{"id":31058,"date":"2019-10-31T21:39:12","date_gmt":"2019-10-31T18:39:12","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya\/"},"modified":"2019-10-31T21:39:12","modified_gmt":"2019-10-31T18:39:12","slug":"kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya","title":{"rendered":"Si si merrni kontrollin mbi infrastruktur\u00ebn tuaj rrjet\u00eb. Kapitulli i tret\u00eb. Siguria rrjet\u00ebs. Pjesa e par\u00eb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><i>Ky artikull \u00ebsht\u00eb i treti n\u00eb ciklin e artikujve \"Si t\u00eb merrni kontrollin mbi infrastruktur\u00ebn tuaj rrjet\u00eb\". P\u00ebrmbajtja e t\u00eb gjitha artikujve t\u00eb ciklit dhe lidhjet mund t\u00eb gjenden <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/447008\/\">k\u00ebtu<\/a><\/noindex><\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"Si si merrni kontrollin mbi infrastruktur\u00ebn tuaj rrjet\u00eb. Kapitulli i tret\u00eb. Siguria rrjet\u00ebs. Pjesa e par\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/cdf33cc6797d26df8fef5533f2570c47.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNuk ka asnj\u00eb kuptim t\u00eb flasim p\u00ebr eliminimin e plot\u00eb t\u00eb riskut t\u00eb siguris\u00eb. Ne n\u00eb parim nuk mund ta zvog\u00eblojm\u00eb at\u00eb n\u00eb zero. Po ashtu, duhet t\u00eb kuptohet se, teksa p\u00ebrpiqemi t\u00eb b\u00ebjm\u00eb rrjetin m\u00eb t\u00eb sigurt, zgjidhjet tona b\u00ebhen gjithnj\u00eb e m\u00eb t\u00eb shtrenjta. \u00cbsht\u00eb e nevojshme t\u00eb gjejm\u00eb nj\u00eb kompromis t\u00eb arsyesh\u00ebm p\u00ebr rrjetin tuaj mes \u00e7mimit, kompleksitetit dhe siguris\u00eb. <\/p>\n<p>Sigurisht, dizajni i siguris\u00eb \u00ebsht\u00eb organikisht i integruar n\u00eb arkitektur\u00ebn e p\u00ebrgjithshme dhe zgjidhjet e siguris\u00eb q\u00eb p\u00ebrdoren ndikojn\u00eb n\u00eb shkall\u00ebzueshm\u00ebri, besueshm\u00ebri, menaxhueshm\u00ebri, \u2026 t\u00eb infrastruktur\u00ebs rrjet\u00eb, t\u00eb cilat gjithashtu duhet t\u00eb merren parasysh.<\/p>\n<p>Por, le t'i kujtojm\u00eb se tani nuk po flasim p\u00ebr krijimin e rrjetit. N\u00eb p\u00ebrputhje me <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/433614\/\">kushtet tona fillestare<\/a><\/noindex> ne tashm\u00eb kemi zgjedhur dizajnin, pajisjet e zgjedhura dhe kemi nd\u00ebrtuar infrastruktur\u00ebn, dhe n\u00eb k\u00ebt\u00eb faz\u00eb duhet t\u00eb \"jetojm\u00eb\" sa m\u00eb shum\u00eb t\u00eb jet\u00eb e mundur dhe t\u00eb gjejm\u00eb zgjidhje n\u00eb kontekstin e qasjes t\u00eb zgjedhur m\u00eb par\u00eb.<\/p>\n<p>Detyra jon\u00eb tani \u00ebsht\u00eb t\u00eb identifikojm\u00eb rreziqet lidhur me mbrojtjen n\u00eb nivelin e rrjetit dhe t'i zvog\u00eblojm\u00eb ato n\u00eb nj\u00eb nivel t\u00eb arsyesh\u00ebm. <noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h1>Auditimi i siguris\u00eb n\u00eb rrjet<\/h1>\n<p>\nN\u00ebse n\u00eb organizat\u00ebn tuaj jan\u00eb implementuar proceset ISO 27k, auditimi i siguris\u00eb dhe ndryshimet e rrjetit duhet t\u00eb jen\u00eb integruar natyrsh\u00ebm n\u00eb proceset e p\u00ebrgjithshme n\u00eb kuad\u00ebr t\u00eb k\u00ebtij qasje. Por k\u00ebto standarde nuk flasin konkretisht p\u00ebr zgjidhje, konfigurim, ose dizajn... Nuk ka k\u00ebshilla t\u00eb qarta, nuk ka standarde q\u00eb t\u00eb diktojn\u00eb detajisht se si duhet t\u00eb jet\u00eb rrjeti juaj; k\u00ebtu q\u00ebndron kompleksiteti dhe bukuria e k\u00ebsaj detyre.<\/p>\n<p>Do t\u00eb ve\u00e7oja disa auditime t\u00eb mundshme t\u00eb siguris\u00eb n\u00eb rrjet:<\/p>\n<ul>\n<li>auditimi i konfiguracionit t\u00eb pajisjeve (hardening)<\/li>\n<li>auditimi i dizajnit t\u00eb siguris\u00eb<\/li>\n<li>auditimi i aksesit<\/li>\n<li>auditimi i proceseve<\/li>\n<\/ul>\n<p><\/p>\n<h1>Auditimi i konfiguracionit t\u00eb pajisjeve (hardening)<\/h1>\n<p>\nDuket se n\u00eb shumic\u00ebn e rasteve, kjo \u00ebsht\u00eb pika m\u00eb e mir\u00eb e nisjes p\u00ebr auditimin dhe p\u00ebrmir\u00ebsimin e siguris\u00eb s\u00eb rrjetit tuaj. IMHO, kjo \u00ebsht\u00eb nj\u00eb demonstrim e mir\u00eb e ligjit t\u00eb Pareto (20% e p\u00ebrpjekjeve japin 80% t\u00eb rezultateve, nd\u00ebrsa 80% e p\u00ebrpjekjeve japin vet\u00ebm 20% t\u00eb rezultateve). <\/p>\n<p>Mundore \u00ebsht\u00eb q\u00eb zakonisht kemi rekomandime nga shit\u00ebsit p\u00ebr \"praktikat m\u00eb t\u00eb mira\" p\u00ebr sigurin\u00eb gjat\u00eb konfigurimit t\u00eb pajisjeve. Kjo quhet \"hardening\".