{"id":31058,"date":"2019-10-31T21:39:12","date_gmt":"2019-10-31T18:39:12","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya\/"},"modified":"2019-10-31T21:39:12","modified_gmt":"2019-10-31T18:39:12","slug":"kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya","title":{"rendered":"Si t\u00eb merrni kontrollin mbi infrastruktur\u00ebn tuaj rrjet\u00eb. Koka e tret\u00eb. Siguria rrjet\u00eb. Pjesa e par\u00eb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><i>Ky ky artikulli \u00ebsht\u00eb e treta n\u00eb ciklin e artikujve \"Si t\u00eb kontrolloni infrastruktur\u00ebn e rrjetit tuaj\". P\u00ebrmbajtja e t\u00eb gjitha artikujve n\u00eb cik\u00ebl dhe lidhjet mund t\u00eb gjenden <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/447008\/\">k\u00ebtu<\/a><\/noindex><\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"Si t\u00eb merrni kontrollin mbi infrastruktur\u00ebn tuaj rrjet\u00eb. Koka e tret\u00eb. Siguria rrjet\u00eb. Pjesa e par\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/cdf33cc6797d26df8fef5533f2570c47.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNuk ka kuptim t\u00eb flasim p\u00ebr eliminimin e plot\u00eb t\u00eb rreziqeve t\u00eb siguris\u00eb. Ne, n\u00eb thelb, nuk mund t'i ulim ato n\u00eb zero. P\u00ebr m\u00eb tep\u00ebr, duhet t\u00eb kuptohet se, nd\u00ebrsa p\u00ebrpiqemi ta b\u00ebjm\u00eb rrjetin m\u00eb t\u00eb sigurt, zgjidhjet tona b\u00ebhen gjithnj\u00eb e m\u00eb t\u00eb shtrenjta. Duhet t\u00eb gjejm\u00eb nj\u00eb kompromis t\u00eb arsyesh\u00ebm p\u00ebr rrjetin tuaj midis \u00e7mimit, kompleksitetit dhe siguris\u00eb. <\/p>\n<p>Sigurisht, dizajni i siguris\u00eb \u00ebsht\u00eb organikisht e inkorporuar n\u00eb arkitektur\u00ebn e p\u00ebrgjithshme dhe zgjidhjet e siguris\u00eb t\u00eb p\u00ebrdorura ndikojn\u00eb n\u00eb shkall\u00ebzueshm\u00ebrin\u00eb, besueshm\u00ebrin\u00eb, menaxhueshm\u00ebrin\u00eb, \u2026 e infrastruktur\u00ebs s\u00eb rrjetit, e cila gjithashtu duhet t\u00eb merret parasysh.<\/p>\n<p>Por, le t\u00eb rikujtojm\u00eb se tani nuk po flasim p\u00ebr krijimin e rrjetit. N\u00eb p\u00ebrputhje me kushtet tona <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/433614\/\">nxjerr\u00ebse<\/a><\/noindex> ne tashm\u00eb kemi ndar\u00eb dizajnin, kemi p\u00ebrzgjedhur pajisjet dhe kemi krijuar infrastruktur\u00ebn, dhe n\u00eb k\u00ebt\u00eb faz\u00eb ne, sa m\u00eb shum\u00eb t\u00eb jet\u00eb e mundur, duhet t\u00eb \"jetojm\u00eb\" dhe t\u00eb gjejm\u00eb zgjidhje n\u00eb kontekstin e qasjes s\u00eb m\u00ebparshme.<\/p>\n<p>Detyra jon\u00eb tani \u00ebsht\u00eb t\u00eb identifikojm\u00eb rreziqet q\u00eb lidhen me sigurin\u00eb n\u00eb nivelin e rrjetit dhe t\u2019i ulim ato n\u00eb nj\u00eb nivel t\u00eb arsyesh\u00ebm. <noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h1>Auditimi i siguris\u00eb s\u00eb rrjetit<\/h1>\n<p>\nN\u00ebse n\u00eb organizat\u00ebn tuaj jan\u00eb implementuar proceset ISO 27k, at\u00ebher\u00eb auditimi i siguris\u00eb dhe ndryshimet n\u00eb rrjet duhet t\u00eb jen\u00eb organikisht t\u00eb inkorporuara n\u00eb proceset e p\u00ebrgjithshme brenda k\u00ebsaj qasjeje. Por k\u00ebto standarde nuk flasin p\u00ebr zgjidhje specifike, p\u00ebr konfigurimin, p\u00ebr dizajnin\u2026 Nuk ka k\u00ebshilla t\u00eb qarta, nuk ka standa q\u00eb e diktojn\u00eb me detaje se si duhet t\u00eb jet\u00eb rrjeti juaj, kjo \u00ebsht\u00eb kompleksi dhe bukuria e k\u00ebsaj detyre.