{"id":31004,"date":"2019-10-31T21:38:50","date_gmt":"2019-10-31T18:38:50","guid":{"rendered":"https:\/\/prohoster.info\/blog\/testirovanie-pokazhet-kak-podgotovitsya-k-vnedreniyu-cisco-ise-i-ponyat-kakie-fichi-sistemy-vam-nuzhny\/"},"modified":"2019-10-31T21:38:50","modified_gmt":"2019-10-31T18:38:50","slug":"testirovanie-pokazhet-kak-podgotovitsya-k-vnedreniyu-cisco-ise-i-ponyat-kakie-fichi-sistemy-vam-nuzhny","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/testirovanie-pokazhet-kak-podgotovitsya-k-vnedreniyu-cisco-ise-i-ponyat-kakie-fichi-sistemy-vam-nuzhny","title":{"rendered":"Testimi do t\u00eb tregoj\u00eb: si t\u00eb p\u00ebrgatitemi p\u00ebr implementimin e Cisco ISE dhe t\u00eb kuptojm\u00eb cilat karakteristika t\u00eb sistemit na nevojiten","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Testimi
\n
\nSa sa her\u00eb bleni di\u00e7ka n\u00eb m\u00ebnyr\u00eb spontane, duke u dor\u00ebzuar nj\u00eb reklame t\u00eb bukur, dhe pastaj ajo gj\u00eb e d\u00ebshiruar fillimisht p\u00ebrfundon duke pluhurosur n\u00eb dollap, n\u00eb bodrum ose n\u00eb garazh deri n\u00eb pastrimin e radh\u00ebs ose transferimin? Si rezultat \u2014 zhg\u00ebnjim p\u00ebr shkak t\u00eb pritshm\u00ebrive t\u00eb paarsyetuara dhe parave t\u00eb shpenzuara kot. M\u00eb e keqja \u00ebsht\u00eb kur di\u00e7ka e till\u00eb ndodh me biznesin. Shpesh, hile marketingu jan\u00eb aq t\u00eb mira, sa q\u00eb kompanit\u00eb blejn\u00eb zgjidhje t\u00eb shtrenjta, duke mos par\u00eb plot\u00ebsisht imazhin e p\u00ebrdorimit t\u00eb saj. Megjithat\u00eb, testimi i prov\u00ebs ndihmon p\u00ebr t\u00eb kuptuar si t\u00eb p\u00ebrgatitet infrastruktura p\u00ebr integrim, cila funksionalitet dhe n\u00eb \u00e7far\u00eb sasi duhet t\u00eb zbatohet. K\u00ebshtu mund t\u00eb shmanget nj\u00eb num\u00ebr i madh problemesh p\u00ebr shkak t\u00eb zgjedhjes s\u00eb produktit \"me sy t\u00eb mbyllur\". P\u00ebr m\u00eb tep\u00ebr, zbatimi pas nj\u00eb \"piloti\" t\u00eb mir\u00eb do t\u00eb sjell\u00eb shum\u00eb m\u00eb pak shqet\u00ebsime p\u00ebr inxhinier\u00ebt. Le t\u00eb shohim pse testimi pilot \u00ebsht\u00eb kaq i r\u00ebnd\u00ebsish\u00ebm p\u00ebr nj\u00eb projekt t\u00eb suksessh\u00ebm, duke marr\u00eb si shembull mjetin popullor p\u00ebr kontrollin e aksesit n\u00eb rrjetin korporativ \u2014 Cisco ISE. Do t\u00eb shqyrtojm\u00eb si opsionet standarde ashtu edhe ato t\u00eb pazakonta t\u00eb p\u00ebrdorimit t\u00eb zgjidhjes, q\u00eb kemi hasur n\u00eb p\u00ebrvoj\u00ebn ton\u00eb.
\n<\/a><\/noindex><\/p>\n

Cisco ISE \u2014 \"Server Radius n\u00eb steroide\"<\/h2>\n

\nCisco Identity Services Engine (ISE) \u00ebsht\u00eb nj\u00eb platform\u00eb p\u00ebr nd\u00ebrtimin e nj\u00eb sistemi kontrolli t\u00eb aksesit n\u00eb rrjetin lokal t\u00eb organizat\u00ebs. N\u00eb komunitetin e ekspert\u00ebve, produkti \u00ebsht\u00eb quajtur \"Server Radius n\u00eb steroide\" p\u00ebr nga cil\u00ebsit\u00eb e tij. Pse k\u00ebshtu? N\u00eb thelb, zgjidhja \u00ebsht\u00eb nj\u00eb server Radius, t\u00eb cilit i jan\u00eb shtuar nj\u00eb num\u00ebr i madh sh\u00ebrbimesh dhe \"pec\u00ebsh\", q\u00eb lejojn\u00eb marrjen e nj\u00eb sasi t\u00eb madhe informacioni kontekstual dhe aplikimin e k\u00ebsaj p\u00ebrmbajtjeje t\u00eb t\u00eb dh\u00ebnave n\u00eb politikat e aksesit.<\/p>\n

