\u00eb njohur p\u00ebr kontrollin e qasjes n\u00eb rrjetin korporativ \u2014 Cisco ISE. Do t\u00eb shqyrtojm\u00eb si p\u00ebrdorimet standarde ashtu edhe ato krejt t\u00eb pazakonta t\u00eb zgjidhjes q\u00eb kemi hasur n\u00eb praktik\u00ebn ton\u00eb.
\n<\/a><\/noindex><\/p>\n

Cisco ISE \u2014 \u00abRadius-server n\u00eb steroide\u00bb<\/h2>\n

\nCisco Identity Services Engine (ISE) \u00ebsht\u00eb nj\u00eb platform\u00eb p\u00ebr krijimin e nj\u00eb sistemi t\u00eb kontrollit t\u00eb qasjes n\u00eb rrjetin e brendsh\u00ebm t\u00eb organizat\u00ebs. N\u00eb komunitetin ekspert\u00eb, ky produkt \u00ebsht\u00eb quajtur \"Radius-server n\u00eb steroide\" p\u00ebr arsye. N\u00eb thelb, ky zgjidhje \u00ebsht\u00eb nj\u00eb server Radius, i cili \u00ebsht\u00eb pajisur me nj\u00eb s\u00ebr\u00eb sh\u00ebrbimesh dhe ve\u00e7orish t\u00eb m\u00ebdha, duke lejuar marrjen e nj\u00eb sasi t\u00eb madhe informacioni kontekstual dhe aplikimin e t\u00eb dh\u00ebnave t\u00eb marra n\u00eb politik\u00ebn e qasjes.<\/p>\n

Si \u00e7do server tjet\u00ebr Radius, Cisco ISE bie n\u00eb kontakt me pajisjet e rrjetit t\u00eb qasjes, mbledh informacion p\u00ebr t\u00eb gjitha p\u00ebrpjekjet p\u00ebr t'u lidhur me rrjetin korporativ dhe, p\u00ebrmes politikave t\u00eb autentikimit dhe autorizimit, lejon ose ndalon p\u00ebrdoruesit n\u00eb rrjetin lokal. Megjithat\u00eb, mund\u00ebsit\u00eb p\u00ebr profilizim, rregullim dhe integrim me zgjidhje t\u00eb tjera t\u00eb siguris\u00eb informatik\u00eb lejojn\u00eb q\u00eb logjika e politik\u00ebs s\u00eb autorizimit t\u00eb komplikohet ndjesh\u00ebm, duke zgjidhur k\u00ebshtu detyra mjaft t\u00eb nd\u00ebrlikuara dhe interesante.<\/p>\n

\"Testimi
\n<\/p>\n

T\u00eb implementosh nuk do t\u00eb thot\u00eb t\u00eb pilotosh: pse \u00ebsht\u00eb e nevojshme testimi?<\/h2>\n

\nVlera e testimit pilot \u00ebsht\u00eb n\u00eb demonstruarjen e t\u00eb gjitha mund\u00ebsive t\u00eb sistemit n\u00eb infrastruktur\u00ebn specifike t\u00eb organizat\u00ebs. Jam i bindur se pilotimi i Cisco ISE para zbatimit \u00ebsht\u00eb i dobish\u00ebm p\u00ebr t\u00eb gjitha pal\u00ebt e angazhuara n\u00eb projekt, dhe ja pse. <\/p>\n

Kjo u jep integrator\u00ebve nj\u00eb pasqyr\u00eb t\u00eb qart\u00eb t\u00eb pritshm\u00ebrive t\u00eb klientit dhe ndihmon n\u00eb formimin e nj\u00eb detyre teknike t\u00eb sakt\u00eb, e cila p\u00ebrmban shum\u00eb m\u00eb tep\u00ebr detaje sesa fraza e zakonshme \"b\u00ebni q\u00eb gjith\u00e7ka t\u00eb funksionoj\u00eb mir\u00eb\". \"Piloti\" na lejon t\u00eb kuptojm\u00eb n\u00eb thelb t\u00eb gjitha shqet\u00ebsimet e klientit, t\u00eb kuptojm\u00eb se cilat detyra jan\u00eb prioritare p\u00ebr t\u00eb dhe cilat jan\u00eb t\u00eb dyt\u00ebsore. P\u00ebr ne, kjo \u00ebsht\u00eb nj\u00eb mund\u00ebsi e shk\u00eblqyer p\u00ebr t\u00eb m\u00ebsuar paraprakisht se \u00e7far\u00eb pajisjesh p\u00ebrdoren n\u00eb organizat\u00eb, si do t\u00eb realizohet zbatimi, n\u00eb cilat lokacione, ku jan\u00eb ato etj. <\/p>\n