<\/p>\n<p>Do t\u00eb ve\u00e7oja disa audite t\u00eb mundshme t\u00eb siguris\u00eb s\u00eb rrjetit:<\/p>\n<ul>\n<li>auditimi i konfigurimit t\u00eb pajisjeve (hardening)<\/li>\n<li>auditimi i dizajnit t\u00eb siguris\u00eb<\/li>\n<li>auditimi i qasjeve<\/li>\n<li>auditimi i proceseve<\/li>\n<\/ul>\n<p><\/p>\n<h1>Auditimi i konfiguracionit t\u00eb pajisjeve (hardening)<\/h1>\n<p>\nDuket se, n\u00eb shumic\u00ebn e rasteve, kjo \u00ebsht\u00eb pika m\u00eb e mir\u00eb fillestare p\u00ebr auditimin dhe p\u00ebrmir\u00ebsimin e siguris\u00eb s\u00eb rrjetit tuaj. IMHO, kjo \u00ebsht\u00eb nj\u00eb demonstrim e mir\u00eb e ligjit t\u00eb Pareto (20% e p\u00ebrpjekjeve japin 80% t\u00eb rezultateve, nd\u00ebrsa 80% e p\u00ebrpjekjeve japin vet\u00ebm 20% t\u00eb rezultateve). <\/p>\n<p>\u00c7\u00ebshtja \u00ebsht\u00eb se zakonisht kemi rekomandime nga furnizuesit n\u00eb lidhje me \"praktikat m\u00eb t\u00eb mira\" p\u00ebr sigurin\u00eb gjat\u00eb konfigurimit t\u00eb pajisjeve. Kjo quhet \u201chardening\u201d.<\/p>\n<p>Nj\u00eb anket\u00eb (ose mund ta krijoni vet\u00eb) mund t\u00eb p\u00ebrfshihet n\u00eb baz\u00eb t\u00eb k\u00ebtyre rekomandimeve, e cila do t'ju ndihmoj\u00eb t\u00eb p\u00ebrcaktoni se sa p\u00ebrputhet konfigurimi i pajisjeve tuaja me k\u00ebto \"praktikat m\u00eb t\u00eb mira\" dhe n\u00eb p\u00ebrputhje me rezultatet t\u00eb b\u00ebni ndryshime n\u00eb rrjetin tuaj. Kjo do t'ju lejoj\u00eb t\u00eb ulni ndjesh\u00ebm rreziqet e siguris\u00eb pa ndonj\u00eb kostot t\u00eb konsiderueshme.<\/p>\n<blockquote><p>Disa shembuj p\u00ebr disa sisteme operative Cisco.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/support\/docs\/ip\/access-lists\/13608-21.html\">Forcimi i Konfigurimit t\u00eb Cisco IOS<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/tools.cisco.com\/security\/center\/resources\/increase_security_ios_xr_devices.html\">Forcimi i Konfigurimit t\u00eb Cisco IOS-XR<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/tools.cisco.com\/security\/center\/resources\/securing_nx_os.html\">Forcimi i Konfigurimit t\u00eb Cisco NX-OS<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/solutions\/Enterprise\/Security\/Baseline_Security\/securebasebook\/appendxD.html\">Lista e Kontrollit t\u00eb Siguris\u00eb s\u00eb Cisco<\/a><\/noindex><\/p>\n<p>Bazuar n\u00eb k\u00ebto dokumente, mund t\u00eb krijohet nj\u00eb list\u00eb k\u00ebrkesash p\u00ebr konfigurimin e \u00e7do lloji pajisjeje. P\u00ebr shembull, p\u00ebr Cisco N7K VDC, k\u00ebto k\u00ebrkesa mund t\u00eb duken <noindex><a rel=\"nofollow\" href=\"https:\/\/www.dropbox.com\/s\/hnat6yriyptigzb\/7k_hard.xlsx?dl=0\">ashtu<\/a><\/noindex>.<\/p><\/blockquote>\n<p>\nK\u00ebshtu, mund t\u00eb krijohen skedar\u00eb konfigurimi p\u00ebr lloje t\u00eb ndryshme t\u00eb pajisjeve aktive n\u00eb infrastruktur\u00ebn tuaj rrjet\u00ebrore. M\u00eb pas, manualisht ose me ndihm\u00ebn e automatizimit, mund t\u00eb \"ngarkoni\" k\u00ebto skedar\u00eb konfigurimi. Si t\u00eb automatizoni k\u00ebt\u00eb proces do t\u00eb shqyrtohet n\u00eb nj\u00eb seri tjet\u00ebr artikujsh q\u00eb jan\u00eb p\u00ebrkushtuar orkestrimit dhe automatizimit.<\/p>\n<h1>Auditimi i dizajnit t\u00eb siguris\u00eb<\/h1>\n<p>\nZakoniisht n\u00eb skema e nj\u00eb nd\u00ebrmarrjeje (enterprise network) n\u00eb nj\u00eb form\u00eb ose tjet\u00ebr jan\u00eb t\u00eb pranishme segmentet e m\u00ebposhtme: <\/p>\n<ul>\n<li>DC (Sh\u00ebrbimet publike DMZ dhe qendra t\u00eb dh\u00ebnash Intranet)<\/li>\n<li>Qasja n\u00eb Internet<\/li>\n<li>VPN me qasje t\u00eb larg\u00ebt<\/li>\n<li>WAN edge<\/li>\n<li>Deg\u00eb<\/li>\n<li>Kampusi (Zyra)<\/li>\n<li>Core<\/li>\n<\/ul>\n<p>\nEmrat jan\u00eb marr\u00eb nga <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/solutions\/Enterprise\/Security\/SAFE_RG\/SAFE_rg\/chap1.html\">Cisco SAFE<\/a><\/noindex> modeli, por nuk \u00ebsht\u00eb e nevojshme, natyrisht, t\u00eb lidhen sakt\u00ebsisht me k\u00ebto emra dhe k\u00ebt\u00eb model. Megjithat\u00eb, d\u00ebshirojm\u00eb t\u00eb flasim p\u00ebr thelbin dhe t\u00eb mos bllokohemi n\u00eb formalisma.<\/p>\n<p>P\u00ebr secilin nga k\u00ebto segmente, k\u00ebrkesat p\u00ebr nivelin e siguris\u00eb, rreziqet dhe, p\u00ebr rrjedhoj\u00eb, zgjidhjet do t\u00eb ndryshojn\u00eb.