Si \u00e7do server tjet\u00ebr Radius, Cisco ISE bashk\u00ebpunon me pajisjet e rrjetit n\u00eb nivelin e aksesit, grumbullon informacion mbi t\u00eb gjitha p\u00ebrpjekjet p\u00ebr t\u00eb hyr\u00eb n\u00eb rrjetin korporativ dhe, n\u00eb baz\u00eb t\u00eb politikave t\u00eb autentifikimit dhe autorizimit, lejon ose ndalon p\u00ebrdoruesit n\u00eb LAN. Megjithat\u00eb, mund\u00ebsia p\u00ebr profilizim, kontrollim dhe integrim me zgjidhje t\u00eb tjera t\u00eb siguris\u00eb informuese lejon q\u00eb logjika e politik\u00ebs s\u00eb autorizimit t\u00eb komplikohet ndjesh\u00ebm dhe k\u00ebshtu t\u00eb zgjidh\u00eb detyra mjaft t\u00eb v\u00ebshtira dhe interesante.<\/p>\n

\"Testimi
\n<\/p>\n

Nuk duhet t\u00eb zbatohet, por duhet t\u00eb pilotohet: pse \u00ebsht\u00eb e nevojshme testimi?<\/h2>\n

\nVlera e testimit pilot q\u00ebndron n\u00eb demonstrimin e t\u00eb gjitha mund\u00ebsive t\u00eb sistemit n\u00eb infrastruktur\u00ebn specifike t\u00eb institucionit p\u00ebrkat\u00ebs. Jam i bindur se pilotimi i Cisco ISE para implementimit \u00ebsht\u00eb i dobish\u00ebm p\u00ebr t\u00eb gjith\u00eb pjes\u00ebmarr\u00ebsit e projektit, dhe ja pse. <\/p>\n

Kjo u jep integrator\u00ebve nj\u00eb pamje t\u00eb qart\u00eb t\u00eb pritshm\u00ebrive t\u00eb klientit dhe ndihmon n\u00eb formimin e nj\u00eb detyre teknike t\u00eb sakt\u00eb, e cila p\u00ebrmban shum\u00eb m\u00eb tep\u00ebr detaje sesa fraza e zakonshme \"b\u00ebni q\u00eb gjith\u00e7ka t\u00eb jet\u00eb mir\u00eb\". \"Piloti\" na lejon t\u00eb ndiejm\u00eb t\u00eb gjith\u00eb dhimbjen e klientit, t\u00eb kuptojm\u00eb, cilat jan\u00eb prioritete p\u00ebr t\u00eb dhe cilat jan\u00eb dyt\u00ebsore. P\u00ebr ne, kjo \u00ebsht\u00eb nj\u00eb mund\u00ebsi e shk\u00eblqyer p\u00ebr t\u00eb kuptuar paraprakisht se \u00e7far\u00eb pajisjesh p\u00ebrdoren n\u00eb organizat\u00eb, si do t\u00eb zhvillohet implementimi, n\u00eb cilat lokacione, ku ndodhen etj. <\/p>\n

Klient\u00ebt gjat\u00eb testimit pilot shohin sistemin e v\u00ebrtet\u00eb n\u00eb veprim, njohin nd\u00ebrfaqen e tij, mund t\u00eb verifikojn\u00eb n\u00ebse \u00ebsht\u00eb kompatibile me \"harduerin\" q\u00eb kan\u00eb, dhe marrin nj\u00eb pamje t\u00eb plot\u00eb t\u00eb asaj se si do t\u00eb funksionoj\u00eb zgjidhja pas implementimit t\u00eb plot\u00eb. \"Piloti\" \u00ebsht\u00eb ai moment kur mund t\u00eb shohim t\u00eb gjitha \"k\u00ebto momente t\u00eb papritura\" me t\u00eb cilat do t\u00eb duhet t\u00eb p\u00ebrballen gjat\u00eb integrimit dhe t\u00eb vendosim, sa licenca duhet t\u00eb blihen.
\n\u00c7far\u00eb mund t\u00eb \"shfaqet\" gjat\u00eb \"pilotit\"<\/p>\n

Pra, si t\u00eb p\u00ebrgatisni si\u00e7 duhet p\u00ebr implementimin e Cisco ISE? Nga p\u00ebrvoja jon\u00eb, kemi identifikuar 4 pika kryesore q\u00eb \u00ebsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb merren parasysh gjat\u00eb procesit t\u00eb testimit pilot t\u00eb sistemit.<\/p>\n

Formati<\/h2>\n

\nS\u00eb pari, duhet t\u00eb p\u00ebrcaktoni n\u00eb cilin format do t\u00eb zbatohet sistemi: pajisje fisike apo pajisje virtuale. \u00c7do opsion ka avantazhe dhe disavantazhe. P\u00ebr shembull, nj\u00eb pik\u00eb e fort\u00eb e pajisjeve fizike \u00ebsht\u00eb performanca e parashikueshme, por nuk duhet harruar se k\u00ebto pajisje jan\u00eb n\u00eb rrezik t\u00eb b\u00ebhen t\u00eb vjetra me kalimin e koh\u00ebs. Pajisjet virtuale jan\u00eb m\u00eb pak t\u00eb parashikueshme, pasi varen nga hardueri mbi t\u00eb cilin \u00ebsht\u00eb nd\u00ebrtuar mjedisi i virtualizimit, por kan\u00eb nj\u00eb avantazh t\u00eb r\u00ebnd\u00ebsish\u00ebm: n\u00ebse kan\u00eb mb\u00ebshtetje, ato gjithmon\u00eb mund t\u00eb p\u00ebrdit\u00ebsohen n\u00eb versionin m\u00eb t\u00eb fundit. <\/p>\n