<\/p>\n<p>Gjithashtu, shpesh mund t\u00eb gjeni nj\u00eb anket\u00eb (ose ta krijoni vet\u00eb) q\u00eb bazohet n\u00eb k\u00ebto rekomandime, q\u00eb do t'ju ndihmoj\u00eb t\u00eb p\u00ebrcaktoni se sa mir\u00eb konfigurimi i pajisjeve tuaja p\u00ebrputhet me k\u00ebto \"praktikat m\u00eb t\u00eb mira\" dhe t\u00eb b\u00ebni ndryshimet e nevojshme n\u00eb rrjetin tuaj bazuar n\u00eb rezultatet. Kjo do t'ju lejoj\u00eb t\u00eb reduktoni ndjesh\u00ebm rreziqet e siguris\u00eb, n\u00eb fakt pa asnj\u00eb kosto.<\/p>\n<blockquote><p>Disa shembuj p\u00ebr disa sisteme operative Cisco.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/support\/docs\/ip\/access-lists\/13608-21.html\">Cisco IOS Configuration Hardening<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/tools.cisco.com\/security\/center\/resources\/increase_security_ios_xr_devices.html\">Cisco IOS-XR Configuration Hardening<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/tools.cisco.com\/security\/center\/resources\/securing_nx_os.html\">Cisco NX-OS Configuration Hardening<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/solutions\/Enterprise\/Security\/Baseline_Security\/securebasebook\/appendxD.html\">Cisco Baseline Security Check List<\/a><\/noindex><\/p>\n<p>N\u00eb baz\u00eb t\u00eb k\u00ebtyre dokumenteve mund t\u00eb krijohet nj\u00eb list\u00eb k\u00ebrkesash p\u00ebr konfigurimin e \u00e7do lloj pajisje. P\u00ebr shembull, p\u00ebr Cisco N7K VDC, k\u00ebto k\u00ebrkesa mund t\u00eb duken <noindex><a rel=\"nofollow\" href=\"https:\/\/www.dropbox.com\/s\/hnat6yriyptigzb\/7k_hard.xlsx?dl=0\">k\u00ebshtu<\/a><\/noindex>.<\/p><\/blockquote>\n<p>\nK\u00ebshtu, mund t\u00eb krijohen skedar\u00eb konfigurimi p\u00ebr lloje t\u00eb ndryshme pajisjesh aktive n\u00eb infrastruktur\u00ebn tuaj rrjet\u00eb. M\u00eb pas, manualisht ose duke p\u00ebrdorur automatizimin, mund t'i \u00abngarkoni\u00bb k\u00ebto skedar\u00eb konfigurimi. Si t\u00eb automatizoni k\u00ebt\u00eb proces do t\u00eb shqyrtohet n\u00eb nj\u00eb seri artikujsh, t\u00eb kushtuar orkestrimit dhe automatizimit.<\/p>\n<h1>Auditimi i dizajnit t\u00eb siguris\u00eb<\/h1>\n<p>\nZakonisht n\u00eb rrjetin e nd\u00ebrmarrjes (enterprise network) ndodhen k\u00ebto segmente n\u00eb nj\u00eb far\u00eb forme: <\/p>\n<ul>\n<li>DC (Sh\u00ebrbimet publike DMZ dhe qendra e t\u00eb dh\u00ebnave Intranet)<\/li>\n<li>Qasja n\u00eb Internet<\/li>\n<li>VPN p\u00ebr qasjen e larg\u00ebt<\/li>\n<li>WAN edge<\/li>\n<li>Deg\u00eb<\/li>\n<li>Kampusi (Zyra)<\/li>\n<li>B\u00ebrthama<\/li>\n<\/ul>\n<p>\nEmrat jan\u00eb marr\u00eb nga <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/solutions\/Enterprise\/Security\/SAFE_RG\/SAFE_rg\/chap1.html\">Cisco SAFE<\/a><\/noindex> modeli, por nuk \u00ebsht\u00eb e nevojshme, natyrisht, t\u00eb lidhemi vet\u00ebm me k\u00ebta emra dhe me k\u00ebt\u00eb model. Megjithat\u00eb, d\u00ebshirojm\u00eb t\u00eb flasim p\u00ebr thelbin dhe t\u00eb mos jet\u00eb nj\u00eb ngat\u00ebrrim me formalitetet.<\/p>\n<p>P\u00ebr secilin prej k\u00ebtyre segmenteve, k\u00ebrkesat p\u00ebr nivelin e siguris\u00eb, rreziqet dhe, p\u00ebrkat\u00ebsisht, zgjidhjet do t\u00eb ndryshojn\u00eb.<\/p>\n<p>T\u00eb shqyrtojm\u00eb secilin prej tyre ve\u00e7 e ve\u00e7 p\u00ebr problemet q\u00eb mund t\u00eb hasni nga pik\u00ebpamja e dizajnit t\u00eb siguris\u00eb. Sigurisht, do t\u00eb p\u00ebrs\u00ebris se kjo artikull nuk pretendon p\u00ebr p\u00ebrmbajtje t\u00eb plot\u00eb, nj\u00eb arritje q\u00eb \u00ebsht\u00eb e v\u00ebshtir\u00eb n\u00eb k\u00ebt\u00eb tem\u00eb t\u00eb thell\u00eb dhe shum\u00eb dimensional, por pasqyron p\u00ebrvoj\u00ebn time personale.<\/p>\n<p>Nuk ekziston nj\u00eb zgjidhje ideale (n\u00eb \u00e7do rast tani). Ky \u00ebsht\u00eb gjithmon\u00eb nj\u00eb kompromis. Por \u00ebsht\u00eb e r\u00ebnd\u00ebsishme q\u00eb vendimi p\u00ebr t\u00eb p\u00ebrdorur nj\u00eb qasje t\u00eb caktuar t\u00eb jet\u00eb b\u00ebr\u00eb me vet\u00ebdije, duke kuptuar si p\u00ebravantazhet, ashtu edhe disavantazhet e saj.<\/p>\n<h2>Data Center<\/h2>\n<p>\nSegmenti m\u00eb kritik nga pik\u00ebpamja e siguris\u00eb.