<\/p>\n<p>Le t\u00eb shqyrtojm\u00eb secilin prej tyre nj\u00eb p\u00ebr nj\u00eb n\u00eb lidhje me problemet me t\u00eb cilat mund t\u00eb p\u00ebrballeni nga k\u00ebndv\u00ebshtrimi i dizajnit t\u00eb siguris\u00eb. Sigurisht, p\u00ebrs\u00ebris se ky artikull nuk pretendojn\u00eb p\u00ebr p\u00ebrmbushjen e plot\u00eb, e cila \u00ebsht\u00eb e v\u00ebshtir\u00eb t\u00eb arrihet n\u00eb k\u00ebt\u00eb tem\u00eb t\u00eb thell\u00eb dhe t\u00eb shum\u00ebanshme (n\u00ebse ndonj\u00ebher\u00eb \u00ebsht\u00eb e mundur), por pasqyron eksperienc\u00ebn time personale.<\/p>\n<p>Nuk ka zgjidhje perfekte ( t\u00eb pakt\u00ebn jo tani). Kjo \u00ebsht\u00eb gjithmon\u00eb nj\u00eb kompromis. Por \u00ebsht\u00eb e r\u00ebnd\u00ebsishme q\u00eb zgjidhja p\u00ebr t\u00eb p\u00ebrdorur nj\u00eb qasje t\u00eb caktuar t\u00eb b\u00ebhet e vet\u00ebdijshme, me kuptim t\u00eb avantazheve dhe disavantazheve t\u00eb saj.<\/p>\n<h2>Qendra e t\u00eb Dh\u00ebnave<\/h2>\n<p>\nSegmenti m\u00eb kritik nga k\u00ebndv\u00ebshtrimi i siguris\u00eb.<br \/>\nDhe, si zakonisht, k\u00ebtu gjithashtu nuk ka nj\u00eb zgjidhje universale. Gjith\u00e7ka varet shum\u00eb nga k\u00ebrkesat p\u00ebr rrjetin. <\/p>\n<h3>A nevojitet nj\u00eb firewall?<\/h3>\n<p>\nDuket sikur p\u00ebrgjigjja \u00ebsht\u00eb e qart\u00eb, por gjith\u00e7ka nuk \u00ebsht\u00eb aq e thjesht\u00eb sa duket. Dhe zgjedhja juaj mund t\u00eb ndikoj\u00eb jo vet\u00ebm<b> \u00e7mimi<\/b>. <\/p>\n<blockquote><p>Shembulli 1. <b>Vonesa.<\/b><\/p>\n<p>N\u00ebse midis ndonj\u00eb segmenti t\u00eb rrjetit, vonesa e ul\u00ebt \u00ebsht\u00eb nj\u00eb k\u00ebrkes\u00eb thelb\u00ebsore, gj\u00eb q\u00eb, p\u00ebr shembull, \u00ebsht\u00eb e v\u00ebrtet\u00eb n\u00eb rastin e tregjeve, at\u00ebher\u00eb midis k\u00ebtyre segmenteve ne nuk do t\u00eb mund t\u00eb p\u00ebrdorim firewall. \u00cbsht\u00eb e v\u00ebshtir\u00eb t\u00eb gjejm\u00eb studime mbi vonesat n\u00eb firewall, por vet\u00ebm disa modele switch-e mund t\u00eb ofrojn\u00eb vonesa m\u00eb pak se ose rreth 1 mksec, prandaj, mendoj se n\u00ebse mikrosekuadat jan\u00eb t\u00eb r\u00ebnd\u00ebsishme p\u00ebr ju, at\u00ebher\u00eb firewall-t nuk jan\u00eb p\u00ebr ju.<\/p><\/blockquote>\n<blockquote><p>Shembulli 2. <b>Performanca.<\/b><\/p>\n<p>Kapaciteti i switches L3 m\u00eb t\u00eb mir\u00eb zakonisht \u00ebsht\u00eb shum\u00eb m\u00eb i lart\u00eb se kapaciteti i firewall-ve m\u00eb produktiv\u00eb. Prandaj, n\u00eb rastin e trafikut me intensitet t\u00eb lart\u00eb, ju gjithashtu ndoshta do t\u00eb duhet ta kaloni k\u00ebt\u00eb trafik p\u00ebrtej firewall-ve.<\/p><\/blockquote>\n<p><\/p>\n<blockquote><p>Shembulli 3. <b>Q\u00ebndrueshm\u00ebria.<\/b><\/p>\n<p>Firewall-t, ve\u00e7an\u00ebrisht moderne NGFW (Firewall-i i Gjenerat\u00ebs s\u00eb Re) \u2013 jan\u00eb pajisje komplekse. Ato jan\u00eb ndjesh\u00ebm m\u00eb t\u00eb komplikuara se switch-e L3\/L2. Ato ofrojn\u00eb nj\u00eb mori sh\u00ebrbimesh dhe mund\u00ebsish p\u00ebr konfigurim, prandaj nuk \u00ebsht\u00eb e \u00e7uditshme q\u00eb q\u00ebndrueshm\u00ebria e tyre \u00ebsht\u00eb ndjesh\u00ebm m\u00eb e ul\u00ebt. N\u00ebse vazhdim\u00ebsia e sh\u00ebrbimit \u00ebsht\u00eb kritike p\u00ebr rrjetin, ndoshta do t'ju duhet t\u00eb zgjidhni se \u00e7far\u00eb do t\u00eb \u00e7oj\u00eb n\u00eb disponueshm\u00ebrin\u00eb m\u00eb t\u00eb mir\u00eb - mbrojtja me an\u00eb t\u00eb firewall-it ose thjesht\u00ebsia e rrjetit t\u00eb nd\u00ebrtuar mbi switch-e (ose lloje t\u00eb ndryshme fabrikash) duke p\u00ebrdorur ACL-t\u00eb e zakonshme.