{"id":31395,"date":"2019-10-31T21:41:01","date_gmt":"2019-10-31T18:41:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-tretya\/"},"modified":"2019-10-31T21:41:01","modified_gmt":"2019-10-31T18:41:01","slug":"kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-tretya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-tretya","title":{"rendered":"Si t\u00eb merrni n\u00ebn kontroll infrastruktur\u00ebn e rrjetit tuaj. K kapitulli i tret\u00eb. Siguria e rrjetit. Pjesa e tret\u00eb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><i>Ky\u00e7 i k\u00ebtij artikulli \u00ebsht\u00eb t\u00eb  p\u00ebrcaktoj\u00eb se si t\u00eb keni kontroll mbi infrastruktur\u00ebn e rrjetit tuaj. T\u00eb gjitha artikujt e k\u00ebtij cikli dhe lidhjet mund t\u00eb gjenden <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/447008\/\">k\u00ebtu<\/a><\/noindex><\/i>.<\/p>\n<p>Kjo pjes\u00eb do t\u00eb p\u00ebrqendrohet n\u00eb segmentet e Campus (Zyra) &amp; Q \uc811\uadfc VPN. <\/p>\n<p><img decoding=\"async\" alt=\"Si t\u00eb merrni n\u00ebn kontroll infrastruktur\u00ebn e rrjetit tuaj. K kapitulli i tret\u00eb. Siguria e rrjetit. Pjesa e tret\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/c20ea5e670105b5bf9b655a97b82f62f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMund t\u00eb duket se dizajni i rrjetit t\u00eb zyr\u00ebs \u00ebsht\u00eb i thjesht\u00eb. <\/p>\n<p>Sigurisht, marrim switch-e L2\/L3, i lidhim ata me nj\u00ebri-tjetrin. M\u00eb pas, realizojm\u00eb konfigurimin e duke filluar vilan\u00ebve, portavendosjen e der\u00ebs dhe ngrem\u00eb nj\u00eb routing t\u00eb thjesht\u00eb, lidhemi me kontrolluesit WiFi, pik\u00eb-qasjet, instalojm\u00eb dhe konfigurojm\u00eb ASA p\u00ebr qasje t\u00eb larg\u00ebt, duke u g\u00ebzuar q\u00eb gjith\u00e7ka funksionon. N\u00eb parim, si\u00e7 kam p\u00ebrmendur n\u00eb nj\u00eb nga artikujt e m\u00ebparsh\u00ebm <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/434750\/\">artikujsh<\/a><\/noindex> t\u00eb k\u00ebtij cikli, t\u00eb dizenjohet dhe konfigurohet rrjeti i zyr\u00ebs p\u00ebr t\u00eb funksionuar 'n\u00eb nj\u00eb m\u00ebnyr\u00eb', mund t\u00eb jet\u00eb e leht\u00eb p\u00ebr \u00e7do student q\u00eb ka ndjekur (dhe kapur) dy semestra t\u00eb kursit p\u00ebr telekomunikacionin.<\/p>\n<p>Por sa m\u00eb shum\u00eb t\u00eb m\u00ebsoni, aq m\u00eb pak e thjesht\u00eb duket kjo detyr\u00eb. Personal p\u00ebr mua, kjo tem\u00eb, dizajni i rrjetit t\u00eb zyr\u00ebs, nuk duket e thjesht\u00eb dhe n\u00eb k\u00ebt\u00eb artikull do t\u00eb p\u00ebrpiqem t\u00eb shpjegoj pse.<\/p>\n<p>N\u00eb p\u00ebrmbledhje, duhet t\u00eb merret parasysh nj\u00eb num\u00ebr t\u00eb madh faktor\u00ebsh. Shpesh k\u00ebta faktor\u00eb jan\u00eb n\u00eb kontradikt\u00eb me nj\u00ebri-tjetrin dhe duhet t\u00eb gjendet nj\u00eb kompromis i arsyesh\u00ebm. <br \/>\nKjo paqart\u00ebsi \u00ebsht\u00eb v\u00ebshtir\u00ebsia kryesore. Pra, duke folur p\u00ebr sigurin\u00eb, kemi nj\u00eb trek\u00ebnd\u00ebsh me tre kru\u00e7eta: siguria, leht\u00ebsia p\u00ebr p\u00ebrdoruesit dhe \u00e7mimi i zgjidhjes. <br \/>\nDhe \u00e7do her\u00eb duhet t\u00eb gjejm\u00eb nj\u00eb kompromis midis k\u00ebtyre tre.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Arkitektura<\/h2>\n<p>\nSi nj\u00eb shembull t\u00eb arkitektur\u00ebs p\u00ebr k\u00ebto dy segmente, si n\u00eb artikujt e m\u00ebparsh\u00ebm, rekomandoj <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/solutions\/Enterprise\/Security\/SAFE_RG\/SAFE_rg\/chap1.html\">Cisco SAFE<\/a><\/noindex> modelin: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/solutions\/Enterprise\/Security\/SAFE_RG\/SAFE_rg\/chap5.html#wpxref51616\">Enterprise Campus<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/solutions\/Enterprise\/Security\/SAFE_RG\/SAFE_rg\/chap6.html#wpxref74611\">Enterprise Internet Edge<\/a><\/noindex>.<\/p>\n<p>K\u00ebto jan\u00eb disa dokumente t\u00eb vjetra. Po i citoj k\u00ebtu pasi skemat dhe qasja nuk kan\u00eb ndryshuar, por p\u00ebrshkrimi m\u00eb p\u00eblqen m\u00eb shum\u00eb se n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/solutions\/enterprise\/design-zone-security\/landing_safe.html#~tab-architecture\">dokumentacionin e ri.<\/a><\/noindex>.<\/p>\n<p>Pa e shtyr\u00eb n\u00eb p\u00ebrdorimin e zgjidhjeve Cisco, megjithat\u00eb mendoj se \u00ebsht\u00eb e dobishme t\u00eb studiohet me kujdes ky dizajn. <\/p>\n<p>Ky artikull, si zakonisht, n\u00eb asnj\u00eb m\u00ebnyr\u00eb nuk pretendon p\u00ebr p\u00ebrmbajtje t\u00eb plot\u00eb, \u00ebsht\u00eb m\u00eb shum\u00eb nj\u00eb shtes\u00eb p\u00ebr k\u00ebt\u00eb informacion. <\/p>\n<p>N\u00eb fund t\u00eb artikullit, ne do t\u00eb analizojm\u00eb dizajnin Cisco SAFE p\u00ebr zyr\u00ebn n\u00eb lidhje me konceptet e paraqitura k\u00ebtu.<\/p>\n<h2>Parimet e p\u00ebrgjithshme<\/h2>\n<p>\nDizajni i rrjetit t\u00eb zyr\u00ebs, sigurisht, duhet t\u00eb p\u00ebrmbush\u00eb k\u00ebrkesat e p\u00ebrgjithshme q\u00eb jan\u00eb diskutuar <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/434750\/\">k\u00ebtu<\/a><\/noindex> n\u00eb kapitullin 'Kriteret e vler\u00ebsimit t\u00eb cil\u00ebsis\u00eb s\u00eb dizajnit'. P\u00ebrve\u00e7 \u00e7mimit dhe siguris\u00eb, q\u00eb do t\u00eb diskutojm\u00eb n\u00eb k\u00ebt\u00eb artikull, ka edhe tre kritere t\u00eb tjera q\u00eb duhet t\u00eb merret parasysh gjat\u00eb projektimit (ose ndryshimeve):<\/p>\n<ul>\n<li>shkall\u00ebzimi (scalability)<\/li>\n<li>menaxhueshm\u00ebria (managability)<\/li>\n<li>disponueshm\u00ebria (availability)<\/li>\n<\/ul>\n<p>\nShum\u00eb nga ato q\u00eb jan\u00eb diskutuar p\u00ebr <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">t\u00eb data-qendrave<\/a><\/noindex> jan\u00eb gjithashtu t\u00eb aplicueshme p\u00ebr zyrat. <\/p>\n<p>Por, segmenti i zyr\u00ebs ka specifik\u00ebn e tij q\u00eb nga perspektiva e siguris\u00eb \u00ebsht\u00eb kritike. Thelbi i k\u00ebsaj specifike \u00ebsht\u00eb se ky segment krijohet p\u00ebr t\u00eb ofruar sh\u00ebrbime rrjeti p\u00ebr punonj\u00ebsit (po ashtu edhe p\u00ebr partner\u00ebt dhe t\u00eb ftuarit) e kompanis\u00eb, dhe, si pasoj\u00eb, n\u00eb nivelin m\u00eb t\u00eb lart\u00eb t\u00eb shqyrtimit t\u00eb problemit ne kemi dy detyra:<\/p>\n<ul>\n<li>t\u00eb mbrojm\u00eb burimet e kompanis\u00eb nga veprimet e d\u00ebmshme q\u00eb mund t\u00eb vijn\u00eb nga punonj\u00ebsit (t\u00eb ftuarit, partner\u00ebt) dhe nga softueri q\u00eb ata p\u00ebrdorin. Kjo gjithashtu p\u00ebrfshin mbrojtjen nga lidhjet e paautorizuara n\u00eb rrjet. <\/li>\n<li>t\u00eb mbrojm\u00eb sistemet dhe t\u00eb dh\u00ebnat e vet\u00eb p\u00ebrdoruesve.