A \u00ebsht\u00eb pajisja juaj rrjet\u00ebrore e p\u00ebrputhshme me Cisco ISE?<\/h2>\n

\nSigurisht, skenari ideal do t\u00eb ishte t\u00eb lidhnim t\u00eb gjith\u00eb pajisjet me sistemin menj\u00ebher\u00eb. Megjithat\u00eb, kjo nuk \u00ebsht\u00eb gjithmon\u00eb e mundur, pasi shum\u00eb organizata akoma p\u00ebrdorin switch-a t\u00eb pa menaxhuar ose switch-a q\u00eb nuk mb\u00ebshtesin disa teknologji, mbi t\u00eb cilat punon Cisco ISE. P\u00ebr ta th\u00ebn\u00eb ndryshe, nuk flasim vet\u00ebm p\u00ebr switch-a, por k\u00ebtu mund t\u00eb jen\u00eb edhe kontroler\u00ebt e rrjetit wireless, VPN<\/a>-koncentrator\u00eb dhe \u00e7do pajisje tjet\u00ebr q\u00eb lidhet me p\u00ebrdoruesit. N\u00eb p\u00ebrvoj\u00ebn time, ka pasur raste kur pas nj\u00eb demonstrimi t\u00eb sistemit p\u00ebr nj\u00eb implementim t\u00eb plot\u00eb, klienti ka p\u00ebrdit\u00ebsuar pothuajse gjith\u00eb parkun e switch-ave t\u00eb nivelit t\u00eb aksesit n\u00eb pajisje moderne Cisco. P\u00ebr t'u shmangur surprizave t\u00eb pak\u00ebndshme, \u00ebsht\u00eb e k\u00ebshillueshme t\u00eb zbulohet paraprakisht p\u00ebrqindja e pajisjeve t\u00eb pad\u00ebshtijshme. <\/p>\n

A jan\u00eb t\u00eb gjitha pajisjet tuaja standard?<\/h2>\n

\nN\u00eb \u00e7do rrjet ka pajisje standarde, lidhja e t\u00eb cilave nuk duhet t\u00eb shkaktoj\u00eb probleme: vendet e pun\u00ebs t\u00eb automatizuara, telefonat IP, pikat e qasjes Wi-Fi, kamerat e videove dhe k\u00ebshtu me radh\u00eb. Por ndodhin raste, q\u00eb n\u00eb LAN duhet t\u00eb lidhen pajisje jo standarde, p\u00ebr shembull, konvertues t\u00eb sinjaleve t\u00eb autobusit RS232\/Ethernet, interfaca t\u00eb burimeve t\u00eb energjis\u00eb s\u00eb padiskutueshme, pajisje teknologjike t\u00eb ndryshme, etj. \u00cbsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb p\u00ebrcaktohet lista e k\u00ebtyre pajisjeve paraprakisht, p\u00ebr t'u siguruar q\u00eb n\u00eb faz\u00ebn e implementimit t\u00eb keni nj\u00eb kuptim se si ato do t\u00eb funksionojn\u00eb teknikisht me Cisco ISE.<\/p>\n

Dialog konstruktiv me IT-n\u00eb<\/h2>\n

\nShpesh, p\u00ebrdoruesit e Cisco ISE jan\u00eb departamentet e siguris\u00eb, nd\u00ebrsa p\u00ebr konfigurimin e switch-ave t\u00eb nivelit t\u00eb aksesit dhe Active Directory zakonisht p\u00ebrgjigjen departamentet IT. Prandaj, nj\u00eb nd\u00ebrveprim produktiv mes sigurtar\u00ebve dhe IT-s\u00eb \u00ebsht\u00eb nj\u00eb nga kushtet e r\u00ebnd\u00ebsishme p\u00ebr nj\u00eb implementim t\u00eb suksessh\u00ebm t\u00eb sistemit. N\u00ebse t\u00eb fundit e perceptojn\u00eb integrimin 'me arm\u00eb', \u00ebsht\u00eb e r\u00ebnd\u00ebsishme t'u shpjegosh atyre se si zgjidhja do t\u00eb jet\u00eb e dobishme p\u00ebr departamentin IT.<\/p>\n

Top 5 raste p\u00ebrdorimi t\u00eb Cisco ISE<\/h2>\n

\nNga p\u00ebrvoja jon\u00eb, funksionaliteti i nevojsh\u00ebm i sistemit gjithashtu identifikohet gjat\u00eb faz\u00ebs testuese pilot. M\u00eb posht\u00eb jan\u00eb disa nga rastet m\u00eb t\u00eb njohura dhe m\u00eb pak t\u00eb zakonshme t\u00eb p\u00ebrdorimit t\u00eb zgjidhjes. <\/p>\n