<\/p><\/blockquote>\n<p> N\u00eb rastin e shembujve t\u00eb p\u00ebrmendur m\u00eb sip\u00ebr, ju ndoshta (si zakonisht) do t\u00eb duhet t\u00eb k\u00ebrkoni nj\u00eb kompromis. Shikoni drejt zgjidhjeve t\u00eb m\u00ebposhtme: <\/p>\n<ul>\n<li>n\u00ebse keni vendosur t\u00eb mos p\u00ebrdorni firewall brenda qendr\u00ebs s\u00eb t\u00eb dh\u00ebnave, at\u00ebher\u00eb duhet t\u00eb mendoni se si t\u00eb kufizoni sa m\u00eb shum\u00eb qasjet n\u00eb periferin\u00eb. P\u00ebr shembull, mund t\u00eb hapni vet\u00ebm portet e nevojshme nga Interneti (p\u00ebr trafikun e klient\u00ebve) dhe qasjet administrative n\u00eb qendr\u00ebn e t\u00eb dh\u00ebnave vet\u00ebm nga hoste t\u00eb skakier\u00ebve. N\u00eb hostet e skakier\u00ebve kryeni t\u00eb gjitha verifikimet e nevojshme (autentikim\/autorizim, antivirus, logimin, ...)<\/li>\n<li>mund t\u00eb p\u00ebrdorni ndarjen logjike t\u00eb rrjetit t\u00eb qendr\u00ebs s\u00eb t\u00eb dh\u00ebnave n\u00eb segmente, si\u00e7 \u00ebsht\u00eb skema e p\u00ebrshkruar n\u00eb PSEFABRIC <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/nihole\/PSEFABRIC\/wiki\/p002-design\">shembulli p002<\/a><\/noindex>N\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb, drejtimi duhet t\u00eb konfigurohet n\u00eb nj\u00eb m\u00ebnyr\u00eb q\u00eb trafiku, i ndjesh\u00ebm ndaj vonesave ose trafiku me intensitet t\u00eb lart\u00eb t\u00eb kaloj\u00eb \"brenda\" nj\u00eb segmenti (n\u00eb rastin e p002, VRF-it) dhe t\u00eb mos kaloj\u00eb p\u00ebrmes firewall-it. Trafiku nd\u00ebrmjet segmenteve t\u00eb ndryshme do t\u00eb vazhdoj\u00eb t\u00eb kaloj\u00eb p\u00ebrmes firewall-it. Po ashtu, mund t\u00eb p\u00ebrdoret route leaking midis VRF-ve p\u00ebr t\u00eb shmangur ridrejtimin e trafikut p\u00ebrmes firewall-it.<\/li>\n<li>Gjithashtu, mund t\u00eb p\u00ebrdoret firewall n\u00eb modalitetin transparent dhe vet\u00ebm p\u00ebr VLAN-et p\u00ebr t\u00eb cilat k\u00ebta faktor\u00eb (vonesa\/p\u00ebrformanca) nuk jan\u00eb thelb\u00ebsor\u00eb. Por duhet t\u00eb studiohen me kujdes kufizimet q\u00eb lidhen me p\u00ebrdorimin e k\u00ebsaj mode p\u00ebr \u00e7do furnizues.<\/li>\n<li>Mund t\u00eb mendoni p\u00ebr zbatimin e arkitektur\u00ebs s\u00eb zinxhirit t\u00eb sh\u00ebrbimeve. Kjo do t\u00eb lejoj\u00eb kalimin p\u00ebrmes firewall-it vet\u00ebm t\u00eb trafikut t\u00eb nevojsh\u00ebm. Teorikisht duket bukur, por un\u00eb kurr\u00eb nuk e kam par\u00eb k\u00ebt\u00eb zgjidhje n\u00eb prodhim. Ne e testuam zinxhirin e sh\u00ebrbimeve p\u00ebr Cisco ACI\/Juniper SRX\/F5 LTM rreth 3 vjet m\u00eb par\u00eb, por n\u00eb at\u00eb koh\u00eb kjo zgjidhje na dukej \"e papjekur\".<\/li>\n<\/ul>\n<p><\/p>\n<h3>Niveli i mbrojtjes<\/h3>\n<p>\nTani duhet t\u00eb p\u00ebrgjigjeni n\u00eb pyetjen se cilat mjete d\u00ebshironi t\u00eb p\u00ebrdorni p\u00ebr filtrimin e trafikut. Ja disa nga mund\u00ebsit\u00eb q\u00eb zakonisht jan\u00eb t\u00eb pranishme n\u00eb NGFW (p.sh., <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.paloaltonetworks.com\/pan-os\/8-0\/pan-os-admin\/policy\/security-profiles.html\">k\u00ebtu<\/a><\/noindex>):<\/p>\n<ul>\n<li>firewall stateful (n\u00eb m\u00ebnyr\u00eb t\u00eb paracaktuar)<\/li>\n<li>firewall aplikacioni<\/li>\n<li>parandalimi i k\u00ebrc\u00ebnimeve (antivirus, anti-spyware dhe dob\u00ebsi)<\/li>\n<li>filtrimi i URL-ve<\/li>\n<li>filtrimi i t\u00eb dh\u00ebnave (filtrimi i p\u00ebrmbajtjes)<\/li>\n<li>bllokimi i skedar\u00ebve (bllokimi i llojeve t\u00eb skedar\u00ebve)<\/li>\n<li>mbrojtja nga dos<\/li>\n<\/ul>\n<p>\nDhe gjithashtu nuk \u00ebsht\u00eb gjith\u00e7ka e qart\u00eb. Duket se sa m\u00eb i lart\u00eb t\u00eb jet\u00eb niveli i mbrojtjes, aq m\u00eb i mir\u00eb \u00ebsht\u00eb. Por ju gjithashtu duhet t\u00eb merrni parasysh se<\/p>\n<ul>\n<li>sa m\u00eb shum\u00eb nga funksionet e m\u00ebsip\u00ebrme t\u00eb firewall-it t\u00eb p\u00ebrdorni, aq natyrisht do t\u00eb jet\u00eb m\u00eb e shtrenjt\u00eb (licencat, module t\u00eb tjera)<\/li>\n<li>p\u00ebrdorimi i disa algoritmeve mund t\u00eb ul\u00eb ndjesh\u00ebm kapacitetin e firewall-it, si dhe t\u00eb rris\u00eb vonesat, shihni p\u00ebr shembull <noindex><a rel=\"nofollow\" href=\"https:\/\/www.paloaltonetworks.com\/products\/secure-the-network\/next-generation-firewall\/pa-7000-series\">k\u00ebtu<\/a><\/noindex><\/li>\n<li>si\u00e7 \u00ebsht\u00eb \u00e7do zgjidhje e komplikuar, p\u00ebrdorimi i metodave t\u00eb nd\u00ebrlikuara t\u00eb mbrojtjes mund t\u00eb ul\u00eb besueshm\u00ebrin\u00eb e zgjidhjes suaj, p\u00ebr shembull, kur p\u00ebrdor aplikacionin e mbrojtjes un\u00eb kam hasur n\u00eb bllokimin e disa aplikacioneve mjaft standarde (dns, smb)<\/li>\n<\/ul>\n<p>\nSi zakonisht, duhet t\u00eb gjeni zgjidhjen optimale p\u00ebr rrjetin tuaj.