<\/li>\n<\/ul>\n<p>\nDhe kjo \u00ebsht\u00eb vet\u00ebm nj\u00ebra an\u00eb e problemit (n\u00eb m\u00ebnyr\u00eb m\u00eb t\u00eb sakt\u00eb nj\u00ebra maja e trek\u00ebnd\u00ebshit). Nga ana tjet\u00ebr \u2014 leht\u00ebsia e p\u00ebrdoruesit dhe \u00e7mimi i zgjidhjeve t\u00eb aplikuara.<\/p>\n<p>Le t\u00eb fillojm\u00eb duke shqyrtuar se \u00e7far\u00eb pret p\u00ebrdoruesi nga nj\u00eb rrjet modern t\u00eb zyr\u00ebs. <\/p>\n<h2>Komoditeti<\/h2>\n<p>\nK\u00ebtu jan\u00eb si\u00e7 mendoj duket 'leht\u00ebsit\u00eb e rrjetit' p\u00ebr p\u00ebrdoruesin e zyr\u00ebs:<\/p>\n<ul>\n<li>Mobiliteti<\/li>\n<li>Mund\u00ebsia p\u00ebr t\u00eb p\u00ebrdorur t\u00eb gjith\u00eb gam\u00ebn e pajisjeve t\u00eb njohura dhe sistemeve operative<\/li>\n<li>Qasje e leht\u00eb n\u00eb t\u00eb gjitha burimet e nevojshme t\u00eb kompanis\u00eb <\/li>\n<li>Disponueshm\u00ebria e burimeve n\u00eb internet, p\u00ebrfshir\u00eb sh\u00ebrbimet e ndryshme n\u00eb cloud<\/li>\n<li>\u2018Puna e shpejt\u00eb\u2019 e rrjetit<\/li>\n<\/ul>\n<p>\nT\u00eb gjitha k\u00ebto zgjidhje lidhen si me punonj\u00ebsit ashtu edhe me t\u00eb ftuarit (ose partner\u00ebt), dhe kjo tashm\u00eb \u00ebsht\u00eb nj\u00eb detyr\u00eb p\u00ebr inxhinier\u00ebt e kompanis\u00eb p\u00ebr t\u00eb ndar\u00eb aksesin n\u00eb baz\u00eb t\u00eb autorizimit p\u00ebr grupe t\u00eb ndryshme p\u00ebrdoruesish.<\/p>\n<p>Le t\u00eb shqyrtojm\u00eb m\u00eb me holl\u00ebsi \u00e7do nj\u00eb nga k\u00ebto aspekte.<\/p>\n<h3>Mobiliteti<\/h3>\n<p>\nB\u00ebhet fjal\u00eb p\u00ebr mund\u00ebsin\u00eb p\u00ebr t\u00eb punuar dhe p\u00ebrdorur t\u00eb gjitha burimet e nevojshme t\u00eb kompanis\u00eb nga \u00e7do pik\u00eb n\u00eb bot\u00eb (sigurisht, ku \u00ebsht\u00eb e disponueshme interneti).<\/p>\n<p>Kjo vlen gjithashtu p\u00ebr zyr\u00ebn. \u00cbsht\u00eb e p\u00ebrshtatshme q\u00eb nga \u00e7do pik\u00eb e zyr\u00ebs t\u00eb keni mund\u00ebsin\u00eb t\u00eb vazhdoni t\u00eb punoni, p\u00ebr shembull, t\u00eb merrni email, t\u00eb komunikoni n\u00eb mesazhet korporative, t\u00eb jeni t\u00eb qassh\u00ebm p\u00ebr thirrje video, \u2026 K\u00ebshtu, kjo ju lejon, nga nj\u00ebra an\u00eb, t\u00eb zgjidhni disa \u00e7\u00ebshtje p\u00ebrmes komunikimit \"n\u00eb gjall\u00eb\" (p\u00ebr shembull, t\u00eb merrni pjes\u00eb n\u00eb takime), dhe nga ana tjet\u00ebr, t\u00eb jeni gjithmon\u00eb online, t\u00eb mbani dor\u00ebn mbi pulsin dhe t\u00eb zgjidhni shpejt disa detyra urgjente me prioritet t\u00eb lart\u00eb. Kjo \u00ebsht\u00eb shum\u00eb e p\u00ebrshtatshme dhe, n\u00eb t\u00eb v\u00ebrtet\u00eb, p\u00ebrmir\u00ebson cil\u00ebsin\u00eb e komunikimeve.<\/p>\n<p>Kjo arrihet p\u00ebrmes dizajnit t\u00eb duhur t\u00eb rrjetit WiFi.<\/p>\n<blockquote><p><b>V\u00ebrejtje<\/b><\/p>\n<p>K\u00ebtu zakonisht lind pyetja, a \u00ebsht\u00eb e mjaftueshme t\u00eb p\u00ebrdorim vet\u00ebm WiFi? A do t\u00eb thot\u00eb kjo se mund t\u00eb heqim dor\u00eb nga p\u00ebrdorimi i porteve Ethernet n\u00eb zyr\u00eb? N\u00ebse flasim vet\u00ebm p\u00ebr p\u00ebrdoruesit dhe jo p\u00ebr serverat, t\u00eb cil\u00ebt, megjithat\u00eb, \u00ebsht\u00eb e arsyeshme t'i lidhni p\u00ebrmes nj\u00eb porte Ethernet, p\u00ebrgjith\u00ebsisht, p\u00ebrgjigja \u00ebsht\u00eb: po, mund t\u00eb kufizoheni vet\u00ebm me WiFi. Por ka nuanca.<\/p>\n<p>Ka grupe t\u00eb r\u00ebnd\u00ebsishme p\u00ebrdoruesish, p\u00ebr t\u00eb cil\u00ebt ka nevoj\u00eb p\u00ebr nj\u00eb qasje t\u00eb ve\u00e7ant\u00eb. K\u00ebta, p\u00ebrve\u00e7 tjerash, jan\u00eb administrator\u00ebt. N\u00eb parim, lidhja WiFi \u00ebsht\u00eb m\u00eb pak e besueshme (n\u00eb aspektin e humbjes s\u00eb trafikut) dhe m\u00eb pak e shpejt\u00eb se porta Ethernet e zakonshme. Kjo mund t\u00eb jet\u00eb e r\u00ebnd\u00ebsishme p\u00ebr administrator\u00ebt. P\u00ebr m\u00eb tep\u00ebr, administrator\u00ebt e rrjetit, p\u00ebr shembull, ndonj\u00ebher\u00eb kan\u00eb nj\u00eb rrjet Ethernet t\u00eb dedikuar p\u00ebr lidhje jasht\u00eb band\u00ebs.<\/p>\n<p>Ndoshta, n\u00eb kompanin\u00eb tuaj do t\u00eb ket\u00eb edhe grupe t\u00eb tjera\/departamente p\u00ebr t\u00eb cilat k\u00ebta faktor\u00eb jan\u00eb gjithashtu t\u00eb r\u00ebnd\u00ebsish\u00ebm.<\/p>\n<p>Ka edhe nj\u00eb moment tjet\u00ebr t\u00eb r\u00ebnd\u00ebsish\u00ebm \u2013 telefoni. Ndoshta, p\u00ebr ndonj\u00eb arsye nuk doni t\u00eb p\u00ebrdorni Wireless VoIP dhe d\u00ebshironi t\u00eb p\u00ebrdorni telefonat IP me lidhje t\u00eb zakonshme Ethernet. <\/p>\n<p>Zakonisht, n\u00eb kompanit\u00eb ku kam punuar, ka pasur mund\u00ebsi p\u00ebr lidhje WiFi dhe n\u00ebp\u00ebrmjet port\u00ebs Ethernet.<\/p><\/blockquote>\n<p>\nD\u00ebshiroja q\u00eb l\u00ebvizshm\u00ebria t\u00eb mos p\u00ebrfundonte vet\u00ebm me zyr\u00ebn.<\/p>\n<p>P\u00ebr t\u00eb mund\u00ebsuar pun\u00ebn nga sht\u00ebpia (ose nga \u00e7do vend tjet\u00ebr me internet t\u00eb aksesuesh\u00ebm) p\u00ebrdoret lidhja VPN. N\u00eb k\u00ebt\u00eb rast, \u00ebsht\u00eb e k\u00ebshillueshme q\u00eb punonj\u00ebsit t\u00eb mos ndiejn\u00eb ndonj\u00eb ndryshim midis pun\u00ebs nga sht\u00ebpia dhe pun\u00ebs n\u00eb distanc\u00eb, \u00e7ka n\u00ebnkupton pranin\u00eb e t\u00eb nj\u00ebjtave qasje. Si ta organizojm\u00eb k\u00ebt\u00eb do ta diskutojm\u00eb pak m\u00eb von\u00eb n\u00eb kapitullin \"Sistemi i centralizuar i autentifikimit dhe autorizimit.\"<\/p>\n<blockquote><p><b>V\u00ebrejtje<\/b><\/p>\n<p>Me siguri, nuk do t\u00eb jeni n\u00eb gjendje t\u00eb ofroni t\u00eb nj\u00ebjt\u00ebn cil\u00ebsi sh\u00ebrbimesh p\u00ebr pun\u00ebn n\u00eb distanc\u00eb si\u00e7 keni n\u00eb zyr\u00eb. Le t\u00eb supozojm\u00eb q\u00eb si nj\u00eb VPN gateway p\u00ebrdorni Cisco ASA 5520. Sipas <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/products\/security\/asa-5500-series-next-generation-firewalls\/data_sheet_c78-345385.html\">flet\u00ebs s\u00eb t\u00eb dh\u00ebnave<\/a><\/noindex> kjo pajisje mund t\u00eb \"p\u00ebrballoj\u00eb\" vet\u00ebm 225 Mbps trafik VPN. Do t\u00eb thot\u00eb, padyshim, p\u00ebrsa i p\u00ebrket kapacitetit, lidhja p\u00ebrmes VPN \u00ebsht\u00eb ndjesh\u00ebm e ndryshme nga puna n\u00eb zyr\u00eb. Gjithashtu, n\u00ebse p\u00ebr ndonj\u00eb arsye, vonesa, humbjet, jitteri (p\u00ebr shembull, n\u00ebse doni t\u00eb p\u00ebrdorni telefonin\u00eb IP t\u00eb zyr\u00ebs) p\u00ebr sh\u00ebrbimet tuaja rrjetore jan\u00eb t\u00eb r\u00ebnd\u00ebsishme, po ashtu nuk do t\u00eb merrni t\u00eb nj\u00ebjt\u00ebn cil\u00ebsi, si\u00e7 do t\u00eb kishte ndodhur n\u00eb zyr\u00eb. Prandaj, kur flasim p\u00ebr l\u00ebvizshm\u00ebrin\u00eb, duhet t\u00eb mbajm\u00eb parasysh kufizimet e mundshme.