<br \/>\nDhe, si zakonisht, k\u00ebtu nuk ka nj\u00eb zgjidhje universale. T\u00eb gjitha varen shum\u00eb nga k\u00ebrkesat p\u00ebr rrjet. <\/p>\n<h3>A \u00ebsht\u00eb i nevojsh\u00ebm nj\u00eb firewall?<\/h3>\n<p>\nDuket se p\u00ebrgjigjja \u00ebsht\u00eb e qart\u00eb, por gj\u00ebrat nuk jan\u00eb aq t\u00eb thjeshta sa mund t\u00eb duken. Zgjedhja juaj mund t\u00eb ndikohet jo vet\u00ebm nga<b> \u00e7mimi<\/b>. <\/p>\n<blockquote><p>Shembulli 1. <b>Vonesa.<\/b><\/p>\n<p>N\u00ebse nj\u00eb vones\u00eb e ul\u00ebt \u00ebsht\u00eb nj\u00eb k\u00ebrkes\u00eb kritike nd\u00ebrmjet disa segmenteve t\u00eb rrjetit, si\u00e7 ndodh n\u00eb rastin e tregjeve, nuk do t\u00eb mund t\u00eb p\u00ebrdorim firewall nd\u00ebrmjet k\u00ebtyre segmenteve. \u00cbsht\u00eb e v\u00ebshtir\u00eb t\u00eb gjejm\u00eb studime mbi vonesat n\u00eb firewall, por vet\u00ebm disa modele switchesh mund t\u00eb ofrojn\u00eb vonesa m\u00eb t\u00eb ul\u00ebta se 1 mksec, k\u00ebshtu q\u00eb mendoj se n\u00ebse mikrosekundat jan\u00eb t\u00eb r\u00ebnd\u00ebsishme p\u00ebr ju, firewall-et nuk jan\u00eb p\u00ebr ju.<\/p><\/blockquote>\n<blockquote><p>Shembulli 2. <b>Performanca.<\/b><\/p>\n<p>Kapaciteti i broadband-it t\u00eb switch-\u00ebve L3 t\u00eb nivelit t\u00eb lart\u00eb \u00ebsht\u00eb zakonisht shum\u00eb m\u00eb i lart\u00eb se kapaciteti i firewall-eve m\u00eb t\u00eb fuqishme. Prandaj, n\u00eb rastin e trafik t\u00eb lart\u00eb, p\u00ebr ju gjithashtu me siguri do t\u00eb duhet ta d\u00ebrgoni k\u00ebt\u00eb trafik p\u00ebrmes nj\u00eb rruge anashkalimi t\u00eb firewall-eve.<\/p><\/blockquote>\n<p><\/p>\n<blockquote><p>Shembulli 3. <b>Besueshm\u00ebria.<\/b><\/p>\n<p>Firewall-at, ve\u00e7an\u00ebrisht NGFW (Firewall-e t\u00eb Gjenerat\u00ebs s\u00eb Re) jan\u00eb pajisje t\u00eb nd\u00ebrlikuara. Ato jan\u00eb ndjesh\u00ebm m\u00eb t\u00eb nd\u00ebrlikuara se switch-at L3\/L2. Ato ofrojn\u00eb nj\u00eb num\u00ebr t\u00eb madh sh\u00ebrbimesh dhe mund\u00ebsish konfigurimi, prandaj nuk \u00ebsht\u00eb e \u00e7uditshme q\u00eb besueshm\u00ebria e tyre \u00ebsht\u00eb ndjesh\u00ebm m\u00eb e ul\u00ebt. N\u00ebse vazhdim\u00ebsia e sh\u00ebrbimit \u00ebsht\u00eb kritike p\u00ebr rrjetin, ndoshta do t'ju duhet t\u00eb zgjidhni se \u00e7far\u00eb do t\u00eb \u00e7oj\u00eb n\u00eb nj\u00eb disponibilitet m\u00eb t\u00eb mir\u00eb - mbrojtja me firewall ose thjesht\u00ebsia e rrjetit t\u00eb nd\u00ebrtuar mbi switch-a (ose lloje t\u00eb ndryshme fabrikash) duke p\u00ebrdorur ACL t\u00eb zakonshme.<\/p><\/blockquote>\n<p> N\u00eb rastet e m\u00ebsip\u00ebrme, p\u00ebr siguri do t'ju duhet t\u00eb b\u00ebni nj\u00eb kompromis. Shikoni drejt zgjidhjeve t\u00eb m\u00ebposhtme: <\/p>\n<ul>\n<li>n\u00ebse vendosni t\u00eb mos p\u00ebrdorni firewall-at brenda qendr\u00ebs s\u00eb t\u00eb dh\u00ebnave, duhet t\u00eb mendoni se si t\u00eb kufizoni sa m\u00eb shum\u00eb akseset n\u00eb periferin\u00eb. P\u00ebr shembull, mund t\u00eb hapni vet\u00ebm portet e nevojshme nga Interneti (p\u00ebr trafikun e klient\u00ebve) dhe akseset administrative n\u00eb qendr\u00ebn e t\u00eb dh\u00ebnave vet\u00ebm nga hostat e skakhtar\u00ebve. N\u00eb hostat e skakhtar\u00ebve, kryeni t\u00eb gjitha kontrollat e nevojshme (autentikimin\/autorizimin, antivirusin, regjistrimin, \u2026)<\/li>\n<li>mund t\u00eb p\u00ebrdorni ndarjen logjike t\u00eb rrjetit t\u00eb qendr\u00ebs s\u00eb t\u00eb dh\u00ebnave n\u00eb segmente, si\u00e7 \u00ebsht\u00eb p\u00ebrshkruar n\u00eb PSEFABRIC <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/nihole\/PSEFABRIC\/wiki\/p002-design\">shembulli p002<\/a><\/noindex>. N\u00eb k\u00ebt\u00eb rast, rrug\u00ebzimi duhet t\u00eb konfigurohet k\u00ebshtu q\u00eb trafiku i ndjesh\u00ebm ndaj vonesave ose trafiku me intensitet t\u00eb lart\u00eb t\u00eb kaloj\u00eb \"brenda\" nj\u00eb segmenti (n\u00eb rastin e p002, VRF) dhe t\u00eb mos shkoj\u00eb p\u00ebrmes firewall-it. Trafiku nd\u00ebrmjet segmenteve t\u00eb ndryshme do t\u00eb vazhdoj\u00eb t\u00eb kaloj\u00eb p\u00ebrmes firewall-it. Gjithashtu, mund t\u00eb p\u00ebrdoren route leaking midis VRF-ve p\u00ebr t\u00eb shmangur ridrejtimin e trafikut p\u00ebrmes firewall-it.<\/li>\n<li>mund t\u00eb p\u00ebrdorni gjithashtu firewall-in n\u00eb modalitetin transparent dhe vet\u00ebm p\u00ebr ato VLAN-e ku k\u00ebta faktor\u00eb (vonesa \/ performanca) nuk jan\u00eb thelb\u00ebsor\u00eb. Por duhet t\u00eb studioni me kujdes kufizimet q\u00eb lidhen me p\u00ebrdorimin e k\u00ebsaj metode p\u00ebr \u00e7do ofrues.