<\/p>\n<p>Nuk \u00ebsht\u00eb e mundur t\u00eb p\u00ebrgjigjeni n\u00eb m\u00ebnyr\u00eb t\u00eb qart\u00eb se cilat funksione mbrojtjeje mund t\u00eb nevojiten. S\u00eb pari, sepse kjo natyrisht varet nga t\u00eb dh\u00ebnat q\u00eb po p\u00ebrcillni ose ruani dhe p\u00ebrpiqeni t'i mbrojtni. S\u00eb dyti, n\u00eb t\u00eb v\u00ebrtet\u00eb, shpesh zgjedhja e mjeteve t\u00eb mbrojtjes \u00ebsht\u00eb nj\u00eb \u00e7\u00ebshtje besimi dhe besimi n\u00eb furnizuesin. Ju nuk e dini algoritmet, nuk e dini sa efektiv\u00eb jan\u00eb dhe nuk mund t'i testoni plot\u00ebsisht. <\/p>\n<p>Prandaj, n\u00eb segmentet kritike, nj\u00eb zgjidhje e mir\u00eb mund t\u00eb jet\u00eb p\u00ebrdorimi i ofertave nga kompani t\u00eb ndryshme. P\u00ebr shembull, mund t\u00eb aktivizoni antivirusin n\u00eb firewall, por gjithashtu t\u00eb p\u00ebrdorni mbrojtjen antivirale (nga nj\u00eb prodhues tjet\u00ebr) lokalisht n\u00eb hostet.<\/p>\n<h3>Segmentimi<\/h3>\n<p>\nB\u00ebhet fjal\u00eb p\u00ebr segmentimin logjik t\u00eb rrjetit t\u00eb qendr\u00ebs t\u00eb t\u00eb dh\u00ebnave. P\u00ebr shembull, ndarja n\u00eb VLAN dhe n\u00ebnrrjete \u00ebsht\u00eb gjithashtu segmentim logjik, por ne nuk do ta shqyrtojm\u00eb at\u00eb p\u00ebr shkak t\u00eb evidenc\u00ebs s\u00eb saj. E r\u00ebnd\u00ebsishme \u00ebsht\u00eb segmentimi duke marr\u00eb parasysh nj\u00ebsi t\u00eb tilla si zonat e siguris\u00eb FW, VRF (dhe ekuivalent\u00ebt e tyre p\u00ebr furnizues t\u00eb ndrysh\u00ebm), pajisjet logjike (PA VSYS, Cisco N7K VDC, Cisco ACI Tenant, ...), ...<\/p>\n<blockquote><p>Nj\u00eb shembuj i till\u00eb i segmentimit logjik dhe dizajnit t\u00eb k\u00ebrkuar n\u00eb k\u00ebt\u00eb moment t\u00eb qendr\u00ebs t\u00eb t\u00eb dh\u00ebnave \u00ebsht\u00eb paraqitur n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/nihole\/PSEFABRIC\/wiki\/p002-design\">p002 projekti PSEFABRIC<\/a><\/noindex>.<\/p><\/blockquote>\n<p> Pasi t\u00eb keni p\u00ebrcaktuar pjes\u00ebt logjike t\u00eb rrjetit tuaj, mund t\u00eb p\u00ebrshkruani se si kalon trafiku midis segmenteve t\u00eb ndryshme, n\u00eb cilat pajisje do t\u00eb kryhet filtrimi dhe me \u00e7far\u00eb mjete.<\/p>\n<p>N\u00ebse rrjeti juaj nuk ka nj\u00eb ndarje logjike t\u00eb qart\u00eb dhe nuk jan\u00eb formalizuar rregullat p\u00ebr aplikimin e politikave t\u00eb siguris\u00eb p\u00ebr rrjedhat e ndryshme t\u00eb t\u00eb dh\u00ebnave, at\u00ebher\u00eb kjo do t\u00eb thot\u00eb se, kur hapni nj\u00eb qasje t\u00eb caktuar, duhet t\u00eb zgjidhni k\u00ebt\u00eb \u00e7\u00ebshtje, dhe ka nj\u00eb probabilitet t\u00eb madh q\u00eb \u00e7do her\u00eb do ta zgjidhni ndryshe. <\/p>\n<p>Shpesh, segmentimi bazohet vet\u00ebm n\u00eb zonat e siguris\u00eb FW. At\u00ebher\u00eb, ju duhet t\u00eb p\u00ebrgjigjeni n\u00eb k\u00ebto pyetje:<\/p>\n<ul>\n<li>cilat zona sigurie ju nevojiten<\/li>\n<li>\u00e7far\u00eb niveli mbrojtjeje d\u00ebshironi t\u00eb aplikoni p\u00ebr secil\u00ebn nga k\u00ebto zona <\/li>\n<li>a do t\u00eb lejohet trafiku intra-zone me default <\/li>\n<li>n\u00ebse jo, \u00e7far\u00eb politikash t\u00eb filtrimit t\u00eb trafikut do t\u00eb aplikohen brenda secil\u00ebs zon\u00eb<\/li>\n<li>\u00e7far\u00eb politikash t\u00eb filtrimit t\u00eb trafikut do t\u00eb aplikohen p\u00ebr secil\u00ebn \u00e7ift zonash (source\/destination)<\/li>\n<\/ul>\n<p><\/p>\n<h3>TCAM<\/h3>\n<p>\nProblemi i insuficientit TCAM (Ternary Content Addressable Memory) \u00ebsht\u00eb shpesh i pranish\u00ebm, si p\u00ebr rrug\u00ebzimin ashtu edhe p\u00ebr akseset. IMHO, ky \u00ebsht\u00eb nj\u00eb nga pyetjet m\u00eb t\u00eb r\u00ebnd\u00ebsishme kur zgjidhni pajisje, prandaj duhet t'i kushtoni k\u00ebtij problemi nj\u00eb nivel adekuat kujdesi.