<\/p><\/blockquote>\n<p><\/p>\n<h3>Qasje e leht\u00eb n\u00eb t\u00eb gjitha burimet e kompanis\u00eb<\/h3>\n<p>\nKjo detyr\u00eb duhet t\u00eb zgjidhet n\u00eb m\u00ebnyr\u00eb bashk\u00ebpunuese me departamentet e tjera teknike.<br \/>\nSituata ideale \u00ebsht\u00eb kur p\u00ebrdoruesi duhet t\u00eb autentikohet vet\u00ebm nj\u00eb her\u00eb, dhe pas k\u00ebsaj merr qasjet n\u00eb t\u00eb gjitha burimet e nevojshme.<br \/>\nOfrimi i qasjes s\u00eb leht\u00eb pa prekur sigurin\u00eb mund t\u00eb rris\u00eb ndjesh\u00ebm efikasitetin e pun\u00ebs dhe t\u00eb ul\u00eb nivelin e stresit t\u00eb koleg\u00ebve tuaj.<\/p>\n<blockquote><p><b>Kujtes\u00eb 1<\/b><\/p>\n<p>Komoditeti i aksesit nuk \u00ebsht\u00eb vet\u00ebm p\u00ebr aq her\u00eb sa ju duhet t\u00eb futni fjal\u00ebkalimin. N\u00ebse, p\u00ebr shembull, sipas politik\u00ebs tuaj t\u00eb siguris\u00eb, p\u00ebr t'u lidhur nga zyra n\u00eb qendr\u00ebn e t\u00eb dh\u00ebnave duhet s\u00eb pari t\u00eb lidheni me VPN gateway, dhe n\u00eb k\u00ebt\u00eb rast humbni aksesin n\u00eb burimet e zyr\u00ebs, at\u00ebher\u00eb kjo \u00ebsht\u00eb gjithashtu shum\u00eb dhe shum\u00eb e pak\u00ebndshme.\n<\/p><\/blockquote>\n<blockquote><p><b>Kujtes\u00eb 2<\/b><\/p>\n<p>Ka sh\u00ebrbime (p\u00ebr shembull, qasje n\u00eb pajisjet rrjetore), ku zakonisht kemi servera t\u00eb dedikuar AAA dhe \u00ebsht\u00eb normale q\u00eb n\u00eb k\u00ebt\u00eb rast t\u00eb duhet t\u00eb autentikoheni disa her\u00eb.\n<\/p><\/blockquote>\n<p><\/p>\n<h3>Disponueshm\u00ebria e burimeve t\u00eb internetit<\/h3>\n<p>\nInternet \u00ebsht\u00eb jo vet\u00ebm arg\u00ebtim, por gjithashtu nj\u00eb grup sh\u00ebrbimesh q\u00eb mund t\u00eb jen\u00eb shum\u00eb t\u00eb dobishme p\u00ebr pun\u00eb. Ka edhe faktor\u00eb t\u00eb past\u00ebr psikologjik\u00eb. Njeriu modern \u00ebsht\u00eb ngjitur me shum\u00eb lidhje virtuale me t\u00eb tjer\u00ebt p\u00ebrmes internetit, dhe, sipas mendimit tim, nuk ka asgj\u00eb t\u00eb keqe n\u00ebse ai vazhdon ta ndjej\u00eb k\u00ebt\u00eb lidhje edhe gjat\u00eb pun\u00ebs.<\/p>\n<p>Sa i p\u00ebrket humbjes s\u00eb koh\u00ebs, nuk ka asgj\u00eb t\u00eb keqe n\u00ebse nj\u00eb punonj\u00ebs, p\u00ebr shembull, ka hapur Skype dhe kalon 5 minuta n\u00eb bised\u00eb me nj\u00eb person t\u00eb af\u00ebrt n\u00eb rast se ka nevoj\u00eb.<\/p>\n<p>A dobi kjo, do t\u00eb thot\u00eb q\u00eb interneti gjithmon\u00eb duhet t\u00eb jet\u00eb i aksesuesh\u00ebm, do t\u00eb thot\u00eb q\u00eb punonj\u00ebsit mund t\u00eb ken\u00eb qasje n\u00eb t\u00eb gjitha burimet dhe t\u00eb mos kontrollohen n\u00eb asnj\u00eb m\u00ebnyr\u00eb?<\/p>\n<p>Jo, sigurisht q\u00eb nuk do t\u00eb thot\u00eb. Niveli i hapjes s\u00eb internetit mund t\u00eb jet\u00eb i ndrysh\u00ebm p\u00ebr kompani t\u00eb ndryshme \u2013 nga mbyllja e plot\u00eb deri n\u00eb hapjen e plot\u00eb. M\u00ebnyrat e kontrollit t\u00eb trafikut ne do t'i diskutojm\u00eb m\u00eb von\u00eb n\u00eb pjes\u00ebt q\u00eb i kushtohen mjeteve t\u00eb mbrojtjes. <\/p>\n<h3>Mund\u00ebsia p\u00ebr t\u00eb p\u00ebrdorur t\u00eb gjith\u00eb gam\u00ebn e pajisjeve t\u00eb njohura<\/h3>\n<p>\n\u00cbsht\u00eb e p\u00ebrshtatshme kur, p\u00ebr shembull, keni mund\u00ebsin\u00eb t\u00eb vazhdoni t\u00eb p\u00ebrdorni t\u00eb gjitha mjetet e komunikimit q\u00eb keni zakon t\u00eb p\u00ebrdorni edhe n\u00eb pun\u00eb. Nuk ka ndonj\u00eb v\u00ebshtir\u00ebsi teknike p\u00ebr ta realizuar k\u00ebt\u00eb. K\u00ebrkohet WiFi dhe nj\u00eb VLAN i mysafir\u00ebve.<\/p>\n<p>Gjithashtu \u00ebsht\u00eb mir\u00eb n\u00ebse ka mund\u00ebsi t\u00eb p\u00ebrdorni at\u00eb sistem operativ me t\u00eb cilin jeni m\u00ebsuar. Por, sipas v\u00ebzhgimeve t\u00eb mia, zakonisht kjo lejohet vet\u00ebm p\u00ebr menaxher\u00ebt, administrator\u00ebt dhe zhvilluesit. <\/p>\n<blockquote><p><b>Shembuj<\/b><\/p>\n<p>Mund t\u00eb shkoni, sigurisht, n\u00eb rrug\u00ebn e ndalimeve, t\u00eb ndaloni qasjen e larg\u00ebt, t\u00eb ndaloni lidhjet me pajisje mobile, t\u00eb kufizoni t\u00eb gjitha lidhjet statike Ethernet, t\u00eb kufizoni qasjen n\u00eb internet, t\u00eb k\u00ebrkoni me patjet\u00ebr q\u00eb t\u00eb konfiskoni telefonat mobil\u00eb dhe pajisjet n\u00eb port\u00ebn hyr\u00ebse... dhe disa organizata me k\u00ebrkesa t\u00eb larta p\u00ebr sigurin\u00eb ndjekin k\u00ebt\u00eb rrug\u00eb, dhe ndoshta n\u00eb disa raste kjo mund t\u00eb jet\u00eb e arsyeshme, por... bieni dakord se kjo duket si nj\u00eb p\u00ebrpjekje p\u00ebr t\u00eb ndaluar p\u00ebrparimin n\u00eb nj\u00eb organizat\u00eb t\u00eb ve\u00e7ant\u00eb. Sigurisht, do t\u00eb d\u00ebshironim t\u00eb kombinojm\u00eb mund\u00ebsit\u00eb q\u00eb teknologjit\u00eb moderne ofrojn\u00eb me nj\u00eb nivel t\u00eb mjaftuesh\u00ebm t\u00eb siguris\u00eb.<\/p><\/blockquote>\n<p><\/p>\n<h3>\u2018Puna e shpejt\u00eb\u2019 e rrjetit<\/h3>\n<p>\nShpejt\u00ebsia e transferimit t\u00eb t\u00eb dh\u00ebnave p\u00ebrb\u00ebhet teknikin\u00eb nga shum\u00eb faktor\u00eb. Dhe shpejt\u00ebsia e port\u00ebs suaj t\u00eb lidhjes zakonisht nuk \u00ebsht\u00eb m\u00eb e r\u00ebnd\u00ebsishmja prej tyre. Nuk \u00ebsht\u00eb gjithmon\u00eb q\u00eb puna e ngadalshme e aplikacioneve \u00ebsht\u00eb e lidhur me problemet e rrjetit, por tani na intereson vet\u00ebm pjesa rrjetore. Problemi m\u00eb i zakonsh\u00ebm i \"ngadal\u00ebsimit\" t\u00eb rrjetit lokal \u00ebsht\u00eb i lidhur me humbjen e paketave. Kjo zakonisht ndodh kur ka nj\u00eb efekt \"gryk\u00eb qoft\u00eb\" ose p\u00ebr probleme me L1 (OSI). Rrall\u00eb, n\u00eb disa dizajne, (p\u00ebr shembull, kur si der\u00ebz p\u00ebrfundimtare n\u00eb n\u00ebnrrjetet tuaja sh\u00ebrben nj\u00eb firewall dhe k\u00ebshtu t\u00eb gjith\u00eb trafiku kalon p\u00ebrmes tij), mund t\u00eb mungoj\u00eb performanca e pajisjes. <\/p>\n<p>Prandaj, gjat\u00eb zgjedhjes s\u00eb pajisjeve dhe arkitektur\u00ebs, duhet t'i p\u00ebrshtatni shpejt\u00ebsit\u00eb e porteve dhe performanc\u00ebn e pajisjeve.