Klient\u00ebt gjat\u00eb testimit pilot shohin sistemin real n\u00eb veprim, njihet me nd\u00ebrfaqen e tij, kan\u00eb mund\u00ebsin\u00eb t\u00eb kontrollojn\u00eb n\u00ebse \u00ebsht\u00eb e p\u00ebrshtatshme me pajisjet e tyre ekzistuese dhe t\u00eb marrin nj\u00eb pamje t\u00eb plot\u00eb se si do t\u00eb funksionoj\u00eb zgjidhja pas zbatimit t\u00eb plot\u00eb. \"Piloti\" \u00ebsht\u00eb ai moment kur mund t\u00eb shoh\u00ebsh t\u00eb gjitha \"k\u00ebrc\u00ebnimet\" me t\u00eb cilat patjet\u00ebr do t\u00eb p\u00ebrballesh gjat\u00eb integrimit, dhe t\u00eb vendos\u00ebsh se sa licenca duhet t\u00eb blihen.
\n\u00c7far\u00eb mund t\u00eb \"shfaqet\" gjat\u00eb \"pilotit\"<\/p>\n

Pra, si t\u00eb p\u00ebrgatitemi si\u00e7 duhet p\u00ebr zbatimin e Cisco ISE? Sipas p\u00ebrvoj\u00ebs son\u00eb, identifikuam 4 pika kryesore q\u00eb \u00ebsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb merren parasysh gjat\u00eb procesit t\u00eb testimit pilot t\u00eb sistemit.<\/p>\n

Formati i bordit<\/h2>\n

\nS\u00eb pari, duhet t\u00eb p\u00ebrcaktoni n\u00ebse sistemi do t\u00eb zbatohet n\u00eb nj\u00eb format fizik ose virtual. Secila mund\u00ebsi ka avantazhe dhe disavantazhe. P\u00ebr shembull, nj\u00eb forc\u00eb e sistemit fizik \u00ebsht\u00eb parashikueshm\u00ebria e performanc\u00ebs, por nuk duhet harruar se k\u00ebto pajisje mund t\u00eb b\u00ebhen t\u00eb vjetra me kalimin e koh\u00ebs. Sistemet virtuale jan\u00eb m\u00eb pak t\u00eb parashikueshme, pasi varen nga pajisja mbi t\u00eb cil\u00ebn \u00ebsht\u00eb instaluar mjedisi virtualizues, por kan\u00eb nj\u00eb avantazh t\u00eb r\u00ebnd\u00ebsish\u00ebm: n\u00ebse ka mb\u00ebshtetje, ato gjithmon\u00eb mund t\u00eb p\u00ebrmir\u00ebsohen n\u00eb versionin m\u00eb t\u00eb fundit. <\/p>\n

A \u00ebsht\u00eb pajisja juaj rrjetore e p\u00ebrputhshme me Cisco ISE?<\/h2>\n

\nNatyrisht, skenari ideal do t\u00eb ishte t\u00eb lidhnit t\u00eb gjitha pajisjet me sistemin menj\u00ebher\u00eb. Megjithat\u00eb, kjo nuk \u00ebsht\u00eb gjithmon\u00eb e mundur, pasi shum\u00eb organizata ende p\u00ebrdorin switch-e t\u00eb pa menaxhuara ose switch-e q\u00eb nuk mb\u00ebshtesin disa teknologji mbi t\u00eb cilat funksionon Cisco ISE. P\u00ebr ta th\u00ebn\u00eb, kjo nuk ka t\u00eb b\u00ebj\u00eb vet\u00ebm me switch-et, por gjithashtu mund t\u00eb jen\u00eb kontrollues t\u00eb rrjetit t\u00eb wireless. VPN<\/a>-koncentrator\u00ebt dhe \u00e7do pajisje tjet\u00ebr q\u00eb lidhet me p\u00ebrdoruesit. N\u00eb praktik\u00ebn time kan\u00eb ndodhur raste kur, pas demonstruar sistemin p\u00ebr implementim t\u00eb plot\u00eb, klienti ka rehabilituar pothuajse t\u00ebr\u00eb parkun e switch-\u00ebve t\u00eb nivelit t\u00eb hyrjes me pajisje moderne Cisco. P\u00ebr t\u00eb shmangur surpriza t\u00eb pak\u00ebndshme, \u00ebsht\u00eb e men\u00e7ur q\u00eb t\u00eb zbulohet paraprakisht p\u00ebrqindja e pajisjeve q\u00eb nuk p\u00ebrkrahen. <\/p>\n

A gjitha pajisjet tuaja jan\u00eb standarde?<\/h2>\n

\nN\u00eb \u00e7do rrjet ka pajisje standarde, p\u00ebr lidhjen me t\u00eb cilat nuk duhet t\u00eb ket\u00eb ndonj\u00eb v\u00ebshtir\u00ebsi: vendet e pun\u00ebs t\u00eb automatizuara, telefonat IP, pikave t\u00eb aksesit Wi-Fi, kamerat e videove dhe k\u00ebshtu me radh\u00eb. Por ndodhin edhe raste kur n\u00eb LAN duhet t\u00eb lidhen pajisje jo standarde, p\u00ebr shembull, konvertor\u00eb sinjalesh t\u00eb autobusit RS232\/Ethernet, nd\u00ebrfaqet e burimeve t\u00eb energjis\u00eb t\u00eb pand\u00ebrprer\u00eb, pajisje teknologjike t\u00eb ndryshme etj. \u00cbsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb p\u00ebrcaktohet lista e k\u00ebtyre pajisjeve paraprakisht, n\u00eb m\u00ebnyr\u00eb q\u00eb n\u00eb faz\u00ebn e implementimit t\u00eb keni nj\u00eb kuptim se si teknikisht do t\u00eb funksiononin ato me Cisco ISE.<\/p>\n