<\/p>\n<blockquote><p>Shembulli 1. Forwarding Table TCAM.<\/p>\n<p>Le t\u00eb shqyrtojm\u00eb <noindex>Palo Alto 7k<\/noindex> firewall.<br \/>\nV\u00ebrejm\u00eb se madh\u00ebsia e IPv4 forwarding table* = 32K<br \/>\nN\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb, ky num\u00ebr rrug\u00ebsh \u00ebsht\u00eb gjithsej p\u00ebr t\u00eb gjitha VSYS-t\u00eb.<\/p>\n<p>Le t\u00eb supozojm\u00eb q\u00eb, n\u00eb p\u00ebrputhje me dizajnin tuaj, keni vendosur t\u00eb p\u00ebrdorni 4 VSYS.<br \/>\n\u00c7do nj\u00ebri nga k\u00ebto VSYS \u00ebsht\u00eb i lidhur me dy PE MPLS n\u00eb cloud, t\u00eb cilin e p\u00ebrdorni si BB. K\u00ebshtu, 4 VSYS shk\u00ebmbejn\u00eb t\u00eb gjitha rrug\u00ebt specifike me nj\u00ebra-tjetr\u00ebn dhe kan\u00eb nj\u00eb tabel\u00eb forwarding me grupe af\u00ebrsisht t\u00eb nj\u00ebjt\u00eb rrug\u00ebsh (por me NH t\u00eb ndryshme). Pasi secili VSYS ka 2 seanca BGP (me konfigurime t\u00eb nj\u00ebjta), \u00e7do rrug\u00eb e marr\u00eb p\u00ebrmes MPLS ka 2 NH dhe, p\u00ebr rrjedhoj\u00eb, 2 FIB t\u00eb regjistruara n\u00eb Tabel\u00ebn e Forwarding. N\u00ebse supozojm\u00eb se ky \u00ebsht\u00eb firewall-i i vet\u00ebm n\u00eb qendr\u00ebn e t\u00eb dh\u00ebnave dhe ai duhet t\u00eb dij\u00eb p\u00ebr t\u00eb gjitha rrug\u00ebt, kjo do t\u00eb thot\u00eb se numri total i rrug\u00ebve n\u00eb qendr\u00ebn ton\u00eb t\u00eb t\u00eb dh\u00ebnave nuk mund t\u00eb jet\u00eb m\u00eb shum\u00eb se 32K\/(4 * 2) = 4K. <\/p>\n<p>Tani, n\u00ebse supozojm\u00eb se kemi 2 qendra t\u00eb t\u00eb dh\u00ebnash (me dizajn t\u00eb nj\u00ebjt\u00eb), dhe duam t\u00eb p\u00ebrdorim VLAN-\u00eb \"t\u00eb shtrira\" midis qendrave t\u00eb t\u00eb dh\u00ebnave (p\u00ebr shembull, p\u00ebr vMotion), at\u00ebher\u00eb p\u00ebr t\u00eb zgjidhur problemin e routing-ut, duhet t\u00eb p\u00ebrdorim rrug\u00ebt e hosteve. Por kjo do t\u00eb thot\u00eb se n\u00eb 2 qendra t\u00eb t\u00eb dh\u00ebnash do t\u00eb kemi m\u00eb pak se 4096 hoste t\u00eb mundsh\u00ebm dhe, sigurisht, kjo mund t\u00eb jet\u00eb e pamjaftueshme.<\/p><\/blockquote>\n<blockquote><p>Shembulli 2. ACL TCAM.<\/p>\n<p>N\u00ebse planifikoni t\u00eb filtroni trafikun n\u00eb switch-e L3 (ose zgjidhje t\u00eb tjera q\u00eb p\u00ebrdorin switch-e L3, p\u00ebr shembull, Cisco ACI), at\u00ebher\u00eb, kur t\u00eb zgjidhni pajisjet, duhet t\u00eb kushtoni v\u00ebmendje n\u00eb ACL TCAM.<\/p>\n<p>Supozoni se d\u00ebshironi t\u00eb kontrolloni aksesin n\u00eb nd\u00ebrfaqet SVI t\u00eb Cisco Catalyst 4500. Pastaj, si\u00e7 shihet nga <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/support\/docs\/switches\/catalyst-4000-series-switches\/66978-tcam-cat-4500.html\">ky artikull<\/a><\/noindex>, p\u00ebr t\u00eb kontrolluar trafikun e dal\u00ebs (po ashtu si edhe at\u00eb t\u00eb ardh\u00ebs) n\u00eb nd\u00ebrfaqet, mund t\u00eb p\u00ebrdorni vet\u00ebm 4096 rreshta TCAM. \u00c7ka me p\u00ebrdorimin e TCAM3 do t'ju jap\u00eb rreth 4000 ACE (rreshta ACL).<\/p><\/blockquote>\n<p> N\u00eb rast se hasni nj\u00eb problem me TCAM t\u00eb pamjaftuesh\u00ebm, at\u00ebher\u00eb, s\u00eb pari, sigurisht, duhet t\u00eb shqyrtoni mund\u00ebsin\u00eb e optimizimit. Pra, n\u00eb rast t\u00eb nj\u00eb problemi me madh\u00ebsin\u00eb e Tabel\u00ebs s\u00eb Forwarding, duhet t\u00eb shqyrtoni mund\u00ebsin\u00eb e agregimit t\u00eb rrug\u00ebve. N\u00eb rast t\u00eb nj\u00eb problemi me madh\u00ebsin\u00eb e TCAM p\u00ebr akseset \u2014 auditimi i aksesit, fshirja e regjistrimeve t\u00eb vjetra dhe nd\u00ebrprera, si dhe, ndoshta, shqyrtimi i procedur\u00ebs s\u00eb hapjes s\u00eb aksesit (do t\u00eb shqyrtohet n\u00eb detaje n\u00eb kapitullin e dedikuar auditimit t\u00eb aksesit).