<\/p>\n<blockquote><p><b>Shembuj<\/b><\/p>\n<p>Supozoni se po p\u00ebrdorni si switch-e t\u00eb nivelit t\u00eb aksesit switch-e me porte 1 gigabit. Nd\u00ebrmjet tyre jan\u00eb lidhur p\u00ebrmes Etherchannel 2 x 10 gigabit. Si der\u00ebz p\u00ebrfundimtare, p\u00ebrdorni nj\u00eb firewall me porte gigabit, p\u00ebr t\u00eb cilin lidhni n\u00eb rrjetin L2 t\u00eb zyr\u00ebs me 2 porte gigabit, t\u00eb kombinuara n\u00eb Etherchannel. <\/p>\n<p>Kjo arkitektur\u00eb \u00ebsht\u00eb shum\u00eb e p\u00ebrshtatshme nga pik\u00ebpamja e funksionalitetit, sepse t\u00eb gjith\u00eb trafiku kalon p\u00ebrmes firewall-it, dhe mund t\u00eb menaxhoni leht\u00ebsisht politik\u00ebn e qasjes, dhe t\u00eb aplikoni algoritme t\u00eb komplikuara p\u00ebr kontrollin e trafikut dhe parandalimin e sulmeve t\u00eb mundshme (shih m\u00eb posht\u00eb), por nga pik\u00ebpamja e kapacitetit dhe performanc\u00ebs, ky dizajn ka sigurisht probleme potenciale. P\u00ebr shembull, 2 host-e q\u00eb ngarkojn\u00eb t\u00eb dh\u00ebna (me shpejt\u00ebsin\u00eb e portit 1 gigabit) mund t\u00eb ngarkojn\u00eb plot\u00ebsisht 2 gigabit lidhjen n\u00eb firewall, dhe k\u00ebshtu t\u00eb \u00e7ojn\u00eb n\u00eb degradimin e sh\u00ebrbimit p\u00ebr t\u00eb gjith\u00eb segmentin e zyr\u00ebs.<\/p><\/blockquote>\n<p>\nKemi shqyrtuar nj\u00eb maj\u00eb t\u00eb trek\u00ebnd\u00ebshit, tani le t\u00eb shohim se cilat mjete mund t\u00eb p\u00ebrdorim p\u00ebr t\u00eb siguruar sigurin\u00eb.<\/p>\n<h2>Mjetet e mbrojtjes<\/h2>\n<p>\nK\u00ebshtu, natyrisht, zakonisht d\u00ebshira jon\u00eb (dhe sakt\u00ebsisht, d\u00ebshira e drejtuesit ton\u00eb) \u00ebsht\u00eb t\u00eb arrijm\u00eb t\u00eb pamundur\u00ebn, p\u00ebrkat\u00ebsisht, t\u00eb ofrojm\u00eb sa m\u00eb shum\u00eb komoditet me sa m\u00eb shum\u00eb siguri dhe \u00e7mim minimal.<\/p>\n<p>Le t\u00eb shohim se cilat metoda kemi p\u00ebr t\u00eb ofruar mbrojtje.<\/p>\n<p>P\u00ebr zyr\u00ebn, do t\u00eb ve\u00e7oja k\u00ebto:<\/p>\n<ul>\n<li>qasja zero besimi n\u00eb dizajn<\/li>\n<li>niveli i lart\u00eb i mbrojtjes <\/li>\n<li>shikimi i rrjetit<\/li>\n<li>sistemi i centralizuar i autentifikimit dhe autorizimit<\/li>\n<li>kontrolli i hostit (host checking) <\/li>\n<\/ul>\n<p>\nM\u00eb tej do t\u00eb ndalemi pak m\u00eb shum\u00eb n\u00eb secilin nga k\u00ebto aspekte.<\/p>\n<h3>Zero Trust<\/h3>\n<p>\nBota IT po ndryshon shpejt. Vet\u00ebm n\u00eb dhjet\u00eb vitet e fundit, shfaqja e teknologjive dhe produkteve t\u00eb reja ka \u00e7uar n\u00eb nj\u00eb rishikim t\u00eb thell\u00eb t\u00eb koncepteve t\u00eb siguris\u00eb. Disa dhjet\u00ebra vite m\u00eb par\u00eb, nga k\u00ebndv\u00ebshtrimi i siguris\u00eb, ne segmentonim rrjetin n\u00eb zona besimi, dmz dhe zonat e pa besuara, duke aplikuar at\u00eb q\u00eb quhej \"mbrojtje p\u00ebrimetrike\", ku kishte dy linja mbrojtjeje: untrust -&gt; dmz dhe dmz -&gt; trust. Po ashtu, mbrojtja zakonisht kufizohej n\u00eb listat e aksesit t\u00eb bazuara n\u00eb L3\/L4 (OSI) tituj (IP, TCP\/UDP portet, flag TCP). \u00c7do gj\u00eb q\u00eb kishte t\u00eb b\u00ebnte me nivelet m\u00eb t\u00eb larta, p\u00ebrfshir\u00eb L7, i jepej sistemit operativ dhe produkteve t\u00eb mbrojtjes, t\u00eb instaluara n\u00eb hostet e fundit.<\/p>\n<p>Tani situata ka ndryshuar rr\u00ebnj\u00ebsisht. Koncepti modern <noindex><a rel=\"nofollow\" href=\"https:\/\/doubleoctopus.com\/security-wiki\/network-architecture\/zero-trust\/\">zero trust<\/a><\/noindex> bazohet n\u00eb faktin se nuk \u00ebsht\u00eb m\u00eb e mundur t\u00eb konsiderohen sistemet brenda perimetrin t\u00eb besueshme, p\u00ebrve\u00e7 k\u00ebsaj, koncepti i perimetrin \u00ebsht\u00eb b\u00ebr\u00eb i paqart\u00eb.<br \/>\nP\u00ebrve\u00e7 lidhjes me internetin, ne gjithashtu kemi<\/p>\n<ul>\n<li>VPN aksesin e larg\u00ebt t\u00eb p\u00ebrdoruesve<\/li>\n<li>pajisje personale t\u00eb ndryshme, laptop\u00eb t\u00eb sjell\u00eb, t\u00eb lidhur p\u00ebrmes Wi-Fi n\u00eb zyr\u00eb<\/li>\n<li>zyrat e tjera (branch)<\/li>\n<li>integrimin me infrastruktur\u00ebn cloud <\/li>\n<\/ul>\n<p>\nSi duket qasja Zero Trust n\u00eb praktik\u00eb?<\/p>\n<p>Idealisht, vet\u00ebm trafiku q\u00eb \u00ebsht\u00eb i nevojsh\u00ebm duhet t\u00eb lejohet dhe, n\u00ebse flasim p\u00ebr idealin, kontrolli duhet t\u00eb jet\u00eb jo vet\u00ebm n\u00eb nivelin L3\/L4, por n\u00eb nivelin e aplikacionit. <\/p>\n<p>N\u00ebse, p\u00ebr shembull, keni mund\u00ebsin\u00eb t\u00eb kaloni t\u00eb gjith\u00eb trafikun p\u00ebrmes nj\u00eb firewall, at\u00ebher\u00eb mund t\u00eb provoni t\u00eb afroni idealin. Por ky qasje mund t\u00eb zvog\u00ebloj\u00eb ndjesh\u00ebm gjer\u00ebsin\u00eb e p\u00ebrgjithshme t\u00eb band\u00ebs t\u00eb rrjetit tuaj, dhe gjithashtu filtrimi n\u00eb nivelin e aplikacionit nuk funksionon gjithmon\u00eb mir\u00eb.<\/p>\n<p>Kur kontrolloni trafikun n\u00eb router ose switch L3 (p\u00ebrdorimi i ACL-ve standarde), ju hasni n\u00eb probleme t\u00eb tjera:<\/p>\n<ul>\n<li>kjo \u00ebsht\u00eb vet\u00ebm filtrimi L3\/L4. Asgj\u00eb nuk e ndalon nj\u00eb sulmues t\u00eb p\u00ebrdor\u00eb portet e lejuara (p.sh., TCP 80) p\u00ebr aplikacionin e tij (jo http)<\/li>\n<li>menaxhimi kompleks i ACL-ve (e v\u00ebshtir\u00eb p\u00ebr tu analizuar)<\/li>\n<li>nuk \u00ebsht\u00eb nj\u00eb firewall stateful, q\u00eb do t\u00eb thot\u00eb se duhet t\u00eb lejoni qart\u00eb trafikun e kthyer<\/li>\n<li>n\u00eb rastin e switch-eve, zakonisht jeni shum\u00eb t\u00eb kufizuar nga madh\u00ebsia e TCAM, e cila n\u00eb rastin e qasjes \"lejo vet\u00ebm at\u00eb q\u00eb \u00ebsht\u00eb e nevojshme\" mund t\u00eb b\u00ebhet nj\u00eb problem shpejt<\/li>\n<\/ul>\n<p><\/p>\n<blockquote><p><b>V\u00ebrejtje<\/b><\/p>\n<p>Duke folur p\u00ebr trafikun e kthyer, duhet t\u00eb mbajm\u00eb mend se kemi mund\u00ebsin\u00eb (Cisco) <\/p>\n<p>lejo tcp \u00e7far\u00ebdo \u00e7far\u00ebdo t\u00eb vendosur<\/p>\n<p>Por duhet t\u00eb kuptohet se kjo linj\u00eb \u00ebsht\u00eb e barabart\u00eb me dy linja:<br \/>\nlejo tcp \u00e7far\u00ebdo \u00e7far\u00ebdo ack<br \/>\nlejo tcp \u00e7far\u00ebdo \u00e7far\u00ebdo rst<\/p>\n<p>K\u00ebto do t\u00eb thot\u00eb se edhe n\u00ebse nuk kishte nj\u00eb segment t\u00eb par\u00eb TCP me flag SYN (dmth sesioni TCP as nuk filloi t\u00eb vendoset) kjo ACL do t\u00eb lejoj\u00eb nj\u00eb paket\u00eb me flag ACK, q\u00eb sulmuesi mund ta shfryt\u00ebzoj\u00eb p\u00ebr t\u00eb d\u00ebrguar t\u00eb dh\u00ebna.