Dialog konstruktiv me IT-ister<\/h2>\n

\nFillesa zakonisht, departamentet e siguris\u00eb tregojn\u00eb interes p\u00ebr Cisco ISE, nd\u00ebrsa nd\u00ebrlidhja e switch-\u00ebve t\u00eb nivelit t\u00eb aksesit dhe Active Directory zakonisht \u00ebsht\u00eb p\u00ebrgjegj\u00ebsi e departamenteve IT. K\u00ebshtu, bashk\u00ebpunimi produktiv midis siguris\u00eb dhe IT-s\u00eb \u00ebsht\u00eb nj\u00eb nga kushtet e r\u00ebnd\u00ebsishme p\u00ebr implementimin pa probleme t\u00eb sistemit. N\u00ebse departamenti i IT-s\u00eb e sheh integrimin me skepticiz\u00ebm, \u00ebsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb shpjegohet se si zgjidhja do t'u sjell\u00eb p\u00ebrfitime atyre.<\/p>\n

Top-5 rastet e p\u00ebrdorimit t\u00eb Cisco ISE<\/h2>\n

\nSipas p\u00ebrvoj\u00ebs son\u00eb, funksionaliteti i nevojsh\u00ebm i sistemit gjithashtu identifikohet n\u00eb faz\u00ebn e testimit pilot. M\u00eb posht\u00eb jan\u00eb disa nga rastet m\u00eb t\u00eb njohura dhe m\u00eb t\u00eb rralla t\u00eb p\u00ebrdorimit t\u00eb zgjidhjes. <\/p>\n

Qasje e sigurt n\u00eb VLAN p\u00ebrmes kabllit me EAP-TLS<\/h4>\n

\nSipas rezultateve t\u00eb hulumtimeve t\u00eb pentester\u00ebve tan\u00eb, shpesh her\u00eb p\u00ebr t\u00eb infiltruar n\u00eb rrjetin e kompanis\u00eb, keqb\u00ebr\u00ebsit p\u00ebrdorin prizat e zakonshme, t\u00eb cilat jan\u00eb t\u00eb lidhura me printer\u00ebt, telefonat, kamerat IP, piketat Wi-Fi dhe pajisje t\u00eb tjera rrjetesh q\u00eb nuk jan\u00eb personale. Prandaj, edhe n\u00ebse qasja n\u00eb rrjet realizohet mbi teknologjin\u00eb dot1x, por p\u00ebrdoren protokolle alternative pa p\u00ebrdorimin e certifikatave p\u00ebr t\u00eb v\u00ebrtetuar identitetin e p\u00ebrdoruesve, ka nj\u00eb probabilitet t\u00eb lart\u00eb p\u00ebr nj\u00eb sulm t\u00eb suksessh\u00ebm me kapjen e sesioneve dhe brute force mbi fjal\u00ebkalimet. N\u00eb rastin me Cisco ISE, t\u00eb braktis\u00ebsh certifikat\u00ebn do t\u00eb jet\u00eb shum\u00eb m\u00eb e v\u00ebshtir\u00eb \u2014 p\u00ebr k\u00ebt\u00eb, haker\u00ebt do t\u00eb ken\u00eb nevoj\u00eb p\u00ebr shum\u00eb m\u00eb shum\u00eb kapacitete p\u00ebrllogarit\u00ebse, k\u00ebshtu q\u00eb ky rast \u00ebsht\u00eb mjaft efektiv.<\/p>\n

Qasja pa tel Dual-SSID <\/h4>\n

\nThe essence of this scenario lies in the use of 2 network identifiers (SSIDs). One can be conditionally referred to as the \"guest\" SSID. Both guests and company employees can connect to this wireless network. However, employees are redirected to a special portal upon attempting to connect, where provisioning occurs. This means that a certificate is issued to the user, and their personal device is configured for automatic reconnection to the second SSID, where EAP-TLS is used with all the benefits of the first case.<\/p>\n