<\/li>\n<li>mund t\u00eb mendoni p\u00ebr implementimin e arkitektur\u00ebs s\u00eb service chain. Kjo do t\u00eb mund\u00ebsonte rrug\u00ebzimin e vet\u00ebm trafikut t\u00eb nevojsh\u00ebm p\u00ebrmes firewall-it. Teoretikisht duket bukur, por nuk kam par\u00eb kurr\u00eb k\u00ebt\u00eb zgjidhje n\u00eb prodhim. Ne testuam service chain p\u00ebr Cisco ACI \/ Juniper SRX \/ F5 LTM rreth 3 vjet m\u00eb par\u00eb, por at\u00ebher\u00eb kjo zgjidhje na dukej \"e pap\u00ebrfunduar\".<\/li>\n<\/ul>\n<p><\/p>\n<h3>Niveli i mbrojtjes<\/h3>\n<p>\nTani \u00ebsht\u00eb pyetja se cilat mjete d\u00ebshironi t\u00eb p\u00ebrdorni p\u00ebr filtrimin e trafikut. Ja disa nga mund\u00ebsit\u00eb q\u00eb zakonisht jan\u00eb t\u00eb pranishme n\u00eb NGFW (p.sh., <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.paloaltonetworks.com\/pan-os\/8-0\/pan-os-admin\/policy\/security-profiles.html\">k\u00ebtu<\/a><\/noindex>):<\/p>\n<ul>\n<li>firewall i gjendjes (me default)<\/li>\n<li>firewall p\u00ebr aplikacione<\/li>\n<li>parandalimi i k\u00ebrc\u00ebnimeve (antivirus, anti-spyware dhe vulnerabilitet)<\/li>\n<li>filtrimi i URL-ve<\/li>\n<li>filtrimi i t\u00eb dh\u00ebnave (filtrimi i p\u00ebrmbajtjes)<\/li>\n<li>bllokimi i skedar\u00ebve (bllokimi i llojeve t\u00eb skedar\u00ebve)<\/li>\n<li>mbrojtja nga DoS<\/li>\n<\/ul>\n<p>\nEdhe kjo nuk \u00ebsht\u00eb gjithmon\u00eb e qart\u00eb. Duke u dukur, sa m\u00eb i lart\u00eb t\u00eb jet\u00eb niveli i mbrojtjes, aq m\u00eb mir\u00eb. Por gjithashtu duhet t\u00eb merrni parasysh se<\/p>\n<ul>\n<li>sa m\u00eb shum\u00eb nga funksionet e m\u00ebsip\u00ebrme t\u00eb firewall-it t\u00eb p\u00ebrdorni, aq natyrsh\u00ebm do t\u00eb jet\u00eb m\u00eb e shtrenjt\u00eb (licencat, modulet shtes\u00eb)<\/li>\n<li>p\u00ebrdorimi i disa algoritmeve mund t\u00eb zvog\u00ebloj\u00eb ndjesh\u00ebm kapacitetin e kalimit t\u00eb firewall-it, si dhe t\u00eb rris\u00eb vonesat, shih p\u00ebr shembull <noindex><a rel=\"nofollow\" href=\"https:\/\/www.paloaltonetworks.com\/products\/secure-the-network\/next-generation-firewall\/pa-7000-series\">k\u00ebtu<\/a><\/noindex><\/li>\n<li>ashtu si \u00e7do zgjidhje komplekse, p\u00ebrdorimi i metodave komplekse t\u00eb mbrojtjes mund t\u00eb ul\u00eb besueshm\u00ebrin\u00eb e zgjidhjes suaj, p\u00ebr shembull, duke p\u00ebrdorur firewall p\u00ebr aplikacione kam hasur n\u00eb bllokimin e disa aplikacioneve q\u00eb funksionojn\u00eb normale (dns, smb)<\/li>\n<\/ul>\n<p>\nSi zakonisht, ju nevojitet t\u00eb gjeni zgjidhjen optimale p\u00ebr rrjetin tuaj.<\/p>\n<p>Nuk \u00ebsht\u00eb e mundur t\u00eb jepet nj\u00eb p\u00ebrgjigje e qart\u00eb p\u00ebr se cilat funksione mbrojtjeje mund t\u00eb nevojiten. S\u00eb pari, sepse kjo natyrisht varet nga t\u00eb dh\u00ebnat q\u00eb jeni duke transmetuar ose ruajtur dhe p\u00ebrpiqeni t\u00eb mbrojni. S\u00eb dyti, n\u00eb t\u00eb v\u00ebrtet\u00eb, shpesh zgjedhja e mjeteve t\u00eb mbrojtjes \u00ebsht\u00eb nj\u00eb \u00e7\u00ebshtje besimi dhe besueshm\u00ebrie ndaj ofruesit. Ju nuk i dini algoritmet, nuk keni nj\u00eb ide se sa efikas\u00eb jan\u00eb dhe nuk mund t'i testoni ato plot\u00ebsisht. <\/p>\n<p>Prandaj, n\u00eb segmente kritike, nj\u00eb zgjidhje e mir\u00eb mund t\u00eb jet\u00eb p\u00ebrdorimi i ofertave nga kompani t\u00eb ndryshme. P\u00ebr shembull, ju mund t\u00eb p\u00ebrfshini antivirusin n\u00eb firewall, por gjithashtu t\u00eb p\u00ebrdorni mbrojtjen antivirus (nga nj\u00eb prodhues tjet\u00ebr) lokalish n\u00eb hostet.<\/p>\n<h3>Segmentimi<\/h3>\n<p>\nB\u00ebhet fjal\u00eb p\u00ebr segmentimin logjik t\u00eb rrjetit t\u00eb qendr\u00ebs s\u00eb t\u00eb dh\u00ebnave. P\u00ebr shembull, ndarja n\u00eb VLAN dhe subnet \u00ebsht\u00eb gjithashtu segmentim logjik, por nuk do ta trajtojm\u00eb at\u00eb p\u00ebr shkak t\u00eb qart\u00ebsis\u00eb s\u00eb saj. Interesante \u00ebsht\u00eb segmentimi duke marr\u00eb parasysh entitete si zonat e siguris\u00eb t\u00eb FW, VRF (dhe ekuivalent\u00ebt e tyre p\u00ebr ofrues t\u00eb ndrysh\u00ebm), pajisjet logjike (PA VSYS, Cisco N7K VDC, Cisco ACI Tenant, \u2026), \u2026<\/p>\n<blockquote><p>Nj\u00eb shembull i till\u00eb i segmentimit logjik dhe dizajnit t\u00eb k\u00ebrkuar t\u00eb qendr\u00ebs s\u00eb t\u00eb dh\u00ebnave \u00ebsht\u00eb paraqitur n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/nihole\/PSEFABRIC\/wiki\/p002-design\">p002 e projektit PSEFABRIC<\/a><\/noindex>.