<\/p>\n<p>K\u00ebshtu q\u00eb kjo linj\u00eb n\u00eb asnj\u00eb m\u00ebnyr\u00eb nuk e kthen routerin tuaj ose switch-in L3 n\u00eb nj\u00eb firewall stateful.<\/p><\/blockquote>\n<p><\/p>\n<h3>Niveli i lart\u00eb i mbrojtjes<\/h3>\n<p>\nN\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">artikullin<\/a><\/noindex> N\u00eb seksionin q\u00eb i kushtohej qendrave t\u00eb t\u00eb dh\u00ebnave, ne shqyrtuam metodat e m\u00ebposhtme t\u00eb mbrojtjes.<\/p>\n<ul>\n<li>firewall i gjendjes (me default)<\/li>\n<li>mbrojtje ddos\/dos<\/li>\n<li>firewall p\u00ebr aplikacione<\/li>\n<li>parandalimi i k\u00ebrc\u00ebnimeve (antivirus, anti-spyware dhe vulnerabilitet)<\/li>\n<li>filtrimi i URL-ve<\/li>\n<li>filtrimi i t\u00eb dh\u00ebnave (filtrimi i p\u00ebrmbajtjes)<\/li>\n<li>bllokimi i skedar\u00ebve (bllokimi i llojeve t\u00eb skedar\u00ebve)<\/li>\n<\/ul>\n<p>\nN\u00eb rastin e zyr\u00ebs, situata \u00ebsht\u00eb e ngjashme, por prioritetet jan\u00eb pak ndryshe. Disponueshm\u00ebria e zyr\u00ebs (availabilty) zakonisht nuk \u00ebsht\u00eb kaq kritike sa n\u00eb rastin e qendr\u00ebs s\u00eb t\u00eb dh\u00ebnave, nd\u00ebrsa probabiliteti i trafik\u00ebve t\u00eb d\u00ebmsh\u00ebm \"t\u00eb brendsh\u00ebm\" \u00ebsht\u00eb shum\u00eb m\u00eb i lart\u00eb. <br \/>\nPrandaj, metodat e m\u00ebposhtme t\u00eb mbrojtjes p\u00ebr k\u00ebt\u00eb segment b\u00ebhen kritike:<\/p>\n<ul>\n<li>firewall p\u00ebr aplikacione<\/li>\n<li>parandalimi i k\u00ebrc\u00ebnimeve (anti-virus, anti-spyware, dhe vulnerabilitet)<\/li>\n<li>filtrimi i URL-ve<\/li>\n<li>filtrimi i t\u00eb dh\u00ebnave (filtrimi i p\u00ebrmbajtjes)<\/li>\n<li>bllokimi i skedar\u00ebve (bllokimi i llojeve t\u00eb skedar\u00ebve)<\/li>\n<\/ul>\n<p>\nMegjith\u00ebse t\u00eb gjitha k\u00ebto metoda mbrojtjeje, p\u00ebrve\u00e7 firewall-it t\u00eb aplikacionit, tradicionalisht ishin dhe vazhdojn\u00eb t\u00eb zgjidhen n\u00eb hostet e fundit (p.sh., me instalimin e programeve antivirus) dhe me ndihm\u00ebn e proxy, NGFW moderne gjithashtu ofrojn\u00eb k\u00ebto sh\u00ebrbime. <\/p>\n<p>Furnizuesit e pajisjeve t\u00eb siguris\u00eb po synojn\u00eb t\u00eb krijojn\u00eb nj\u00eb mbrojtje t\u00eb plot\u00eb, k\u00ebshtu q\u00eb p\u00ebrve\u00e7 mbrojtjes n\u00eb kutit\u00eb lokale, ofrohen teknologji t\u00eb ndryshme \u043e\u0431\u043b\u0430\u0447\u043d\u00eb dhe softuer p\u00ebr klient\u00ebt p\u00ebr hostet (end point protection\/EPP). Pra, p.sh., nga <noindex><a rel=\"nofollow\" href=\"https:\/\/www.fairline.com.tw\/data\/editor\/files\/01%20%20Gartner%20-%20Magic%20Quad%20-%20Endpoint%20Protection%20Platforms%201-2018.pdf\">Magjike Kvadri i Gartnerit (Gartner Magic Quadrant) p\u00ebr vitin 2018<\/a><\/noindex> ne shohim se Palo Alto dhe Cisco kan\u00eb EPP-t\u00eb e tyre (PA: Traps, Cisco: AMP), por nuk jan\u00eb shum\u00eb n\u00eb krye.<\/p>\n<p>Aktivizimi i k\u00ebtyre mbrojtjeve (zakonisht me blerjen e licencave) n\u00eb firewall, sigurisht q\u00eb nuk \u00ebsht\u00eb e detyrueshme (mund t\u00eb shkoni me rrug\u00ebn tradicionale), por sjell disa p\u00ebrpar\u00ebsi:<\/p>\n<ul>\n<li>n\u00eb k\u00ebt\u00eb rast shfaqet nj\u00eb pik\u00eb e vetme p\u00ebr aplikimin e metodave t\u00eb mbrojtjes, q\u00eb p\u00ebrmir\u00ebson visibility (shihni tem\u00ebn tjet\u00ebr). <\/li>\n<li>n\u00ebse n\u00eb rrjetin tuaj ka nj\u00eb pajisje t\u00eb paprotectuar, ajo p\u00ebrs\u00ebri bie n\u00ebn \"ombrell\u00ebn\" e mbrojtjes s\u00eb firewall-it<\/li>\n<li> duke p\u00ebrdorur mbrojtjet n\u00eb firewall s\u00eb bashku me mbrojtjen n\u00eb hostet e fundit, ne rrisim probabilitetin e zbuluar t\u00eb trafikut t\u00eb d\u00ebmsh\u00ebm. P\u00ebr shembull, p\u00ebrdorimi i parandalimit t\u00eb k\u00ebrc\u00ebnimeve n\u00eb hostet lokale dhe n\u00eb firewall rrit probabilitetin e zbulimit (n\u00ebn kushtin, natyrisht, q\u00eb k\u00ebto zgjidhje t\u00eb bazohen n\u00eb produkte t\u00eb ndryshme t\u00eb softuerit)<\/li>\n<\/ul>\n<blockquote><p><b>V\u00ebrejtje<\/b><\/p>\n<p>N\u00ebse, p\u00ebr shembull, p\u00ebrdorni Kaspersky si antivirus n\u00eb firewall dhe n\u00eb host-et p\u00ebrfundimtar\u00eb, at\u00ebher\u00eb \u00ebsht\u00eb e qart\u00eb se kjo nuk do t\u00eb rris\u00eb ndjesh\u00ebm shanset tuaja p\u00ebr t\u00eb parandaluar nj\u00eb sulm virusesh n\u00eb rrjetin tuaj.<\/p><\/blockquote>\n<p><\/p>\n<h3>Shikueshm\u00ebri e rrjetit<\/h3>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/blog.gigamon.com\/2017\/11\/01\/what-is-network-visibility\/\">Ideja kryesore<\/a><\/noindex> \u00ebsht\u00eb thjesht\u00eb \u2013 \u00abt\u00eb shoh\u00ebsh\u00bb se \u00e7far\u00eb po ndodh n\u00eb rrjetin tuaj, si n\u00eb koh\u00eb reale ashtu edhe t\u00eb dh\u00ebna historike. <\/p>\n<p>Un\u00eb do ta ndaj k\u00ebt\u00eb \u00abshikim\u00bb n\u00eb dy grupe:<\/p>\n<p><b>Grupi i par\u00eb:<\/b> ato q\u00eb zakonisht ju ofron sistemi juaj i monitorimit.<\/p>\n<ul>\n<li>ngarkesa e pajisjeve<\/li>\n<li>ngarkesa e kanaleve<\/li>\n<li>p\u00ebrdorimi i memories<\/li>\n<li>p\u00ebrdorimi i disqeve<\/li>\n<li>ndryshimi i tabel\u00ebs s\u00eb routimit <\/li>\n<li>statusi i lidhjeve<\/li>\n<li>disponueshm\u00ebria e pajisjeve (ose host-ve)<\/li>\n<li>\u2026<\/li>\n<\/ul>\n<p><b>Grupi i dyt\u00eb: <\/b>informacioni i lidhur me sigurin\u00eb.<\/p>\n<ul>\n<li>statistika t\u00eb ndryshme (p\u00ebr shembull, p\u00ebr aplikacionet, p\u00ebr vizitat n\u00eb URL, llojet e t\u00eb dh\u00ebnave q\u00eb jan\u00eb shkarkuar, t\u00eb dh\u00ebna p\u00ebr p\u00ebrdoruesit)<\/li>\n<li>\u00e7far\u00eb \u00ebsht\u00eb bllokuar nga politikat e siguris\u00eb dhe p\u00ebr \u00e7far\u00eb arsye, konkretisht\n<ul>\n<li>aplikacion i ndaluar<\/li>\n<li>ndaluar mbi baz\u00ebn e ip\/protocol\/port\/flags\/zones<\/li>\n<li>parandalimi i k\u00ebrc\u00ebnimeve<\/li>\n<li>filtrimi i URL-ve<\/li>\n<li>filtrimi i t\u00eb dh\u00ebnave<\/li>\n<li>bllokimi i skedar\u00ebve<\/li>\n<li>&#8230;<\/li>\n<\/ul>\n<\/li>\n<li>statistika p\u00ebr sulmet DOS\/DDOS<\/li>\n<li>p\u00ebrpjekjet e d\u00ebshtuara t\u00eb identifikimit dhe autorizimit<\/li>\n<li>statistika p\u00ebr t\u00eb gjitha ngjarjet e m\u00ebparshme t\u00eb shkeljeve t\u00eb politikave t\u00eb siguris\u00eb<\/li>\n<li>&#8230;<\/li>\n<\/ul>\n<p>\nN\u00eb k\u00ebt\u00eb kapitull, i p\u00ebrkushtuar siguris\u00eb, na intereson pik\u00ebrisht pjesa e dyt\u00eb.