Qasje e sigurt n\u00eb LAN p\u00ebrmes kabllor me EAP-TLS<\/h4>\n

\nSipas rezultateve t\u00eb hulumtimeve t\u00eb p\u00ebntester\u00ebve tan\u00eb, shpesh p\u00ebr t\u00eb infiltruar rrjetin e nj\u00eb kompanie, sulmuesit p\u00ebrdorin prizat e zakonshme, t\u00eb cilat jan\u00eb t\u00eb lidhura me printera, telefona, kamera IP, pik\u00eb Wi-Fi dhe pajisje t\u00eb tjera jo personale t\u00eb rrjetit. Prandaj, edhe n\u00ebse qasja n\u00eb rrjet sigurohet me teknologjin\u00eb dot1x, n\u00ebse p\u00ebrdoren protokolle alternative pa p\u00ebrdorimin e certifikatave t\u00eb konfirmimit t\u00eb autentikimit t\u00eb p\u00ebrdoruesve, \u00ebsht\u00eb shum\u00eb e mundshme q\u00eb t\u00eb ndodh\u00eb nj\u00eb sulm i suksessh\u00ebm me kapjen e sesioneve dhe brute-forcing t\u00eb fjal\u00ebkalimeve. N\u00eb rastin e Cisco ISE, p\u00ebr t\u00eb thyer certifikat\u00ebn do t\u00eb jet\u00eb shum\u00eb m\u00eb e v\u00ebshtir\u00eb - p\u00ebr k\u00ebt\u00eb, haker\u00ebt do t\u00eb ken\u00eb nevoj\u00eb p\u00ebr shum\u00eb m\u00eb shum\u00eb kapacitet kompjuterik, k\u00ebshtu q\u00eb ky rast \u00ebsht\u00eb mjaft efektiv.<\/p>\n

Qasja Pa Fije Dual-SSID <\/h4>\n

\nEssenca e k\u00ebtij skenari p\u00ebrfshin p\u00ebrdorimin e 2 identifikator\u00ebve t\u00eb rrjetit (SSID). Nj\u00ebri nga ata mund t\u00eb quhet sipas zakonit \"gost\". N\u00ebp\u00ebrmjet tij, n\u00eb rrjetin pa fije mund t\u00eb hyjn\u00eb si vizitor\u00ebt ashtu edhe punonj\u00ebsit e kompanis\u00eb. T\u00eb fundit, n\u00eb p\u00ebrpjekjen p\u00ebr t'u lidhur, ridrejtohen n\u00eb nj\u00eb portal t\u00eb ve\u00e7ant\u00eb, ku ndodh provizionimi. Kjo do t\u00eb thot\u00eb se p\u00ebrdoruesit u jepet nj\u00eb certifikat dhe b\u00ebhet konfigurimi i pajisjes s\u00eb tij personale p\u00ebr ricop\u00ebzim automatik n\u00eb SSID t\u00eb dyt\u00eb, ku tashm\u00eb p\u00ebrdoret EAP-TLS me t\u00eb gjitha avantazhet e rastit t\u00eb par\u00eb.<\/p>\n

Shk\u00ebputja e Autentifikimit MAC dhe profilizimi<\/h4>\n

\nNj\u00eb rast tjet\u00ebr popullor p\u00ebrfshin p\u00ebrcaktimin automatik t\u00eb llojit t\u00eb pajisjes q\u00eb \u00ebsht\u00eb e lidhur dhe aplikimin e kufizimeve t\u00eb duhura p\u00ebr t\u00eb. Pse \u00ebsht\u00eb ky interesant? Fakti \u00ebsht\u00eb se ende ka shum\u00eb pajisje q\u00eb nuk mb\u00ebshtesin autentifikimin n\u00ebp\u00ebrmjet protokollit 802.1X. Prandaj, p\u00ebr t\u00eb lejuar q\u00eb k\u00ebto pajisje t\u00eb lidhen me rrjetin, ato duhet t\u00eb lejojn\u00eb sipas adres\u00ebs MAC, e cila \u00ebsht\u00eb mjaft e leht\u00eb p\u00ebr t'u falsifikuar. K\u00ebtu vjen n\u00eb ndihm\u00eb Cisco ISE: p\u00ebrmes sistemit mund t\u00eb shohim se si pajisja sillet n\u00eb rrjet, t\u00eb krijojm\u00eb profilin e saj dhe t\u00eb vendosim at\u00eb n\u00eb p\u00ebrputhje me nj\u00eb grup pajisjesh t\u00eb tjera, p\u00ebr shembull, telefon IP dhe nj\u00eb stacion pune. Kur nj\u00eb sulmues p\u00ebrpiqet t\u00eb falsifikoj\u00eb adres\u00ebn MAC dhe t\u00eb lidh\u00eb n\u00eb rrjet, sistemi do t\u00eb shoh\u00eb se profili i pajisjes ka ndryshuar, do t\u00eb d\u00ebrgoj\u00eb nj\u00eb sinjal p\u00ebr sjellje t\u00eb dyshimt\u00eb dhe nuk do t\u00eb lejoj\u00eb p\u00ebrdoruesin e dyshimt\u00eb n\u00eb rrjet. <\/p>\n