<\/p><\/blockquote>\n<p> Duke p\u00ebrcaktuar pjes\u00ebt logjike t\u00eb rrjetit tuaj, ju m\u00eb pas mund t\u00eb p\u00ebrshkruani si l\u00ebviz trafiku midis segmenteve t\u00eb ndryshme, mbi cilat pajisje do t\u00eb kryhet filtrimi dhe me \u00e7far\u00eb mjetesh.<\/p>\n<p>N\u00ebse rrjeti juaj nuk ka nj\u00eb ndarje logjike t\u00eb qart\u00eb dhe rregullat e zbatimit t\u00eb politikave t\u00eb siguris\u00eb p\u00ebr rrjedhat e ndryshme t\u00eb t\u00eb dh\u00ebnave (flow) nuk jan\u00eb formalizuar, at\u00ebher\u00eb kjo do t\u00eb thot\u00eb se kur hapni nj\u00eb qasje t\u00eb till\u00eb, ju detyroheni t\u00eb merrni k\u00ebt\u00eb vendim, dhe me shum\u00eb probabilitet do ta b\u00ebni k\u00ebt\u00eb n\u00eb m\u00ebnyra t\u00eb ndryshme \u00e7do her\u00eb. <\/p>\n<p>Shpesh segmentimi bazohet vet\u00ebm n\u00eb zonat e siguris\u00eb FW. At\u00ebher\u00eb duhet t'i p\u00ebrgjigjeni k\u00ebtyre pyetjeve:<\/p>\n<ul>\n<li>cilat zona sigurie ju nevojiten<\/li>\n<li>\u00e7far\u00eb niveli mbrojtjeje d\u00ebshironi t\u00eb aplikoni p\u00ebr secil\u00ebn nga k\u00ebto zona <\/li>\n<li>a do t\u00eb lejohet si parazgjedhje trafiku intra-zone <\/li>\n<li>n\u00ebse jo, cilat politika filtrimi do t\u00eb zbatohen brenda secil\u00ebs nga zonat<\/li>\n<li>cilat politika filtrimi do t\u00eb zbatohen p\u00ebr \u00e7do \u00e7ift zonash (burimi\/destinacion)<\/li>\n<\/ul>\n<p><\/p>\n<h3>TCAM<\/h3>\n<p>\nProblemi i munges\u00ebs s\u00eb TCAM (Ternary Content Addressable Memory) \u00ebsht\u00eb shpesh i pranish\u00ebm, si p\u00ebr routing ashtu edhe p\u00ebr akses. N\u00eb mendimin tim, kjo \u00ebsht\u00eb nj\u00eb nga \u00e7\u00ebshtjet m\u00eb t\u00eb r\u00ebnd\u00ebsishme kur zgjidhni pajisjet, prandaj duhet t'i kushtohet k\u00ebsaj \u00e7\u00ebshtjeje nj\u00eb kujdes i duhur.<\/p>\n<blockquote><p>Shembulli 1. Tabela e Forwarding TCAM.<\/p>\n<p>Le t\u00eb shqyrtojm\u00eb <noindex>Palo Alto 7k<\/noindex> firewall.<br \/>\nV\u00ebrejm\u00eb se madh\u00ebsia e tabel\u00ebs s\u00eb forwarding IPv4* = 32K<br \/>\nKjo sasi rrugash \u00ebsht\u00eb gjithsej p\u00ebr t\u00eb gjitha VSYS-\u00ebt.<\/p>\n<p>Le t\u00eb supozojm\u00eb se sipas dizajnit tuaj keni vendosur t\u00eb p\u00ebrdorni 4 VSYS.<br \/>\n\u00c7do nj\u00ebri nga k\u00ebto VSYS \u00ebsht\u00eb lidhur p\u00ebrmes BGP n\u00eb dy PE t\u00eb clouds MPLS, q\u00eb po e p\u00ebrdorni si BB. N\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb, 4 VSYS ndajn\u00eb t\u00eb gjitha rrug\u00ebt specifike me nj\u00ebri-tjetrin dhe kan\u00eb nj\u00eb tabel\u00eb forwarding me grupe rruge pothuajse t\u00eb nj\u00ebjta (por me NH t\u00eb ndrysh\u00ebm). Duke qen\u00eb se \u00e7do VSYS ka 2 sesi BGP (me konfigurime t\u00eb nj\u00ebjta), \u00e7do rrug\u00eb e marr\u00eb p\u00ebrmes MPLS ka 2 NH dhe, p\u00ebr rrjedhoj\u00eb, 2 regjistrime FIB n\u00eb Tabel\u00ebn e Forwarding. N\u00ebse supozojm\u00eb se ky \u00ebsht\u00eb firewall-i i vet\u00ebm n\u00eb data-qendr\u00ebn dhe ai duhet t\u00eb dij\u00eb p\u00ebr t\u00eb gjitha rrug\u00ebt, at\u00ebher\u00eb kjo do t\u00eb thot\u00eb se numri total i rrug\u00ebve n\u00eb data-qendr\u00ebn ton\u00eb nuk mund t\u00eb jet\u00eb m\u00eb shum\u00eb se 32K\/(4 * 2) = 4K. <\/p>\n<p>Tani, le t\u00eb supozojm\u00eb se kemi 2 qendra t\u00eb t\u00eb dh\u00ebnave (me dizajn t\u00eb nj\u00ebjt\u00eb), dhe duam t\u00eb p\u00ebrdorim VLAN t\u00eb \"shtrira\" midis qendrave t\u00eb t\u00eb dh\u00ebnave (p\u00ebr shembull, p\u00ebr vMotion), pastaj, p\u00ebr t\u00eb zgjidhur problemin e ruterizimit, duhet t\u00eb p\u00ebrdorim rrug\u00ebt e hosteve. Por kjo do t\u00eb thot\u00eb se p\u00ebr 2 qendrat e t\u00eb dh\u00ebnave do t\u00eb kemi jo m\u00eb shum\u00eb se 4096 hoste t\u00eb mundsh\u00ebm dhe, sigurisht, kjo mund t\u00eb mos jet\u00eb e mjaftueshme.<\/p><\/blockquote>\n<blockquote><p>Shembulli 2. ACL TCAM.<\/p>\n<p>N\u00ebse planifikoni t\u00eb filtroni trafikun n\u00eb switch-e L3 (ose zgjidhje t\u00eb tjera q\u00eb p\u00ebrdorin switch-e L3, si p\u00ebr shembull Cisco ACI), kur zgjidhni pajisjet duhet t\u2019i kushtoni v\u00ebmendje ACL TCAM.