<\/p>\n<h3>Disponueshm\u00ebri e Lart\u00eb<\/h3>\n<p>\n\u00c7\u00ebshtja \u00ebsht\u00eb n\u00ebse t\u00eb p\u00ebrdorni HA p\u00ebr firewall-et ose t\u00eb vendosni \"paralel\" dy kuti t\u00eb pavarura dhe n\u00eb rast se nj\u00ebra d\u00ebshtan, t\u00eb ruteroni trafikun p\u00ebrmes tjetr\u00ebs?<\/p>\n<p>P\u00ebr aq sa duket, p\u00ebrgjigjja \u00ebsht\u00eb e qart\u00eb \u2013 t\u00eb p\u00ebrdorim HA. Arsyeja pse ky pyetje vazhdon t\u00eb ngrihet \u00ebsht\u00eb se, fatkeq\u00ebsisht, teorikisht dhe reklamuesh\u00ebm, 99 dhe disa n\u00ebnt\u00ebra pas presjes s\u00eb pik\u00ebs s\u00eb disponueshm\u00ebris\u00eb n\u00eb praktik\u00eb duken shum\u00eb m\u00eb pak premtuese. HA \u00ebsht\u00eb nj\u00eb gj\u00eb logjikisht mjaft e mir\u00eb, dhe n\u00eb pajisje t\u00eb ndryshme, dhe me ofrues t\u00eb ndrysh\u00ebm (pa p\u00ebrjashtime), kemi zbuluar probleme dhe ndalesa t\u00eb sh\u00ebrbimeve.<\/p>\n<p>N\u00eb rastin e p\u00ebrdorimit t\u00eb HA, do t\u00eb keni mund\u00ebsin\u00eb t\u00eb fikni node t\u00eb ve\u00e7anta, t\u00eb kaloni midis tyre pa ndaluar sh\u00ebrbimin, gj\u00eb q\u00eb \u00ebsht\u00eb e r\u00ebnd\u00ebsishme, p\u00ebr shembull, gjat\u00eb p\u00ebrmir\u00ebsimeve, por gjithashtu keni nj\u00eb probabilitet t\u00eb konsideruesh\u00ebm q\u00eb t\u00eb dy node-t tuaj t\u00eb prishen n\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb, si dhe se p\u00ebrmir\u00ebsimi i ardhsh\u00ebm nuk do t\u00eb kaloj\u00eb aq mir\u00eb sa premton ofruesi (kjo mund t\u00eb shmanget, n\u00ebse keni mund\u00ebsin\u00eb t\u00eb testoni p\u00ebrmir\u00ebsimin n\u00eb pajisje laboratorike).<\/p>\n<p>N\u00ebse nuk p\u00ebrdorni HA, at\u00ebher\u00eb nga k\u00ebndv\u00ebshtrimi i d\u00ebshtimit t\u00eb dyfisht\u00eb, rreziqet tuaja jan\u00eb ndjesh\u00ebm m\u00eb t\u00eb ulta (p\u00ebr shkak se keni 2 firewall t\u00eb pavarur), por pasi sesionet nuk jan\u00eb t\u00eb sinkronizuara, \u00e7do her\u00eb q\u00eb ndodhi kalimi midis k\u00ebtyre firewall-ave do t\u00eb humbni trafik. Natyrisht, mund t\u00eb p\u00ebrdorni firewall t\u00eb paq\u00ebndruesh\u00ebm, por pastaj kuptimi i p\u00ebrdorimit t\u00eb firewall-it n\u00eb shumic\u00ebn e rasteve humbet.<\/p>\n<p>Prandaj, n\u00ebse si rezultat i auditimit keni zbuluar firewall t\u00eb vetmuar, dhe po mendoni p\u00ebr rritjen e besueshm\u00ebris\u00eb s\u00eb rrjetit tuaj, at\u00ebher\u00eb HA, sigurisht, \u00ebsht\u00eb nj\u00eb nga zgjidhjet e rekomanduara, por duhet t\u00eb merrni parasysh dhe disavantazhet q\u00eb lidhen me k\u00ebt\u00eb qasje dhe, ndoshta, p\u00ebr rrjetin tuaj nj\u00eb zgjidhje tjet\u00ebr do t\u00eb ishte m\u00eb e p\u00ebrshtatshme.<\/p>\n<h3>Leht\u00ebsia n\u00eb menaxhim<\/h3>\n<p>\nN\u00eb principe, HA \u00ebsht\u00eb gjithashtu p\u00ebr menaxhueshm\u00ebrin\u00eb. N\u00eb vend q\u00eb t\u00eb konfiguroni 2 kutia ve\u00e7 e ve\u00e7 dhe t\u00eb zgjidhni problemin e sinkronizimit t\u00eb konfigurimeve, ju i menaxhoni ato n\u00eb nj\u00eb far\u00eb m\u00ebnyre si\u00e7 kishit nj\u00eb pajisje. <\/p>\n<p>Por, ndoshta, keni shum\u00eb qendra t\u00eb t\u00eb dh\u00ebnave dhe shum\u00eb firewall, at\u00ebher\u00eb ky \u00e7\u00ebshtje dolin n\u00eb nj\u00eb nivel t\u00eb ri. Dhe problemi nuk \u00ebsht\u00eb vet\u00ebm p\u00ebr konfigurimin, por gjithashtu p\u00ebr<\/p>\n<ul>\n<li>backup-in e konfigurimeve<\/li>\n<li>p\u00ebrdit\u00ebsimet<\/li>\n<li>p\u00ebrmir\u00ebsimet<\/li>\n<li>monitorimin<\/li>\n<li>logimin<\/li>\n<\/ul>\n<p>\nDhe t\u00eb gjitha k\u00ebto mund t\u00eb zgjidhen nga sisteme t\u00eb menaxhimit t\u00eb centralizuar. <\/p>\n<blockquote><p>P\u00ebr shembull, n\u00ebse p\u00ebrdorni firewall-\u00eb Palo Alto, at\u00ebher\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/www.paloaltonetworks.com\/products\/management\/panorama\">Panorama<\/a><\/noindex> \u00ebsht\u00eb nj\u00eb zgjidhje e till\u00eb.