EAP-Chaining <\/h4>\n

\nTehnologjia EAP-Chaining n\u00ebnkupton autenticimin e radh\u00ebs t\u00eb PC-s\u00eb s\u00eb pun\u00ebs dhe llogaris\u00eb s\u00eb p\u00ebrdoruesit. Ky rast ka marr\u00eb p\u00ebrhapje t\u00eb gjer\u00eb, pasi n\u00eb shum\u00eb kompani ende nuk \u00ebsht\u00eb e pranuar lidhja e pajisjeve personale t\u00eb punonj\u00ebsve me rrjetin korporativ. Duke p\u00ebrdorur nj\u00eb qasje t\u00eb till\u00eb p\u00ebr autentikimin, \u00ebsht\u00eb e mundur t\u00eb kontrollohet n\u00ebse nj\u00eb stacion pune i caktuar \u00ebsht\u00eb pjes\u00eb e domeneve, dhe n\u00eb rast negativ, p\u00ebrdoruesi ose nuk do t\u00eb hyj\u00eb n\u00eb rrjet, ose do t\u00eb hyj\u00eb, por me disa kufizime.<\/p>\n

Posturimi <\/h4>\n

\nN\u00eb k\u00ebt\u00eb rast, \u00ebsht\u00eb fjala p\u00ebr vler\u00ebsimin e p\u00ebrputhshm\u00ebris\u00eb s\u00eb p\u00ebrb\u00ebrjes s\u00eb softuerit t\u00eb stacionit t\u00eb pun\u00ebs me k\u00ebrkesat e siguris\u00eb kibernetike. Me k\u00ebt\u00eb teknologji, mund t\u00eb kontrollohet n\u00ebse softueri n\u00eb stacionin e pun\u00ebs \u00ebsht\u00eb i p\u00ebrdit\u00ebsuar, n\u00ebse jan\u00eb instaluar mjetet e mbrojtjes, n\u00ebse \u00ebsht\u00eb konfigurimi i firewall-it t\u00eb hostit etj. \u00cbsht\u00eb interesante se kjo teknologji gjithashtu lejon zgjidhjen e detyrave t\u00eb tjera, q\u00eb nuk jan\u00eb t\u00eb lidhura me sigurin\u00eb, p\u00ebr shembull, t\u00eb kontrollohet pranimi i skedar\u00ebve t\u00eb nevojsh\u00ebm ose instalimi i softuer\u00ebve t\u00eb sistemit t\u00eb p\u00ebrgjithsh\u00ebm.<\/p>\n

Shpesh hasen edhe skenar\u00eb t\u00eb tjer\u00eb t\u00eb p\u00ebrdorimit t\u00eb Cisco ISE, si kontrolli i aksesit p\u00ebrmes autentikimit t\u00eb domeneve pasiv (Passive ID), mikrosigurtimi i bazuar n\u00eb SGT dhe filtrimi, si dhe integrimi me sistemet e menaxhimit t\u00eb pajisjeve mobile (MDM) dhe skaner\u00ebt e vulnerabiliteteve (Vulnerability Scanner). <\/p>\n

Projekte jo standarde: p\u00ebr \u00e7far\u00eb tjet\u00ebr mund t\u00eb nevojitet Cisco ISE, ose 3 raste t\u00eb rrall\u00eb nga praktika jon\u00eb<\/p>\n