<\/p>\n<p>Supozoni se d\u00ebshironi t\u00eb kontrolloni aksesin n\u00eb nd\u00ebrfaqet SVI t\u00eb Cisco Catalyst 4500. Pastaj, si\u00e7 tregohet n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/support\/docs\/switches\/catalyst-4000-series-switches\/66978-tcam-cat-4500.html\">k\u00ebt\u00eb artikull<\/a><\/noindex>, p\u00ebr t\u00eb kontrolluar trafikun e daljes (ashtu si dhe at\u00eb t\u00eb ardhjes) n\u00eb nd\u00ebrfaqet, mund t\u00eb p\u00ebrdorni vet\u00ebm 4096 rreshta TCAM. Kjo, duke p\u00ebrdorur TCAM3, do t\u2019ju jap\u00eb rreth 4000 ACE (rreshta ACL).<\/p><\/blockquote>\n<p> N\u00eb rast se p\u00ebrballeni me nj\u00eb problem t\u00eb TCAM-it t\u00eb pamjaftuesh\u00ebm, e para q\u00eb duhet t\u00eb shqyrtoni \u00ebsht\u00eb optimizimi. Pra, n\u00eb rastin e nj\u00eb problemi me madh\u00ebsin\u00eb e Tabel\u00ebs s\u00eb D\u00ebrgimit, konsideroni konsolidimin e rrug\u00ebve. N\u00ebse keni nj\u00eb problem me madh\u00ebsin\u00eb e TCAM-it p\u00ebr akseset \u2014 duhet t\u00eb b\u00ebni nj\u00eb auditim t\u00eb aksesit, t\u00eb fshini regjistrimet e vjetra dhe t\u00eb mbivendosura, si dhe ndoshta t\u00eb rishikoni procedur\u00ebn e hapjes s\u00eb aksesit (do t\u00eb diskutohet n\u00eb detaje n\u00eb kapitullin e dedikuar auditimit t\u00eb aksesit).<\/p>\n<h3>Disponibilitet i Lart\u00eb<\/h3>\n<p>\nPyetja \u00ebsht\u00eb, a duhet t\u00eb p\u00ebrdorim HA p\u00ebr firewalls apo t\u00eb vendosim dy kutia t\u00eb pavarura \"paralel\" dhe n\u00eb rast se nj\u00ebra bie, t\u00eb drejtojm\u00eb trafikun p\u00ebrmes tjetr\u00ebs?<\/p>\n<p>Duket e qart\u00eb, duhet t\u00eb p\u00ebrdorim HA. Arsyetimi pse kjo pyetje ngrihet megjithat\u00eb \u00ebsht\u00eb se, p\u00ebr fat t\u00eb keq, teorikisht dhe n\u00eb reklama 99 e disa n\u00ebnt\u00ebsh prapa presjes p\u00ebr disponueshm\u00ebrin\u00eb shpesh rezultojn\u00eb t\u00eb jen\u00eb shum\u00eb m\u00eb pak roz\u00eb n\u00eb praktik\u00eb. HA \u00ebsht\u00eb nj\u00eb mekaniz\u00ebm mjaft kompleks nga pik\u00ebpamja logjike, dhe me pajisje t\u00eb ndryshme e me prodhues t\u00eb ndrysh\u00ebm (nuk ka p\u00ebrjashtime) kemi hasur n\u00eb probleme, defekte dhe ndalime sh\u00ebrbimi.<\/p>\n<p>Me p\u00ebrdorimin e HA, do t\u00eb keni mund\u00ebsin\u00eb t\u00eb fikni nodet e ve\u00e7anta dhe t\u00eb kaloni midis tyre pa ndalur sh\u00ebrbimin, q\u00eb \u00ebsht\u00eb e r\u00ebnd\u00ebsishme, p\u00ebr shembull, gjat\u00eb p\u00ebrdit\u00ebsimeve. Megjithat\u00eb, ka nj\u00eb probabilitet jo t\u00eb vog\u00ebl q\u00eb t\u00eb d\u00ebshtojn\u00eb t\u00eb dy nodet nj\u00ebkoh\u00ebsisht, si dhe q\u00eb p\u00ebrdit\u00ebsimi i ardhsh\u00ebm t\u00eb mos shkoj\u00eb aq mir\u00eb sa premton shit\u00ebsi (k\u00ebt\u00eb problem mund ta evitoni n\u00ebse keni mund\u00ebsin\u00eb t\u00eb testoni p\u00ebrdit\u00ebsimin n\u00eb pajisje laboratorike).<\/p>\n<p>N\u00ebse nuk p\u00ebrdorni HA, rreziku juaj p\u00ebr d\u00ebshtim t\u00eb dyfisht\u00eb \u00ebsht\u00eb ndjesh\u00ebm m\u00eb i ul\u00ebt (pasi keni 2Firewall t\u00eb pavarur), por p\u00ebr shkak se sesionet nuk jan\u00eb t\u00eb sinkronizuara, \u00e7do her\u00eb q\u00eb ndodh kalimi midis k\u00ebtyre firewalleve, do t\u00eb humbni trafik. Natyrisht, mund t\u00eb p\u00ebrdorni firewall t\u00eb paq\u00ebndruesh\u00ebm, por k\u00ebshtu q\u00ebllimi i p\u00ebrdorimit t\u00eb firewalit n\u00eb shum\u00eb aspekte humbet.<\/p>\n<p>Pra anda, n\u00ebse gjat\u00eb auditimit keni gjetur firewalls t\u00eb ve\u00e7anta dhe po mendoni p\u00ebr rritjen e besueshm\u00ebris\u00eb s\u00eb rrjetit tuaj, at\u00ebher\u00eb HA \u00ebsht\u00eb sigurisht nj\u00eb nga zgjidhjet e rekomanduara, por duhet t\u00eb merrni parasysh edhe disavantazhet q\u00eb lidhen me k\u00ebt\u00eb qasje, dhe ndoshta nj\u00eb zgjidhje tjet\u00ebr do t\u00eb ishte m\u00eb e p\u00ebrshtatshme p\u00ebr rrjetin tuaj.