MAC Authentication Bypass and profiling<\/h4>\n

\nNj\u00eb tjet\u00ebr rast popullor lidhet me p\u00ebrcaktimin automatik t\u00eb llojit t\u00eb pajisjes s\u00eb lidhur dhe aplikimin e kufizimeve t\u00eb duhura mbi t\u00eb. \u00c7far\u00eb e b\u00ebn k\u00ebt\u00eb interesante? Faktikisht, ende ekzistojn\u00eb shum\u00eb pajisje q\u00eb nuk mb\u00ebshtesin autentifikimin sipas protokollit 802.1X. Prandaj, p\u00ebr t\u00eb lejuar k\u00ebto pajisje n\u00eb rrjet, ato duhet t\u00eb lidheshin p\u00ebrmes adres\u00ebs MAC, e cila \u00ebsht\u00eb shum\u00eb e leht\u00eb p\u00ebr t'u falsifikuar. Cisco ISE vjen n\u00eb ndihm\u00eb: me k\u00ebt\u00eb sistem mund t\u00eb shihni si sillet pajisja n\u00eb rrjet, t\u00eb krijoni profilin e saj dhe ta lidhni me nj\u00eb grup pajisjesh t\u00eb tjera, si telefoni IP dhe stacioni i pun\u00ebs. N\u00eb rast se nj\u00eb sulmues p\u00ebrpiqet t\u00eb falsifikoj\u00eb adres\u00ebn MAC dhe t\u00eb lidhet n\u00eb rrjet, sistemi do t\u00eb v\u00ebrej\u00eb se profili i pajisjes \u00ebsht\u00eb ndryshuar, do t\u00eb jap\u00eb nj\u00eb sinjal p\u00ebr sjellje t\u00eb dyshimt\u00eb dhe nuk do ta lejoj\u00eb p\u00ebrdoruesin e dyshimt\u00eb t\u00eb hyj\u00eb n\u00eb rrjet. <\/p>\n

EAP-Chaining <\/h4>\n

\nTeknologjia EAP-Chaining p\u00ebrfshin autentifikimin e renditsh\u00ebm t\u00eb PC-ve dhe llogarive t\u00eb p\u00ebrdoruesve. Ky rast \u00ebsht\u00eb b\u00ebr\u00eb i njohur, pasi n\u00eb shum\u00eb kompani ende nuk k\u00ebrc\u00ebnohet lidhja e pajisjeve personale t\u00eb punonj\u00ebsve me rrjetin korporativ. Duke p\u00ebrdorur k\u00ebt\u00eb qasje p\u00ebr autentifikimin, mund t\u00eb kontrollohet n\u00ebse nj\u00eb stacion i caktuar i pun\u00ebs \u00ebsht\u00eb an\u00ebtar i domain-it, dhe n\u00eb rastin negativ, p\u00ebrdoruesi ose nuk do t\u00eb hyj\u00eb n\u00eb rrjet, ose do t\u00eb hyj\u00eb, por me disa kufizime.<\/p>\n

Posturing <\/h4>\n

\nN\u00eb k\u00ebt\u00eb rast b\u00ebhet fjal\u00eb p\u00ebr vler\u00ebsimin e p\u00ebrputhshm\u00ebris\u00eb s\u00eb p\u00ebrb\u00ebrjes s\u00eb softuerit n\u00eb stacionin e pun\u00ebs me k\u00ebrkesat e siguris\u00eb informatike. Me k\u00ebt\u00eb teknologji mund t\u00eb kontrolloni n\u00ebse softueri n\u00eb stacionin e pun\u00ebs \u00ebsht\u00eb i p\u00ebrdit\u00ebsuar, n\u00ebse jan\u00eb instaluar mjete mbrojt\u00ebse, n\u00ebse \u00ebsht\u00eb konfiguruar bllokuesi i hostit, etj. \u00cbsht\u00eb interesant se kjo teknologji gjithashtu lejon zgjidhjen e detyrave t\u00eb tjera, jo t\u00eb lidhura me sigurin\u00eb, p\u00ebr shembull, t\u00eb kontrolloni n\u00ebse ka skedar\u00eb t\u00eb nevojsh\u00ebm ose instalimin e softuerit t\u00eb p\u00ebrgjithsh\u00ebm.<\/p>\n

Nj\u00ebher\u00eb e kishim t\u00eb zakonshme gjithashtu skenar\u00ebt e p\u00ebrdorimit t\u00eb Cisco ISE, si kontrolle t\u00eb qasjes me autentifikim t\u00eb vazhduesh\u00ebm t\u00eb domainit (Passive ID), mikrosigmentacioni t\u00eb bazuar n\u00eb SGT dhe filtrimi, si dhe integrimi me sistemet e menaxhimit t\u00eb pajisjeve mobile (MDM) dhe skanuesit e dob\u00ebsive (Vulnerability Scanner). <\/p>\n

Projektet e jashtme: pse mund t\u00eb nevojitet Cisco ISE, ose 3 raste t\u00eb rralla nga praktika jon\u00eb.<\/p>\n