Kontrolli i aksesit n\u00eb Server\u00ebt me baz\u00eb Linux<\/h2>\n

\nNj\u00eb her\u00eb we zgjidh\u00ebm nj\u00eb rast mjaft t\u00eb ve\u00e7ant\u00eb p\u00ebr nj\u00eb prej klient\u00ebve tan\u00eb, i cili tashm\u00eb kishte implementuar sistemin Cisco ISE: na duhej t\u00eb gjejm\u00eb nj\u00eb m\u00ebnyr\u00eb p\u00ebr t\u00eb kontrolluar veprimet e p\u00ebrdoruesve (n\u00eb shumic\u00ebn e rast\u00ebve kjo ishin administrator\u00ebt) n\u00eb server\u00ebt me sistemin operativ Linux t\u00eb instaluar. N\u00eb k\u00ebrkimin e p\u00ebrgjigjes na erdhi ideja p\u00ebr t\u00eb angazhuar softuerin e lir\u00eb PAM Radius Module, i cili lejon hyrjen n\u00eb serverat n\u00ebn menaxhimin e Linux me autentifikimin n\u00eb nj\u00eb server radius t\u00eb jasht\u00ebm. E gjith\u00eb kjo do t\u00eb ishte mir\u00eb, n\u00ebse jo p\u00ebr nj\u00eb 'por': serveri radius, duke d\u00ebrguar p\u00ebrgjigje p\u00ebr k\u00ebrkes\u00ebn p\u00ebr autentifikim, jep vet\u00ebm emrin e llogaris\u00eb dhe rezultatin \u2014 assess accepted ose assess rejected. Megjithat\u00eb, p\u00ebr autorizimin n\u00eb Linux duhet t\u00eb caktohet t\u00eb pakt\u00ebn nj\u00eb paramet\u00ebr tjet\u00ebr \u2014 home directory, n\u00eb m\u00ebnyr\u00eb q\u00eb p\u00ebrdoruesi t\u00eb pakt\u00ebn t\u00eb ket\u00eb nj\u00eb vend p\u00ebr t\u00eb shkuar. Ne nuk gjet\u00ebm nj\u00eb m\u00ebnyr\u00eb p\u00ebr ta d\u00ebrguar k\u00ebt\u00eb si atribut radius, prandaj shkruam nj\u00eb skript t\u00eb ve\u00e7ant\u00eb p\u00ebr krijimin e m\u00ebnjanuar t\u00eb llogarive n\u00eb host\u00ebt n\u00eb nj\u00eb m\u00ebnyr\u00eb gjysm\u00eb automatike. Kjo detyr\u00eb ishte mjaft e realizueshme, pasi pat\u00ebm t\u00eb b\u00ebjm\u00eb me llogarit\u00eb e administrator\u00ebve, numri i t\u00eb cil\u00ebve nuk ishte aq i madh. M\u00eb pas, p\u00ebrdoruesit hynin n\u00eb pajisjen e nevojshme, pas s\u00eb cil\u00ebs u caktohej akses i nevojsh\u00ebm. Merrni n\u00eb konsiderat\u00eb nj\u00eb pyetje t\u00eb arsyeshme: a \u00ebsht\u00eb me t\u00eb v\u00ebrtet\u00eb e nevojshme t\u00eb p\u00ebrdoret Cisco ISE n\u00eb raste t\u00eb tilla? N\u00eb t\u00eb v\u00ebrtet\u00eb jo \u2014 \u00e7do server radius do t\u00eb ishte i p\u00ebrshtatsh\u00ebm, por pasi klienti yn\u00eb tashm\u00eb kishte k\u00ebt\u00eb sistem, ne thjesht e shtuam nj\u00eb funksion t\u00eb ri mbi t\u00eb.<\/p>\n

Inventarizimi i \"harduerit\" dhe softuerit n\u00eb LAN<\/h2>\n

\nNj\u00eb her\u00eb ishim duke punuar n\u00eb nj\u00eb projekt p\u00ebr furnizimin e Cisco ISE p\u00ebr nj\u00eb klient pa nj\u00eb \"pilot\" paraprak. Nuk kishte k\u00ebrkesa t\u00eb qarta p\u00ebr zgjidhjen, dhe p\u00ebrve\u00e7 k\u00ebsaj, ne kishim t\u00eb b\u00ebnim me nj\u00eb rrjet t\u00eb shesht\u00eb, pa segmente, q\u00eb e komplikonte detyr\u00ebn ton\u00eb. Gjat\u00eb projektit, ne konfiguram\u00eb t\u00eb gjitha metodat e mundshme t\u00eb profilizimit q\u00eb rrjeti mb\u00ebshteste: NetFlow, DHCP, SNMP, integrim me AD, etj. N\u00eb fund, u konfigurua akses p\u00ebrmes MAR me mund\u00ebsin\u00eb p\u00ebr t\u00eb hyr\u00eb n\u00eb rrjet edhe n\u00eb rast t\u00eb d\u00ebshtimit t\u00eb autentikimit. K\u00ebshtu, edhe n\u00ebse autentikimi nuk ishte i suksessh\u00ebm, sistemi p\u00ebrs\u00ebri e lejonte p\u00ebrdoruesin n\u00eb rrjet, mbledh\u00eb informacion rreth tij dhe e regjistronte at\u00eb n\u00eb databaz\u00ebn ISE. Ky monitorim i rrjetit p\u00ebr disa jav\u00eb na ndihmoi t\u00eb identifikonim sistemet e lidhura dhe pajisjet jo personale dhe t\u00eb zhvillonim nj\u00eb qasje p\u00ebr segmentimin e tyre. Pas k\u00ebsaj, ne gjithashtu konfiguram\u00eb nj\u00eb skenar p\u00ebr instalimin e agjentit n\u00eb stacionet e pun\u00ebs me q\u00ebllim t\u00eb mbledhjes s\u00eb informacionit mbi softuerin e instaluar n\u00eb to. \u00c7far\u00eb arrit\u00ebm? Na arriti t\u00eb segmentojm\u00eb rrjetin dhe t\u00eb p\u00ebrcaktojm\u00eb list\u00ebn e softuer\u00ebve q\u00eb duhej t\u00eb hiqeshin nga stacionet e pun\u00ebs. Nuk do ta fsheh, detyrat e m\u00ebtejshme p\u00ebr shp\u00ebrndarjen e p\u00ebrdoruesve n\u00eb grupe domeni dhe ndarjen e t\u00eb drejtave t\u00eb aksesit na mor\u00ebn mjaft koh\u00eb, por k\u00ebshtu e mor\u00ebm nj\u00eb pamje t\u00eb plot\u00eb t\u00eb asaj se \u00e7far\u00eb \"hardueri\" kishte klienti n\u00eb rrjet. P\u00ebr ta th\u00ebn\u00eb t\u00eb drejt\u00ebn, kjo nuk ishte e v\u00ebshtir\u00eb fal\u00eb pun\u00ebs s\u00eb mir\u00eb t\u00eb profilizimit \"nga kutia\". Nd\u00ebrkoh\u00eb, atje ku profilizimi nuk ndihmoi, ne e shqyrtuam vet\u00eb, duke identifikuar portin e switch-it t\u00eb lidhur me pajisjet. <\/p>\n