<\/p>\n<h3>Leht\u00ebsia e menaxhimit<\/h3>\n<p>\nP\u00ebrgjith\u00ebsisht, HA p\u00ebrfshin gjithashtu menaxhueshm\u00ebrin\u00eb. N\u00eb vend t\u00eb konfigurimit t\u00eb dy kutive ndaras dhe zgjidhjes s\u00eb problemit t\u00eb sinkronizimit t\u00eb konfigurimeve, ju i menaxhoni ato n\u00eb nj\u00eb mas\u00eb t\u00eb till\u00eb si\u00e7 do t\u00eb kishit nj\u00eb pajisje t\u00eb vetme. <\/p>\n<p>Por ndoshta keni shum\u00eb qendra t\u00eb t\u00eb dh\u00ebnave dhe shum\u00eb firewalls, at\u00ebher\u00eb kjo \u00e7\u00ebshtje del n\u00eb nj\u00eb nivel t\u00eb ri. Dhe \u00e7\u00ebshtja nuk \u00ebsht\u00eb vet\u00ebm p\u00ebr konfigurimin, por gjithashtu p\u00ebr<\/p>\n<ul>\n<li>backup-i i konfigurimeve<\/li>\n<li>dokumentimet<\/li>\n<li>p\u00ebrmir\u00ebsimet<\/li>\n<li>monitorimin<\/li>\n<li>logimin<\/li>\n<\/ul>\n<p>\nDhe t\u00eb gjitha k\u00ebto mund t\u00eb zgjidhen nga sistemet e menaxhimit qendror. <\/p>\n<blockquote><p>K\u00ebshtu, p\u00ebr shembull, n\u00ebse p\u00ebrdorni firewalls Palo Alto, at\u00ebher\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/www.paloaltonetworks.com\/products\/management\/panorama\">Panorama<\/a><\/noindex> \u00ebsht\u00eb nj\u00eb zgjidhje e till\u00eb.\n<\/p><\/blockquote>\n<p>\n<i>Vazhdon.<\/i><br \/>\n<br \/>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0440\u0435\u0442\u044c\u0435\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb. \u0421\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u0441\u0442\u0430\u0442\u0435\u0439 \u0446\u0438\u043a\u043b\u0430 \u0438 \u0441\u0441\u044b\u043b\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0437\u0434\u0435\u0441\u044c. \u041d\u0435\u0442 \u0441\u043c\u044b\u0441\u043b\u0430 \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u044c \u043e \u043f\u043e\u043b\u043d\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 security \u0440\u0438\u0441\u043a\u043e\u0432. \u041c\u044b \u0432 \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0435 \u043d\u0435 \u043c\u043e\u0436\u0435\u043c \u0441\u043d\u0438\u0437\u0438\u0442\u044c \u0438\u0445 \u0434\u043e \u043d\u0443\u043b\u044f. \u0422\u0430\u043a\u0436\u0435 \u043d\u0443\u0436\u043d\u043e \u043f\u043e\u043d\u0438\u043c\u0430\u0442\u044c, \u0447\u0442\u043e \u043f\u0440\u0438 \u0441\u0442\u0440\u0435\u043c\u043b\u0435\u043d\u0438\u0438 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0441\u0435\u0442\u044c \u0431\u043e\u043b\u0435\u0435 \u0438 \u0431\u043e\u043b\u0435\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043d\u0430\u0448\u0438 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0441\u0442\u0430\u043d\u043e\u0432\u044f\u0442\u0441\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23033,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31058","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0440\u0435\u0442\u044c\u0435\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb. \u0421\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u0441\u0442\u0430\u0442\u0435\u0439 \u0446\u0438\u043a\u043b\u0430 \u0438 \u0441\u0441\u044b\u043b\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0437\u0434\u0435\u0441\u044c. \u041d\u0435\u0442 \u0441\u043c\u044b\u0441\u043b\u0430 \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u044c \u043e \u043f\u043e\u043b\u043d\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 security \u0440\u0438\u0441\u043a\u043e\u0432. \u041c\u044b \u0432 \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0435 \u043d\u0435 \u043c\u043e\u0436\u0435\u043c \u0441\u043d\u0438\u0437\u0438\u0442\u044c \u0438\u0445 \u0434\u043e \u043d\u0443\u043b\u044f. \u0422\u0430\u043a\u0436\u0435 \u043d\u0443\u0436\u043d\u043e \u043f\u043e\u043d\u0438\u043c\u0430\u0442\u044c, \u0447\u0442\u043e \u043f\u0440\u0438 \u0441\u0442\u0440\u0435\u043c\u043b\u0435\u043d\u0438\u0438 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0441\u0435\u0442\u044c \u0431\u043e\u043b\u0435\u0435 \u0438 \u0431\u043e\u043b\u0435\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043d\u0430\u0448\u0438 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0441\u0442\u0430\u043d\u043e\u0432\u044f\u0442\u0441\u044f\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c. \u0413\u043b\u0430\u0432\u0430 \u0442\u0440\u0435\u0442\u044c\u044f. \u0421\u0435\u0442\u0435\u0432\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c. \u0427\u0430\u0441\u0442\u044c \u043f\u0435\u0440\u0432\u0430\u044f | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0440\u0435\u0442\u044c\u0435\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb. \u0421\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u0441\u0442\u0430\u0442\u0435\u0439 \u0446\u0438\u043a\u043b\u0430 \u0438 \u0441\u0441\u044b\u043b\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0437\u0434\u0435\u0441\u044c. \u041d\u0435\u0442 \u0441\u043c\u044b\u0441\u043b\u0430 \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u044c \u043e \u043f\u043e\u043b\u043d\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 security \u0440\u0438\u0441\u043a\u043e\u0432. \u041c\u044b \u0432 \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0435 \u043d\u0435 \u043c\u043e\u0436\u0435\u043c \u0441\u043d\u0438\u0437\u0438\u0442\u044c \u0438\u0445 \u0434\u043e \u043d\u0443\u043b\u044f. \u0422\u0430\u043a\u0436\u0435 \u043d\u0443\u0436\u043d\u043e \u043f\u043e\u043d\u0438\u043c\u0430\u0442\u044c, \u0447\u0442\u043e \u043f\u0440\u0438 \u0441\u0442\u0440\u0435\u043c\u043b\u0435\u043d\u0438\u0438 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0441\u0435\u0442\u044c \u0431\u043e\u043b\u0435\u0435 \u0438 \u0431\u043e\u043b\u0435\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043d\u0430\u0448\u0438 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0441\u0442\u0430\u043d\u043e\u0432\u044f\u0442\u0441\u044f\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:39:12+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:39:12+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Si ta merrni n\u00ebn kontroll infrastruktur\u00ebn e rrjeteve. Kapitulli i tret\u00eb. Siguria e rrjetit. Pjesa e par\u00eb | ProHoster","description":"Kyli artikulli \u00ebsht\u00eb e treta n\u00eb ciklin e artikujve \"Si t\u00eb merrni n\u00ebn kontroll infrastruktur\u00ebn e rrjeteve\". P\u00ebrmbajtja e t\u00eb gjitha artikujve n\u00eb cik\u00ebl dhe lidhjet mund t\u00eb gjenden k\u00ebtu. Nuk ka kuptim t\u00eb flasim p\u00ebr eliminimin e plot\u00eb t\u00eb rreziqeve t\u00eb siguris\u00eb. N\u00eb parim, ne nuk mund t'i reduktojm\u00eb ato n\u00eb zero. Gjithashtu, duhet t\u00eb kuptojm\u00eb se nd\u00ebrsa p\u00ebrpiqemi t\u00eb b\u00ebjm\u00eb rrjetin gjithnj\u00eb e m\u00eb t\u00eb sigurt, zgjidhjet tona b\u00ebhen","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c. \u0413\u043b\u0430\u0432\u0430 \u0442\u0440\u0435\u0442\u044c\u044f. \u0421\u0435\u0442\u0435\u0432\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c. \u0427\u0430\u0441\u0442\u044c \u043f\u0435\u0440\u0432\u0430\u044f | ProHoster","og:description":"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0440\u0435\u0442\u044c\u0435\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb. \u0421\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u0441\u0442\u0430\u0442\u0435\u0439 \u0446\u0438\u043a\u043b\u0430 \u0438 \u0441\u0441\u044b\u043b\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0437\u0434\u0435\u0441\u044c. \u041d\u0435\u0442 \u0441\u043c\u044b\u0441\u043b\u0430 \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u044c \u043e \u043f\u043e\u043b\u043d\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 security \u0440\u0438\u0441\u043a\u043e\u0432. \u041c\u044b \u0432 \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0435 \u043d\u0435 \u043c\u043e\u0436\u0435\u043c \u0441\u043d\u0438\u0437\u0438\u0442\u044c \u0438\u0445 \u0434\u043e \u043d\u0443\u043b\u044f. \u0422\u0430\u043a\u0436\u0435 \u043d\u0443\u0436\u043d\u043e \u043f\u043e\u043d\u0438\u043c\u0430\u0442\u044c, \u0447\u0442\u043e \u043f\u0440\u0438 \u0441\u0442\u0440\u0435\u043c\u043b\u0435\u043d\u0438\u0438 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0441\u0435\u0442\u044c \u0431\u043e\u043b\u0435\u0435 \u0438 \u0431\u043e\u043b\u0435\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043d\u0430\u0448\u0438 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0441\u0442\u0430\u043d\u043e\u0432\u044f\u0442\u0441\u044f","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:39:12+00:00","article:modified_time":"2019-10-31T18:39:12+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31058","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 04:20:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:24:14","updated":"2026-01-21 04:20:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/31058","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=31058"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/31058\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/23033"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=31058"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=31058"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=31058"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}