Kontrolli i qasjes n\u00eb serverat me baz\u00eb Linux.<\/h2>\n

\nNj\u00eb her\u00eb po zgjidhnim nj\u00eb rast mjaft jo t\u00eb zakonsh\u00ebm p\u00ebr nj\u00eb nga klient\u00ebt tan\u00eb, i cili kishte implementuar tashm\u00eb sistemin Cisco ISE: na duhej t\u00eb gjenim nj\u00eb m\u00ebnyr\u00eb p\u00ebr t\u00eb kontrolluar veprimet e p\u00ebrdoruesve (n\u00eb shumic\u00ebn e rasteve ishin administrator\u00eb) n\u00eb server\u00ebt me sistemin operativ Linux t\u00eb instaluar. N\u00eb k\u00ebrkim t\u00eb nj\u00eb p\u00ebrgjigjeje, na erdhi ideja t\u00eb angazhonim softuerin e lir\u00eb PAM Radius Module, i cili lejonte hyrjen n\u00eb server\u00ebt n\u00ebn menaxhimin e Linux me autentifikimin n\u00eb nj\u00eb server radius t\u00eb jasht\u00ebm. \u00c7do gj\u00eb do t\u00eb ishte mir\u00eb n\u00eb k\u00ebt\u00eb plan, po megjithat\u00eb kishte nj\u00eb \"por\": serveri radius, kur d\u00ebrgon p\u00ebrgjigjen p\u00ebr k\u00ebrkes\u00ebn e autentifikimit, jep vet\u00ebm emrin e llogaris\u00eb dhe rezultatin - assess accepted ose assess rejected. Megjithat\u00eb, p\u00ebr autorizimin n\u00eb Linux duhen caktuar t\u00eb pakt\u00ebn nj\u00eb parametr tjet\u00ebr - direktoria e sht\u00ebpis\u00eb, n\u00eb m\u00ebnyr\u00eb q\u00eb p\u00ebrdoruesi t\u00eb mund t\u00eb hynte diku. Ne nuk gjet\u00ebm nj\u00eb m\u00ebnyr\u00eb p\u00ebr ta kthyer k\u00ebt\u00eb si atribut radius, prandaj shkruam nj\u00eb skript t\u00eb ve\u00e7ant\u00eb p\u00ebr krijimin e llogarive n\u00eb distanc\u00eb n\u00eb host\u00ebt n\u00eb nj\u00eb m\u00ebnyr\u00eb gjysm\u00eb-automatike. Kjo detyr\u00eb ishte plot\u00ebsisht e realizueshme, pasi kishim t\u00eb b\u00ebnim me llogarit\u00eb e administrator\u00ebve, numri i t\u00eb cil\u00ebve nuk ishte shum\u00eb i madh. M\u00eb pas, p\u00ebrdoruesit hynin n\u00eb pajisjen e nevojshme, pas s\u00eb cil\u00ebs u jepeshin akseset e nevojshme. Lind pyetja e arsyeshme: a \u00ebsht\u00eb e domosdoshme t\u00eb p\u00ebrdoret pik\u00ebrisht Cisco ISE n\u00eb raste t\u00eb ngjashme? N\u00eb fakt jo \u2014 \u00e7do server radius do t\u00eb ishte i p\u00ebrshtatsh\u00ebm, por duke qen\u00eb se klienti kishte tashm\u00eb k\u00ebt\u00eb sistem, ne thjesht i shtuam nj\u00eb funksionalitet t\u00eb ri.<\/p>\n