Instalimi n\u00eb distanc\u00eb i softuerit n\u00eb stacionet e pun\u00ebs<\/h2>\n

\nKy k\u00ebt\u00eb rast \u00ebsht\u00eb nj\u00eb nga m\u00eb t\u00eb \u00e7uditshmit n\u00eb praktik\u00ebn time. Nj\u00eb her\u00eb nj\u00eb klient erdhi te ne me nj\u00eb thirrje p\u00ebr ndihm\u00eb \u2014 gjat\u00eb implementimit t\u00eb Cisco ISE, di\u00e7ka shkoi keq, gjith\u00e7ka u prish dhe askush nuk mundi m\u00eb t\u00eb hynte n\u00eb rrjet. Filluam t\u00eb shqyrtonim situat\u00ebn dhe zbuluam sa vijon. N\u00eb kompani ishin 2000 kompjuter\u00eb, administrimi i t\u00eb cil\u00ebve, p\u00ebr shkak t\u00eb munges\u00ebs s\u00eb kontrolluesit t\u00eb domenit, b\u00ebhej n\u00ebn llogarin\u00eb e administratorit. Me q\u00ebllim q\u00eb t\u00eb realizohej nj\u00eb audt, n\u00eb organizat\u00eb u implementua Cisco ISE. Duhej n\u00eb nj\u00eb far\u00eb m\u00ebnyre t\u00eb kuptohej n\u00ebse n\u00eb PC-t\u00eb ekzistuese ishte instaluar antivirus, n\u00ebse mjedisi i programit ishte i p\u00ebrdit\u00ebsuar, etj. Dhe pasi q\u00eb pajisjet rrjetore ishin p\u00ebrshtatur nga administratoret e TI-s\u00eb, ishte logjike q\u00eb ata t\u00eb kishin qasje n\u00eb t\u00eb. Duke par\u00eb se si funksiononte ajo dhe duke realizuar audt t\u00eb PC-ve t\u00eb tyre, administrator\u00ebt arrit\u00ebn t\u00eb instalonin softuer n\u00eb stacionet e pun\u00ebs t\u00eb punonj\u00ebsve n\u00eb distanc\u00eb pa vizita personale. Vet\u00ebm imagjinoni se sa hapa mund t\u00eb kursehen n\u00eb dit\u00eb! Administrator\u00ebt b\u00ebn\u00eb disa kontrollime t\u00eb ARM p\u00ebr pranin\u00eb e nj\u00eb skedari t\u00eb caktuar n\u00eb drejtorin\u00eb C:Program Files, dhe n\u00eb munges\u00eb t\u00eb tij, fillonte automatikisht nj\u00eb proces riparimi me kalim n\u00eb nj\u00eb lidhje q\u00eb \u00e7onte n\u00eb nj\u00eb ruajtje skedar\u00ebsh p\u00ebr skedarin instalues .exe. Kjo i lejoi p\u00ebrdoruesit e zakonsh\u00ebm t\u00eb hynin n\u00eb ruajtjen e skedar\u00ebve dhe t\u00eb shkarkonin atje softuerin e nevojsh\u00ebm. Fatkeq\u00ebsisht, administratorit i ishte b\u00ebr\u00eb von\u00eb njohur me sistemin ISE dhe d\u00ebmtoi mekanizmat e audt-it \u2014 shkroi gabim politik\u00ebn, gj\u00eb q\u00eb e \u00e7oi n\u00eb problemin q\u00eb na angazhoi. Personalish, jam sinqerisht i habitur me k\u00ebt\u00eb qasje kaq krijuese, sepse do t\u00eb kishte qen\u00eb shum\u00eb m\u00eb e lir\u00eb dhe m\u00eb pak e lodhshme t\u00eb krijohej nj\u00eb kontrollues domeni. Por si prov\u00eb e konceptit, kjo funksionoi.<\/p>\n

M\u00eb shum\u00eb rreth nuancave teknike q\u00eb lindin gjat\u00eb implementimit t\u00eb Cisco ISE, lexoni n\u00eb artikullin e kolegut tim. \u00abPraktika e implementimit t\u00eb Cisco ISE. Perspektiva e nj\u00eb inxhinieri\u00bb<\/a><\/noindex>.<\/p>\n