<\/p>\n<p>Disa firewall-e moderne (nga p\u00ebrvoja ime Palo Alto) ofrojn\u00eb nj\u00eb nivel t\u00eb mir\u00eb shikueshm\u00ebrie. Por, sigurisht, trafiku q\u00eb ju intereson duhet t\u00eb kaloj\u00eb p\u00ebrmes k\u00ebtyre firewall-eve (n\u00eb k\u00ebt\u00eb rast keni mund\u00ebsin\u00eb t\u00eb bllokoni trafikun) ose t\u00eb pasqyrohet n\u00eb firewall (p\u00ebrdoret vet\u00ebm p\u00ebr monitorim dhe analiz\u00eb), dhe duhet t\u00eb keni licenca q\u00eb lejojn\u00eb aktivizimin e t\u00eb gjitha k\u00ebtyre sh\u00ebrbimeve.<\/p>\n<p>Sigurisht, ka edhe nj\u00eb rrug\u00eb alternative, ose m\u00eb sakt\u00eb nj\u00eb rrug\u00eb tradicionale, p\u00ebr shembull,<\/p>\n<ul>\n<li>statistikat e seancave mund t\u00eb mblidhen p\u00ebrmes netflow dhe m\u00eb pas mund t\u00eb p\u00ebrdoren mjete speciale p\u00ebr analizimin e informacionit dhe vizualizimin e t\u00eb dh\u00ebnave.<\/li>\n<li>parandalimi i k\u00ebrc\u00ebnimeve \u2013 programe speciale (anti-virus, anti-spyware, firewall) n\u00eb host-et p\u00ebrfundimtar\u00eb<\/li>\n<li>filtrimi i URL-ve, filtrimi i t\u00eb dh\u00ebnave, bllokimi i skedar\u00ebve \u2013 n\u00eb proxy<\/li>\n<li>mund t\u00eb analizohet gjithashtu tcpdump me, p\u00ebr shembull, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/268207\/\">snort<\/a><\/noindex><\/li>\n<\/ul>\n<p>\nMund t\u00eb kombinohen k\u00ebto dy qasje, duke plot\u00ebsuar funksionet q\u00eb mungojn\u00eb ose duke i duplikuar ato p\u00ebr t\u00eb rritur probabilitetin e zbulimit t\u00eb sulmit.<\/p>\n<p>Cila qasje t\u00eb zgjidhni?<br \/>\nVaret shum\u00eb nga kualifikimi dhe preferencat e ekipit tuaj.<br \/>\nT\u00eb dyja kan\u00eb p\u00ebrfitime dhe disavantazhe.<\/p>\n<h3>Nj\u00eb sistem i centralizuar i nj\u00ebjt\u00eb p\u00ebr autentifikim dhe autorizim<br \/>\n<\/h3>\n<p>\nMe nj\u00eb dizajn t\u00eb mir\u00eb, l\u00ebvizshm\u00ebria, t\u00eb cil\u00ebn e diskutuam n\u00eb k\u00ebt\u00eb artikull, \u043f\u043e\u0434\u0440\u0430\u0437\u0443\u043c\u0435\u0432\u0430\u0435\u0442 q\u00eb keni t\u00eb nj\u00ebjtat qasje, duke punuar nga zyrat ose nga sht\u00ebpia, nga aeroporti, nga nj\u00eb kafene ose nga \u00e7do pik\u00eb tjet\u00ebr (me kufizime, t\u00eb cilat i diskutuam m\u00eb sip\u00ebr). Duket se \u00e7far\u00eb problemi ka? <br \/>\nP\u00ebr t\u00eb kuptuar m\u00eb mir\u00eb kompleksitetin e k\u00ebtij problemi, le t\u00eb shqyrtojm\u00eb nj\u00eb dizajn tipik.<\/p>\n<blockquote><p><b>Shembuj<\/b><\/p>\n<ul>\n<li>Ju i keni ndar\u00eb t\u00eb gjith\u00eb punonj\u00ebsit n\u00eb grupe. Ju vendos\u00ebt t\u00eb ofroni qasje p\u00ebrmes grupeve.<\/li>\n<li>Brenda zyr\u00ebs kontrolloni qasjet n\u00eb firewall-in e zyrave.<\/li>\n<li>Trafici nga zyra n\u00eb qendr\u00ebn e t\u00eb dh\u00ebnave e kontrolloni n\u00eb firewall-in e qendr\u00ebs s\u00eb t\u00eb dh\u00ebnave.<\/li>\n<li>Si nj\u00eb port\u00eb VPN p\u00ebrdorni Cisco ASA dhe p\u00ebr kontrollin e trafikut q\u00eb hyn n\u00eb rrjetin tuaj nga klient\u00ebt e dedikuar, p\u00ebrdorni ACL lokale (n\u00eb ASA).<\/li>\n<\/ul>\n<p>\nTani, le t\u00eb supozojm\u00eb se ju k\u00ebrkohet t\u00eb shtoni qasje shtes\u00eb p\u00ebr nj\u00eb punonj\u00ebs t\u00eb caktuar. N\u00eb k\u00ebt\u00eb rast, ju k\u00ebrkohet t\u00eb shtoni qasje vet\u00ebm p\u00ebr at\u00eb dhe ask\u00ebnd tjet\u00ebr nga grupi i tij.<\/p>\n<p>P\u00ebr k\u00ebt\u00eb, ne duhet t\u00eb krijojm\u00eb nj\u00eb grup t\u00eb ve\u00e7ant\u00eb p\u00ebr k\u00ebt\u00eb punonj\u00ebs, dometh\u00ebn\u00eb<\/p>\n<ul>\n<li>n\u00eb ASA t\u00eb krijoni nj\u00eb grup t\u00eb ve\u00e7ant\u00eb IP p\u00ebr k\u00ebt\u00eb punonj\u00ebs.<\/li>\n<li>shtoni nj\u00eb ACL t\u00eb re n\u00eb ASA dhe lidheni at\u00eb me k\u00ebt\u00eb klient t\u00eb distancuar.<\/li>\n<li>krijoni politika t\u00eb reja sigurie n\u00eb firewall-et e zyrave dhe qendr\u00ebs s\u00eb t\u00eb dh\u00ebnave.<\/li>\n<\/ul>\n<p>\nMir\u00eb \u00ebsht\u00eb, n\u00ebse ky ngjarje \u00ebsht\u00eb e rrall\u00eb. Por n\u00eb p\u00ebrvoj\u00ebn time ka pasur situata kur punonj\u00ebsit merrnin pjes\u00eb n\u00eb projekte t\u00eb ndryshme dhe ky grup projektesh p\u00ebr disa prej tyre ndryshonte mjaft shpesh, dhe kjo nuk ishte 1-2 persona, por dhjetra. Sigurisht, k\u00ebtu duhej t\u00eb b\u00ebnim di\u00e7ka.<\/p>\n<p>Kjo u zgjidh n\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb.<\/p>\n<p>Ne vendos\u00ebm se burimi i vet\u00ebm i v\u00ebrtet\u00eb, q\u00eb p\u00ebrcakton t\u00eb gjitha mund\u00ebsit\u00eb e qasjes s\u00eb punonj\u00ebsit, do t\u00eb ishte LDAP. Ne krijuam t\u00eb gjitha grupet e mundshme q\u00eb p\u00ebrcaktojn\u00eb setet e qasjeve dhe \u00e7do p\u00ebrdorues e lidh\u00ebm me nj\u00eb ose m\u00eb shum\u00eb grupe. <\/p>\n<p>P.sh., le t\u00eb supozojm\u00eb se ishin grupet <\/p>\n<ul>\n<li>guest (qasje n\u00eb Internet)<\/li>\n<li>common access (qasje n\u00eb burime t\u00eb p\u00ebrbashk\u00ebta: post\u00eb, baza e njohurive, \u2026)<\/li>\n<li>accounting<\/li>\n<li>project 1<\/li>\n<li>project 2<\/li>\n<li>administrator i baz\u00ebs s\u00eb t\u00eb dh\u00ebnave<\/li>\n<li>administrator linux<\/li>\n<li>\u2026<\/li>\n<\/ul>\n<p>\nDhe n\u00ebse ndonj\u00eb nga punonj\u00ebsit ishte angazhuar n\u00eb t\u00eb dyja projektet 1 dhe 2, dhe iu nevojiteshin qasjet e nevojshme p\u00ebr t\u00eb punuar n\u00eb k\u00ebto projekte, at\u00ebher\u00eb ky punonj\u00ebs lidhej p\u00ebrkat\u00ebsisht me grupet:<\/p>\n<ul>\n<li>guest <\/li>\n<li>common access<\/li>\n<li>project 1<\/li>\n<li>project 2<\/li>\n<\/ul>\n<p>\nSi do ta kthejm\u00eb tani k\u00ebt\u00eb informacion n\u00eb qasje n\u00eb pajisjet rrjet\u00ebsore? <\/p>\n<p>Politika e Qasjes Dinamike t\u00eb Cisco ASA (DAP) (shih. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/support\/docs\/security\/asa-5500-x-series-next-generation-firewalls\/108000-dap-deploy-guide.html\">www.cisco.com\/c\/en\/us\/support\/docs\/security\/asa-5500-x-series-next-generation-firewalls\/108000-dap-deploy-guide.html<\/a><\/noindex>) zgjidhja \u00ebsht\u00eb e p\u00ebrshtatshme p\u00ebr k\u00ebt\u00eb detyr\u00eb.