Inventarizimi i \"harduerit\" dhe software-it n\u00eb rrjetin lokale<\/h2>\n

\nNj\u00eb her\u00eb punonim n\u00eb nj\u00eb projekt p\u00ebr cungimin e Cisco ISE p\u00ebr nj\u00eb klient pa nj\u00eb \"pilot\" t\u00eb parapar\u00eb. Nuk kishte k\u00ebrkesa t\u00eb qarta p\u00ebr zgjidhjen, plus q\u00eb kishim t\u00eb b\u00ebnim me nj\u00eb rrjet t\u00eb shesht\u00eb, pa segmente, q\u00eb e v\u00ebshtir\u00ebsonte pun\u00ebn ton\u00eb. Gjat\u00eb projektit ne konfiguram t\u00eb gjitha metodat e profilizimit q\u00eb mb\u00ebshteste rrjeti: NetFlow, DHCP, SNMP, integrimi me AD, etj. N\u00eb fund u konfigura qasje me MAR me mund\u00ebsin\u00eb p\u00ebr t'u futur n\u00eb rrjet edhe n\u00eb rast autentifikimi t\u00eb d\u00ebshtuar. K\u00ebshtu q\u00eb, edhe n\u00ebse autentifikimi nuk kishte qen\u00eb i suksessh\u00ebm, sistemi ende lejonte p\u00ebrdoruesin t\u00eb hyj\u00eb n\u00eb rrjet, duke mbledhur informacion rreth tij dhe regjistruar at\u00eb n\u00eb baz\u00ebn e t\u00eb dh\u00ebnave ISE. Ky monitorim i rrjetit p\u00ebr nj\u00eb periudh\u00eb disa jav\u00ebsh na ndihmoi t\u00eb identifikonim sistemet e lidhura dhe pajisjet jo personale dhe t\u00eb zhvillonim nj\u00eb qasje p\u00ebr segmentimin e tyre. Pas k\u00ebsaj, ne gjithashtu konfiguram ndarjen p\u00ebr instalimin e agjentit n\u00eb stacionet e pun\u00ebs me q\u00ebllim mbledhjen e informacionit mbi software-n e instaluar n\u00eb to. \u00c7far\u00eb arrit\u00ebm? Na arriti t\u00eb segmentonim rrjetin dhe t\u00eb p\u00ebrcaktonim list\u00ebn e software-ve q\u00eb duhej t\u00eb hiqeshin nga stacionet e pun\u00ebs. Nuk do t\u00eb fsheh, detyrat e m\u00ebtejshme p\u00ebr shp\u00ebrndarjen e p\u00ebrdoruesve n\u00eb grupet e domain-it dhe ndarjen e t\u00eb drejtave t\u00eb aksesit na mor\u00ebn shum\u00eb koh\u00eb, por k\u00ebshtu arrit\u00ebm nj\u00eb pamje t\u00eb plot\u00eb t\u00eb asaj q\u00eb ishte \"hardueri\" n\u00eb rrjetin e klientit. P\u00ebr t\u00eb th\u00ebn\u00eb t\u00eb v\u00ebrtet\u00ebn, kjo nuk ishte e v\u00ebshtir\u00eb fal\u00eb pun\u00ebs s\u00eb mir\u00eb t\u00eb profilizimit \"jasht\u00eb kutis\u00eb\". N\u00eb vendet ku profilizimi nuk ndihmoi, ne e shqyrtuam vet\u00eb, duke ndar\u00eb portin e swit\u00e7it, t\u00eb cilit ishte e lidhur pajisja. <\/p>\n

Instalimi i larg\u00ebt i softuerit n\u00eb stacionet e pun\u00ebs<\/h2>\n

\nKy rasti \u00ebsht\u00eb nj\u00eb nga m\u00eb t\u00eb \u00e7uditshmit n\u00eb praktik\u00ebn time. Nj\u00ebher\u00eb, nj\u00eb klient na u drejtuar me nj\u00eb thirrje p\u00ebr ndihm\u00eb \u2014 gjat\u00eb implementimit t\u00eb Cisco ISE, di\u00e7ka shkoi keq, gjith\u00e7ka u prish, dhe askush tjet\u00ebr nuk mund t\u00eb kishte qasje n\u00eb rrjet. Filluam t\u00eb hetonim dhe zbuluam se sa vijon. N\u00eb kompani kishte 2000 kompjuter\u00eb, menaxhimi i t\u00eb cil\u00ebve p\u00ebr munges\u00eb t\u00eb nj\u00eb kontrolluesi t\u00eb domainit kryhej nga llogaria e administratorit. N\u00eb q\u00ebllim t\u00eb mbik\u00ebqyrjes, u implementua Cisco ISE. Duhej t\u00eb kuptohej se a ishte instaluar antivirus n\u00eb kompjuter\u00ebt ekzistues, a ishte p\u00ebrdit\u00ebsuar mjedisi i softuerit, etj. Dhe pasi q\u00eb pajisjet rrjet\u00ebrore u t\u00ebrhoq\u00ebn n\u00eb sistem nga administrator\u00ebt IT, ishte logjike q\u00eb ata t\u00eb kishin qasje n\u00eb t\u00eb. Pas shikimit se si funksiononte dhe duke kryer mbik\u00ebqyrjen e kompjuter\u00ebve t\u00eb tyre, administrator\u00ebt shpik\u00ebn m\u00ebnyr\u00ebn p\u00ebr t\u00eb instaluar softuer n\u00eb stacionet e pun\u00ebs t\u00eb punonj\u00ebsve n\u00eb distanc\u00eb pa vizita personale. Vet\u00ebm imagjinoni sa hapa mund t\u00eb kursenin gjat\u00eb dit\u00ebs! Administrator\u00ebt b\u00ebn\u00eb disa kontrollime t\u00eb ARM p\u00ebr pranin\u00eb e nj\u00eb skedari t\u00eb caktuar n\u00eb drejtorin\u00eb C:Program Files, dhe n\u00eb munges\u00eb t\u00eb tij aktivizohej nj\u00eb rimedim automatike me nj\u00eb lidhje q\u00eb \u00e7onte n\u00eb arkiv\u00ebn e skedar\u00ebve p\u00ebr skedarin instalues .exe. Kjo i lejonte p\u00ebrdoruesit t\u00eb hyjn\u00eb n\u00eb arkiv\u00ebn e skedar\u00ebve dhe t\u00eb shkarkonin softuerin e nevojsh\u00ebm nga aty. Fatkeq\u00ebsisht, administratori nuk e dinte mir\u00eb sistemin ISE dhe d\u00ebmtoi mekanizmat e mbik\u00ebqyrjes \u2014 shkroi politik\u00ebn gabim, \u00e7ka \u00e7oi n\u00eb problemin p\u00ebr t\u00eb cilin na thirr\u00ebn ne. Personalisht, jam sinqerisht i habitur nga ky qasje kaq kreativ, sepse do t\u00eb kishte qen\u00eb shum\u00eb m\u00eb lir\u00eb dhe m\u00eb pak e lodhshme t\u00eb krijohej nj\u00eb kontrollues domaini. Por si prova e konceptit, kjo funksionoi.<\/p>\n