Artem Bobrikov, inxhinier-projektues n\u00eb Qendr\u00ebn e Siguris\u00eb Informative t\u00eb kompanis\u00eb 'Infosistemat Jet'<\/i><\/p>\n

Pasth\u00ebnie<\/b>:
\nMegjith\u00ebse ky post tregon p\u00ebr sistemin Cisco ISE, problematika e p\u00ebrshkruar \u00ebsht\u00eb relevante p\u00ebr t\u00eb gjith\u00eb klas\u00ebn e zgjidhjeve NAC. Nuk ka r\u00ebnd\u00ebsi se \u00e7far\u00eb zgjidhjeje t\u00eb nj\u00eb prodhuesi planifikohet t\u00eb implementohet, pjesa m\u00eb e madhe e asaj q\u00eb u tha m\u00eb par\u00eb do t\u00eb mbetet e aplikueshme.
\n
Burimi: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u0430\u043a \u0447\u0430\u0441\u0442\u043e \u0432\u044b \u043f\u043e\u043a\u0443\u043f\u0430\u0435\u0442\u0435 \u0447\u0442\u043e-\u0442\u043e \u0441\u043f\u043e\u043d\u0442\u0430\u043d\u043d\u043e, \u043f\u043e\u0434\u0434\u0430\u0432\u0448\u0438\u0441\u044c \u043a\u0440\u0443\u0442\u043e\u0439 \u0440\u0435\u043a\u043b\u0430\u043c\u0435, \u0430 \u043f\u043e\u0442\u043e\u043c \u044d\u0442\u0430 \u0438\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u0436\u0435\u043b\u0430\u043d\u043d\u0430\u044f \u0432\u0435\u0449\u044c \u043f\u044b\u043b\u0438\u0442\u0441\u044f \u0432 \u0448\u043a\u0430\u0444\u0443, \u043a\u043b\u0430\u0434\u043e\u0432\u043a\u0435 \u0438\u043b\u0438 \u0433\u0430\u0440\u0430\u0436\u0435 \u0434\u043e \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u043e\u0439 \u0433\u0435\u043d\u0435\u0440\u0430\u043b\u044c\u043d\u043e\u0439 \u0443\u0431\u043e\u0440\u043a\u0438 \u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u0435\u0437\u0434\u0430? \u041a\u0430\u043a \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442 \u2014 \u0440\u0430\u0437\u043e\u0447\u0430\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0438\u0437-\u0437\u0430 \u043d\u0435\u043e\u043f\u0440\u0430\u0432\u0434\u0430\u043d\u043d\u044b\u0445 \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u0439 \u0438 \u0432\u043f\u0443\u0441\u0442\u0443\u044e \u043f\u043e\u0442\u0440\u0430\u0447\u0435\u043d\u043d\u044b\u0445 \u0434\u0435\u043d\u0435\u0433. \u0413\u043e\u0440\u0430\u0437\u0434\u043e \u0445\u0443\u0436\u0435, \u043a\u043e\u0433\u0434\u0430 \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0435 \u0441\u043b\u0443\u0447\u0430\u0435\u0442\u0441\u044f \u0441 \u0431\u0438\u0437\u043d\u0435\u0441\u043e\u043c. \u041e\u0447\u0435\u043d\u044c \u0447\u0430\u0441\u0442\u043e \u043c\u0430\u0440\u043a\u0435\u0442\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u0442\u0440\u044e\u043a\u0438 \u0431\u044b\u0432\u0430\u044e\u0442 \u043d\u0430\u0441\u0442\u043e\u043b\u044c\u043a\u043e \u0445\u043e\u0440\u043e\u0448\u0438, \u0447\u0442\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u043f\u0440\u0438\u043e\u0431\u0440\u0435\u0442\u0430\u044e\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":22980,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31004","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Testimi do t\u00eb tregoj\u00eb: si t\u00eb p\u00ebrgatiteni p\u00ebr implementimin e Cisco ISE dhe t\u00eb kuptoni se cilat funksionalitete t\u00eb sistemit ju nevojiten | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/testirovanie-pokazhet-kak-podgotovitsya-k-vnedreniyu-cisco-ise-i-ponyat-kakie-fichi-sistemy-vam-nuzhny","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0422\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u043a\u0430\u0436\u0435\u0442: \u043a\u0430\u043a \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u0442\u044c\u0441\u044f \u043a \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044e Cisco ISE \u0438 \u043f\u043e\u043d\u044f\u0442\u044c, \u043a\u0430\u043a\u0438\u0435 \u0444\u0438\u0447\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432\u0430\u043c \u043d\u0443\u0436\u043d\u044b | ProHoster","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/testirovanie-pokazhet-kak-podgotovitsya-k-vnedreniyu-cisco-ise-i-ponyat-kakie-fichi-sistemy-vam-nuzhny","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:38:50+00:00","article:modified_time":"2019-10-31T18:38:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31004","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-04 14:48:23","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:02:36","updated":"2026-02-04 14:48:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/31004","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=31004"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/31004\/revisions"}],"predecessor-version":[{"id":156658,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/31004\/revisions\/156658"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/22980"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=31004"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=31004"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=31004"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}