<\/p>\n<p>N\u00ebse flasim shkurtimisht p\u00ebr realizimin ton\u00eb, gjat\u00eb procesit t\u00eb identifikimit\/autorizimit, ASA merr nga LDAP nj\u00eb grup t\u00eb caktuar grupesh q\u00eb i p\u00ebrkasin k\u00ebtij p\u00ebrdoruesi dhe \"nd\u00ebrton\" nj\u00eb ACL dynamic nga disa ACL lokale (secila prej t\u00eb cilave i p\u00ebrket nj\u00eb grupi) me t\u00eb gjitha qasjet e nevojshme, q\u00eb plot\u00ebson plot\u00ebsisht d\u00ebshirat tona.<\/p>\n<p>Por kjo \u00ebsht\u00eb vet\u00ebm p\u00ebr lidhjet VPN. P\u00ebr t\u00eb b\u00ebr\u00eb situat\u00ebn t\u00eb nj\u00ebjt\u00eb p\u00ebr punonj\u00ebsit q\u00eb lidhen p\u00ebrmes VPN dhe ata q\u00eb ndodhen n\u00eb zyr\u00eb, u nd\u00ebrmor nj\u00eb hap tjet\u00ebr. <\/p>\n<p>Kur lidhen nga zyra, p\u00ebrdoruesit me protokollin 802.1x kalonin ose n\u00eb VLAN guest (p\u00ebr mysafir\u00ebt), ose n\u00eb VLAN me qasje t\u00eb p\u00ebrbashk\u00ebt (p\u00ebr punonj\u00ebsit e kompanis\u00eb). M\u00eb von\u00eb, p\u00ebr t\u00eb marr\u00eb qasje specifike (p\u00ebr shembuj n\u00eb projektet n\u00eb qendrat e t\u00eb dh\u00ebnave), punonj\u00ebsit duhej t\u00eb lidhen p\u00ebrmes VPN.<\/p>\n<p>P\u00ebr lidhjet nga zyra dhe nga sht\u00ebpia, u p\u00ebrdor\u00ebn grupe t\u00eb ndryshme tunelesh n\u00eb ASA. Kjo ishte e nevojshme q\u00eb p\u00ebr ata q\u00eb lidhen nga zyra, trafiku n\u00eb burimet e p\u00ebrbashk\u00ebta (t\u00eb p\u00ebrdorura nga t\u00eb gjith\u00eb punonj\u00ebsit, si posta, server\u00ebt e skedar\u00ebve, sistemi i biletave, DNS, ...) t\u00eb kalonte jo p\u00ebrmes ASA, por p\u00ebrmes rrjetit lokal. K\u00ebshtu, ne nuk ngarkuam ASA me trafik t\u00eb panevojsh\u00ebm, p\u00ebrfshir\u00eb at\u00eb me intensitet t\u00eb lart\u00eb.<\/p>\n<p>K\u00ebshtu, detyra u zgjidh. <br \/>\nNe mor\u00ebm <\/p>\n<ul>\n<li>n\u00eb nj\u00eb grup t\u00eb barabart\u00eb qasjesh, si p\u00ebr lidhjet nga zyra ashtu edhe p\u00ebr lidhjet e larg\u00ebta<\/li>\n<li>munges\u00ebn e degradimit t\u00eb sh\u00ebrbimeve kur punojm\u00eb nga zyra, lidhur me transmetimin e trafikut me intensitet t\u00eb lart\u00eb p\u00ebrmes ASA<\/li>\n<\/ul>\n<p>\nCila \u00ebsht\u00eb p\u00ebrfitimi tjet\u00ebr i k\u00ebtij qasje?<br \/>\nN\u00eb administrimin e qasjes. Qasjet ndryshojn\u00eb leht\u00ebsisht, n\u00eb nj\u00eb vend.<br \/>\nP\u00ebr shembull, n\u00ebse nj\u00eb punonj\u00ebs largohet nga kompania, thjesht e hiqni at\u00eb nga LDAP, dhe ai automatikisht humb t\u00eb gjitha qasjet.\n<\/p><\/blockquote>\n<p><\/p>\n<h3>Kontrolli i hostit<\/h3>\n<p>\nMe mund\u00ebsin\u00eb e lidhjes nga larg, ne marrim rrezikun p\u00ebr t\u00eb lejuar n\u00eb rrjet jo vet\u00ebm punonj\u00ebsin e kompanis\u00eb, por gjithashtu t\u00eb gjith\u00eb softuerin e d\u00ebmsh\u00ebm, i cili me nj\u00eb probabilitet t\u00eb konsideruesh\u00ebm \u00ebsht\u00eb n\u00eb kompjuterin e tij (p\u00ebr shembull, n\u00eb sht\u00ebpi), dhe m\u00eb shum\u00eb, p\u00ebrmes k\u00ebtij softueri mund t\u00eb hapim qasje n\u00eb rrjetin ton\u00eb p\u00ebr nj\u00eb sulmues q\u00eb p\u00ebrdor k\u00ebt\u00eb host si proxy.<\/p>\n<p>Ka sens t\u00eb p\u00ebrdoren t\u00eb nj\u00ebjtat k\u00ebrkesa t\u00eb siguris\u00eb p\u00ebr hostin q\u00eb lidhet nga larg si p\u00ebr hostin q\u00eb ndodhet n\u00eb zyr\u00eb.<\/p>\n<p>Kjo p\u00ebrfshin, mes t\u00eb tjerash, edhe versionin \"e duhur\" t\u00eb sistemit operativ, anti-virus, anti-spyware, dhe softuerin e firewall dhe p\u00ebrdit\u00ebsimeve. N\u00eb p\u00ebrgjith\u00ebsi, kjo mund\u00ebsi ekziston n\u00eb pik\u00ebn e lidhjes VPN (p\u00ebr ASA, shih, p\u00ebr shembull, <noindex><a rel=\"nofollow\" href=\"https:\/\/community.cisco.com\/t5\/security-documents\/how-to-configure-anyconnect-host-scan\/ta-p\/3118732\">k\u00ebtu<\/a><\/noindex>).<\/p>\n<p>Gjithashtu ka sens t\u00eb aplikohet t\u00eb nj\u00ebjtat metoda t\u00eb analiz\u00ebs dhe bllokimit t\u00eb trafikut (shih \"Niveli i Lart\u00eb i Siguris\u00eb\"), q\u00eb p\u00ebrdoren sipas politik\u00ebs tuaj t\u00eb siguris\u00eb p\u00ebr trafikun nga zyrat. <\/p>\n<p>S\u00eb fundi, \u00ebsht\u00eb e arsyeshme t\u00eb supozohet se tani rrjeti juaj zyrar nuk kufizohet vet\u00ebm n\u00eb nd\u00ebrtes\u00ebn e zyr\u00ebs dhe hostet q\u00eb ndodhen n\u00eb t\u00eb.<\/p>\n<blockquote><p><b>Shembuj<\/b><\/p>\n<p>Nj\u00eb praktik\u00eb e mir\u00eb \u00ebsht\u00eb q\u00eb t\u00eb pajisni secilin punonj\u00ebs q\u00eb ka nevoj\u00eb p\u00ebr qasje nga larg me nj\u00eb laptop t\u00eb mir\u00eb, t\u00eb rehatsh\u00ebm dhe t\u00eb k\u00ebrkoni t\u00eb punoj\u00eb nga t\u00eb dyja, si n\u00eb zyr\u00eb ashtu edhe nga sht\u00ebpia, vet\u00ebm me at\u00eb.<\/p>\n<p>Kjo jo vet\u00ebm q\u00eb rrit nivelin e siguris\u00eb s\u00eb rrjetit tuaj, por gjithashtu \u00ebsht\u00eb shum\u00eb e rehatshme dhe zakonisht pranohet pozitivisht nga punonj\u00ebsit (n\u00ebse \u00ebsht\u00eb n\u00eb t\u00eb v\u00ebrtet\u00eb nj\u00eb laptop i mir\u00eb dhe i rehatsh\u00ebm).<\/p><\/blockquote>\n<p><\/p>\n<h2>P\u00ebr ndjenj\u00ebn e mas\u00ebs dhe balanc\u00ebs<\/h2>\n<p>\nB\u00ebhet fjal\u00eb p\u00ebr maj\u00ebn e tret\u00eb t\u00eb trek\u00ebnd\u00ebshit ton\u00eb \u2014 p\u00ebr \u00e7mimin.<br \/>\nLe t\u00eb shqyrtojm\u00eb nj\u00eb shembull hipotetik.<\/p>\n<blockquote><p><b>Shembuj<\/b><\/p>\n<p>Keni nj\u00eb zyr\u00eb me 200 njer\u00ebz. Keni vendosur ta b\u00ebni at\u00eb sa m\u00eb t\u00eb rehatsh\u00ebm dhe sa m\u00eb t\u00eb sigurt.<\/p>\n<p>Prandaj, ju vendos\u00ebt t\u00eb kaloni t\u00eb gjith\u00eb trafikun p\u00ebrmes firewall-it dhe k\u00ebshtu p\u00ebr t\u00eb gjitha n\u00ebnrrjetet e zyr\u00ebs, firewall-i \u00ebsht\u00eb der\u00eb e zakonshme. P\u00ebrve\u00e7 softuerit t\u00eb siguris\u00eb, i instaluar n\u00eb \u00e7do host p\u00ebrfundimtar (anti-virus, anti-spyware, dhe softuer firewall), ju gjithashtu vendos\u00ebt t\u00eb aplikoni t\u00eb gjitha metodat e mundshme t\u00eb mbrojtjes n\u00eb firewall.<\/p>\n<p>P\u00ebr t\u00eb siguruar nj\u00eb shpejt\u00ebsi t\u00eb lart\u00eb lidhjeje (gjith\u00e7ka p\u00ebr rehatin\u00eb), p\u00ebr t\u00eb pasur switch-e me porta 10-gigabit, dhe p\u00ebr firewall-e \u2014 firewall-e t\u00eb performanc\u00ebs s\u00eb lart\u00eb NGFW, p\u00ebr shembull, seria 7K e Palo Alto (me 40 porta gigabit), natyrisht me t\u00eb gjitha licencat e p\u00ebrfshira dhe, natyrisht, nj\u00eb \u00e7ift me Disponueshm\u00ebri t\u00eb Lart\u00eb.