\n<\/p><\/blockquote>\n<p>\n<i>Vazhdon...<\/i><br \/>\n<br \/>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0440\u0435\u0442\u044c\u0435\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb. \u0421\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u0441\u0442\u0430\u0442\u0435\u0439 \u0446\u0438\u043a\u043b\u0430 \u0438 \u0441\u0441\u044b\u043b\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0437\u0434\u0435\u0441\u044c. \u041d\u0435\u0442 \u0441\u043c\u044b\u0441\u043b\u0430 \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u044c \u043e \u043f\u043e\u043b\u043d\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 security \u0440\u0438\u0441\u043a\u043e\u0432. \u041c\u044b \u0432 \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0435 \u043d\u0435 \u043c\u043e\u0436\u0435\u043c \u0441\u043d\u0438\u0437\u0438\u0442\u044c \u0438\u0445 \u0434\u043e \u043d\u0443\u043b\u044f. \u0422\u0430\u043a\u0436\u0435 \u043d\u0443\u0436\u043d\u043e \u043f\u043e\u043d\u0438\u043c\u0430\u0442\u044c, \u0447\u0442\u043e \u043f\u0440\u0438 \u0441\u0442\u0440\u0435\u043c\u043b\u0435\u043d\u0438\u0438 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0441\u0435\u0442\u044c \u0431\u043e\u043b\u0435\u0435 \u0438 \u0431\u043e\u043b\u0435\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043d\u0430\u0448\u0438 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0441\u0442\u0430\u043d\u043e\u0432\u044f\u0442\u0441\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23033,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31058","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0440\u0435\u0442\u044c\u0435\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c. \u0413\u043b\u0430\u0432\u0430 \u0442\u0440\u0435\u0442\u044c\u044f. \u0421\u0435\u0442\u0435\u0432\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c. \u0427\u0430\u0441\u0442\u044c \u043f\u0435\u0440\u0432\u0430\u044f | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0440\u0435\u0442\u044c\u0435\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:39:12+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:39:12+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Si ta merrni infrastruktur\u00ebn rrjet\u00ebsore n\u00ebn kontroll. Kapo e tret\u00eb. Siguria e rrjetit. Pjesa e par\u00eb | ProHoster","description":"Kyky artikulli \u00ebsht\u00eb e treta n\u00eb nj\u00eb cik\u00ebl artikujsh 'Si ta merrni infrastruktur\u00ebn rrjet\u00ebsore n\u00ebn kontroll'.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c. \u0413\u043b\u0430\u0432\u0430 \u0442\u0440\u0435\u0442\u044c\u044f. \u0421\u0435\u0442\u0435\u0432\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c. \u0427\u0430\u0441\u0442\u044c \u043f\u0435\u0440\u0432\u0430\u044f | ProHoster","og:description":"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0440\u0435\u0442\u044c\u0435\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:39:12+00:00","article:modified_time":"2019-10-31T18:39:12+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31058","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 04:20:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:24:14","updated":"2026-01-21 04:20:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/31058","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=31058"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/31058\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/23033"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=31058"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=31058"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=31058"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}