M\u00eb shum\u00eb rreth nuancave teknike q\u00eb shfaqen gjat\u00eb implementimit t\u00eb Cisco ISE, lexoni n\u00eb artikullin e kolegut tim \u00abPraktika e implementimit t\u00eb Cisco ISE. Pamje nga inxhinieri\u00bb<\/a><\/noindex>.<\/p>\n

Artem Bobrikov, inxhinier projektues n\u00eb Qendr\u00ebn e Siguris\u00eb Informatike t\u00eb kompanis\u00eb \u00abInfosystems Jet\u00bb<\/i><\/p>\n

Pasth\u00ebnie<\/b>:
\nPavar\u00ebsisht se ky post p\u00ebrshkruan sistemin Cisco ISE, problematika e p\u00ebrshkruar \u00ebsht\u00eb e r\u00ebnd\u00ebsishme p\u00ebr t\u00eb gjith\u00eb klas\u00ebn e zgjidhjeve NAC. Nuk ka shum\u00eb r\u00ebnd\u00ebsi se cilin zgjidhje t\u00eb nj\u00eb prodhuesi planifikoni t\u00eb implementoni, pjesa m\u00eb e madhe e th\u00ebnieve t\u00eb m\u00ebsip\u00ebrme do t\u00eb mbeten t\u00eb aplicueshme.
\n
Burimi: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u0430\u043a \u0447\u0430\u0441\u0442\u043e \u0432\u044b \u043f\u043e\u043a\u0443\u043f\u0430\u0435\u0442\u0435 \u0447\u0442\u043e-\u0442\u043e \u0441\u043f\u043e\u043d\u0442\u0430\u043d\u043d\u043e, \u043f\u043e\u0434\u0434\u0430\u0432\u0448\u0438\u0441\u044c \u043a\u0440\u0443\u0442\u043e\u0439 \u0440\u0435\u043a\u043b\u0430\u043c\u0435, \u0430 \u043f\u043e\u0442\u043e\u043c \u044d\u0442\u0430 \u0438\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u0436\u0435\u043b\u0430\u043d\u043d\u0430\u044f \u0432\u0435\u0449\u044c \u043f\u044b\u043b\u0438\u0442\u0441\u044f \u0432 \u0448\u043a\u0430\u0444\u0443, \u043a\u043b\u0430\u0434\u043e\u0432\u043a\u0435 \u0438\u043b\u0438 \u0433\u0430\u0440\u0430\u0436\u0435 \u0434\u043e \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u043e\u0439 \u0433\u0435\u043d\u0435\u0440\u0430\u043b\u044c\u043d\u043e\u0439 \u0443\u0431\u043e\u0440\u043a\u0438 \u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u0435\u0437\u0434\u0430? \u041a\u0430\u043a \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442 \u2014 \u0440\u0430\u0437\u043e\u0447\u0430\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0438\u0437-\u0437\u0430 \u043d\u0435\u043e\u043f\u0440\u0430\u0432\u0434\u0430\u043d\u043d\u044b\u0445 \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u0439 \u0438 \u0432\u043f\u0443\u0441\u0442\u0443\u044e \u043f\u043e\u0442\u0440\u0430\u0447\u0435\u043d\u043d\u044b\u0445 \u0434\u0435\u043d\u0435\u0433. \u0413\u043e\u0440\u0430\u0437\u0434\u043e \u0445\u0443\u0436\u0435, \u043a\u043e\u0433\u0434\u0430 \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0435 \u0441\u043b\u0443\u0447\u0430\u0435\u0442\u0441\u044f \u0441 \u0431\u0438\u0437\u043d\u0435\u0441\u043e\u043c. \u041e\u0447\u0435\u043d\u044c \u0447\u0430\u0441\u0442\u043e \u043c\u0430\u0440\u043a\u0435\u0442\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u0442\u0440\u044e\u043a\u0438 \u0431\u044b\u0432\u0430\u044e\u0442 \u043d\u0430\u0441\u0442\u043e\u043b\u044c\u043a\u043e \u0445\u043e\u0440\u043e\u0448\u0438, \u0447\u0442\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u043f\u0440\u0438\u043e\u0431\u0440\u0435\u0442\u0430\u044e\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":22980,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31004","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Testimi do t\u00eb tregoj\u00eb: si t\u00eb p\u00ebrgatiteni p\u00ebr implementimin e Cisco ISE dhe t\u00eb kuptoni se cilat karakteristika t\u00eb sistemit ju nevojiten | ProHoster","description":"Sa shpesh blini di\u00e7ka spontanisht, duke u l\u00ebn\u00eb pas reklamave t\u00eb shk\u00eblqyera, dhe pastaj ajo gj\u00eb q\u00eb fillimisht d\u00ebshirohej q\u00ebndron duke pluhurosur n\u00eb dollap, bodrum, ose garazh deri n\u00eb pastrimin e r\u00ebnd\u00ebsish\u00ebm apo l\u00ebvizje? Si rezultat \u2014 zhg\u00ebnjim p\u00ebr shkak t\u00eb pritjeve t\u00eb pamjaftueshme dhe parave t\u00eb shpenzuara pa nevoj\u00eb. Edhe m\u00eb keq, kur di\u00e7ka e till\u00eb ndodh me biznesin. Shpeshher\u00eb truket marketingu jan\u00eb aq t\u00eb mira sa kompani b\u00ebjn\u00eb","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/testirovanie-pokazhet-kak-podgotovitsya-k-vnedreniyu-cisco-ise-i-ponyat-kakie-fichi-sistemy-vam-nuzhny","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0422\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u043a\u0430\u0436\u0435\u0442: \u043a\u0430\u043a \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u0442\u044c\u0441\u044f \u043a \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044e Cisco ISE \u0438 \u043f\u043e\u043d\u044f\u0442\u044c, \u043a\u0430\u043a\u0438\u0435 \u0444\u0438\u0447\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432\u0430\u043c \u043d\u0443\u0436\u043d\u044b | ProHoster","og:description":"\u041a\u0430\u043a \u0447\u0430\u0441\u0442\u043e \u0432\u044b \u043f\u043e\u043a\u0443\u043f\u0430\u0435\u0442\u0435 \u0447\u0442\u043e-\u0442\u043e \u0441\u043f\u043e\u043d\u0442\u0430\u043d\u043d\u043e, \u043f\u043e\u0434\u0434\u0430\u0432\u0448\u0438\u0441\u044c \u043a\u0440\u0443\u0442\u043e\u0439 \u0440\u0435\u043a\u043b\u0430\u043c\u0435, \u0430 \u043f\u043e\u0442\u043e\u043c \u044d\u0442\u0430 \u0438\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u0436\u0435\u043b\u0430\u043d\u043d\u0430\u044f \u0432\u0435\u0449\u044c \u043f\u044b\u043b\u0438\u0442\u0441\u044f \u0432 \u0448\u043a\u0430\u0444\u0443, \u043a\u043b\u0430\u0434\u043e\u0432\u043a\u0435 \u0438\u043b\u0438 \u0433\u0430\u0440\u0430\u0436\u0435 \u0434\u043e \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u043e\u0439 \u0433\u0435\u043d\u0435\u0440\u0430\u043b\u044c\u043d\u043e\u0439 \u0443\u0431\u043e\u0440\u043a\u0438 \u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u0435\u0437\u0434\u0430? \u041a\u0430\u043a \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442 \u2014 \u0440\u0430\u0437\u043e\u0447\u0430\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0438\u0437-\u0437\u0430 \u043d\u0435\u043e\u043f\u0440\u0430\u0432\u0434\u0430\u043d\u043d\u044b\u0445 \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u0439 \u0438 \u0432\u043f\u0443\u0441\u0442\u0443\u044e \u043f\u043e\u0442\u0440\u0430\u0447\u0435\u043d\u043d\u044b\u0445 \u0434\u0435\u043d\u0435\u0433. \u0413\u043e\u0440\u0430\u0437\u0434\u043e \u0445\u0443\u0436\u0435, \u043a\u043e\u0433\u0434\u0430 \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0435 \u0441\u043b\u0443\u0447\u0430\u0435\u0442\u0441\u044f \u0441 \u0431\u0438\u0437\u043d\u0435\u0441\u043e\u043c. \u041e\u0447\u0435\u043d\u044c \u0447\u0430\u0441\u0442\u043e \u043c\u0430\u0440\u043a\u0435\u0442\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u0442\u0440\u044e\u043a\u0438 \u0431\u044b\u0432\u0430\u044e\u0442 \u043d\u0430\u0441\u0442\u043e\u043b\u044c\u043a\u043e \u0445\u043e\u0440\u043e\u0448\u0438, \u0447\u0442\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u043f\u0440\u0438\u043e\u0431\u0440\u0435\u0442\u0430\u044e\u0442","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/testirovanie-pokazhet-kak-podgotovitsya-k-vnedreniyu-cisco-ise-i-ponyat-kakie-fichi-sistemy-vam-nuzhny","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:38:50+00:00","article:modified_time":"2019-10-31T18:38:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31004","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-04 14:48:23","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:02:36","updated":"2026-02-04 14:48:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/31004","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=31004"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/31004\/revisions"}],"predecessor-version":[{"id":156658,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/31004\/revisions\/156658"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/22980"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=31004"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=31004"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=31004"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}