<\/p>\n<p>Gjithashtu, natyrisht, p\u00ebr t\u00eb punuar me k\u00ebt\u00eb linj\u00eb pajisjesh na duhen s\u00eb paku disa inxhinier\u00eb t\u00eb kualifikuar n\u00eb siguri.<\/p>\n<p>Pastaj, ju vendos\u00ebt t\u00eb jepni \u00e7do punonj\u00ebsi nj\u00eb laptop t\u00eb mir\u00eb.<\/p>\n<p>N\u00eb total, rreth 10 milion dollar\u00eb p\u00ebr implementim, qindra mij\u00ebra dollar\u00eb (mendoj se m\u00eb af\u00ebr nj\u00eb milioni) p\u00ebr mb\u00ebshtetje vjetore dhe paga p\u00ebr inxhinier\u00ebt.<\/p>\n<p>Zyra, 200 njer\u00ebz\u2026<br \/>\nE rehatshme? Ndoshta po. <\/p>\n<p>Ju p\u00ebrgatisni k\u00ebt\u00eb propozim p\u00ebr menaxhimin tuaj...<br \/>\nNdoshta n\u00eb bot\u00eb ekziston ndonj\u00eb kompani p\u00ebr t\u00eb cil\u00ebn kjo \u00ebsht\u00eb nj\u00eb zgjidhje e pranueshme dhe e duhur. N\u00ebse jeni punonj\u00ebs i atij kompania - urime, por n\u00eb shumic\u00ebn d\u00ebrrmuese t\u00eb rasteve, jam i sigurt se njohurit\u00eb tuaja nuk do t\u00eb vler\u00ebsohen nga menaxhimi.<\/p><\/blockquote>\n<p>\nA \u00ebsht\u00eb ky nj\u00eb shembull i ekzagjeruar? Kapitulli n\u00eb vijim do t\u00eb p\u00ebrgjigjet n\u00eb k\u00ebt\u00eb pyetje.<\/p>\n<p>N\u00ebse n\u00eb rrjetin tuaj nuk shihni di\u00e7ka nga ajo q\u00eb u p\u00ebrmend m\u00eb lart, at\u00ebher\u00eb kjo \u00ebsht\u00eb normale.<br \/>\nP\u00ebr \u00e7do rast specifik, duhet t\u00eb gjeni kompromisin tuaj t\u00eb arsyesh\u00ebm midis leht\u00ebsis\u00eb, \u00e7mimit dhe siguris\u00eb. Shpesh nuk nevojitet as nj\u00eb NGFW n\u00eb zyr\u00ebn tuaj, nuk nevojitet mbrojtje L7 n\u00eb firewall. Mjafton t\u00eb sigurohet nj\u00eb nivel i mir\u00eb i visibles dhe alarmesh, dhe kjo mund t\u00eb b\u00ebhet duke p\u00ebrdorur produkte open source, p\u00ebr shembull. Po, reagimi juaj ndaj nj\u00eb sulmi nuk do t\u00eb jet\u00eb i menj\u00ebhersh\u00ebm, por e r\u00ebnd\u00ebsishme \u00ebsht\u00eb se do ta shihni at\u00eb, dhe me proceset e duhura n\u00eb departamentin tuaj do t\u00eb jeni n\u00eb gjendje ta neutralizoni at\u00eb shpejt.<\/p>\n<p>Dhe, kujtoj se sipas q\u00ebllimit t\u00eb k\u00ebtij cikli t\u00eb artikujve, ju nuk jeni duke projektuar nj\u00eb rrjet, thjesht po p\u00ebrpiqeni t\u00eb p\u00ebrmir\u00ebsoni at\u00eb q\u00eb keni marr\u00eb.<\/p>\n<h2>Analiza e arkitektur\u00ebs SAFE t\u00eb zyr\u00ebs<\/h2>\n<p>\nShikoni k\u00ebt\u00eb katror t\u00eb kuq, me t\u00eb cilin kam sh\u00ebnuar vendin n\u00eb skem\u00ebn nga <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/dam\/en\/us\/solutions\/collateral\/enterprise\/design-zone-security\/safe-architecture-guide-secure-campus.pdf\">Udh\u00ebzuesi i Arkitektur\u00ebs s\u00eb Kampusit t\u00eb Sigurt SAFE<\/a><\/noindex>, t\u00eb cilin do t\u00eb doja ta diskutoja k\u00ebtu.<\/p>\n<p><img decoding=\"async\" alt=\"Si t\u00eb merrni n\u00ebn kontroll infrastruktur\u00ebn e rrjetit tuaj. K kapitulli i tret\u00eb. Siguria e rrjetit. Pjesa e tret\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/617b6561b6ebb17d4f015251abcadf9b.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKy \u00ebsht\u00eb nj\u00eb nga vendet ky\u00e7e t\u00eb arkitektur\u00ebs dhe nj\u00eb nga pasigurit\u00eb m\u00eb t\u00eb r\u00ebnd\u00ebsishme.<\/p>\n<blockquote><p><b>V\u00ebrejtje<\/b><\/p>\n<p>Un\u00eb kurr\u00eb nuk kam konfiguruar dhe nuk kam punuar me FirePower (nga linja e firewall-eve Cisco - vet\u00ebm me ASA), k\u00ebshtu q\u00eb do ta shqyrtoj at\u00eb si nj\u00eb firewall t\u00eb zakonsh\u00ebm, p\u00ebr shembull, si Juniper SRX ose Palo Alto, duke supozuar se ai ka t\u00eb nj\u00ebjtat mund\u00ebsi.<\/p><\/blockquote>\n<p>\nNga strukturat e zakonshme, shoh vet\u00ebm 4 mund\u00ebsi t\u00eb mundshme p\u00ebr p\u00ebrdorimin e firewall-it me nj\u00eb lidhje t\u00eb till\u00eb:<\/p>\n<ul>\n<li>gateway default p\u00ebr \u00e7do n\u00ebnrrjet\u00eb \u00ebsht\u00eb nj\u00eb switch, nd\u00ebrsa firewall ndodhet n\u00eb modalitetin transparent (dmth, e gjith\u00eb trafiku kalon p\u00ebrmes tij, por ai nuk krijon nj\u00eb hop L3)<\/li>\n<li>gateway default p\u00ebr \u00e7do n\u00ebnrrjet\u00eb jan\u00eb sub-interfaca e firewall-it (ose SVI interfaca), switch-i luan rolin e L2<\/li>\n<li>n\u00eb switch p\u00ebrdoren VRF t\u00eb ndryshme, dhe trafiku midis VRF kalon p\u00ebrmes firewall-it, trafiku brenda nj\u00eb VRF kontrollohet nga ACL n\u00eb switch<\/li>\n<li>e gjith\u00eb trafiku reflektohet n\u00eb firewall p\u00ebr analiz\u00eb dhe monitorim, trafiku p\u00ebrmes tij nuk kalon<\/li>\n<\/ul>\n<p><\/p>\n<blockquote><p><b>Kujtes\u00eb 1<\/b><\/p>\n<p>Kombinimet e k\u00ebtyre mund\u00ebsive jan\u00eb t\u00eb mundshme, por p\u00ebr thjesht\u00ebsi nuk do t'i shqyrtojm\u00eb ato.<\/p><\/blockquote>\n<blockquote><p><b>V\u00ebrejtja 2<\/b><\/p>\n<p>Ka gjithashtu mund\u00ebsin\u00eb e p\u00ebrdorimit t\u00eb PBR (arkitektura e zinxhirit t\u00eb sh\u00ebrbimeve), por p\u00ebr momentin, ndon\u00ebse e bukur sipas mendimit tim, \u00ebsht\u00eb m\u00eb shum\u00eb nj\u00eb zgjidhje ekzotike, prandaj nuk e trajtoj k\u00ebtu.<\/p><\/blockquote>\n<p>\nNga p\u00ebrshkrimi i flukseve n\u00eb dokument, ne shohim se megjithat\u00eb, trafiku kalon p\u00ebrmes firewall-it, q\u00eb do t\u00eb thot\u00eb se, sipas dizajnit Cisco, mund\u00ebsia e kat\u00ebrt bie.<\/p>\n<p>Le t\u00eb shqyrtojm\u00eb fillimisht dy mund\u00ebsit\u00eb e para.<br \/>\nMe k\u00ebto mund\u00ebsi, e gjith\u00eb trafiku kalon p\u00ebrmes firewall-it.<\/p>\n<p>Tani shohim <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/products\/collateral\/security\/firepower-ngfw\/data_sheet-c78-736661.html\">flet\u00ebs s\u00eb t\u00eb dh\u00ebnave<\/a><\/noindex>, shohim <noindex><a rel=\"nofollow\" href=\"https:\/\/itprice.com\">Cisco GPL<\/a><\/noindex> dhe shohim se, n\u00ebse d\u00ebshirojm\u00eb t\u00eb kemi nj\u00eb band\u00eb totale p\u00ebr zyr\u00ebn ton\u00eb t\u00eb pakt\u00ebn rreth 10 - 20 gigabit, duhet t\u00eb blejm\u00eb versionin 4K.<\/p>\n<blockquote><p><b>V\u00ebrejtje<\/b><\/p>\n<p>Kur flas p\u00ebr band\u00ebn totale kam parasysh trafikun midis n\u00ebnrrjeteve (dhe jo brenda nj\u00eb vlan-i).<\/p><\/blockquote>\n<p>\nNga GPL shohim se p\u00ebr HA Bundle me Threat Defense \u00e7mimi varion n\u00eb var\u00ebsi t\u00eb modelit (4110 - 4150) nga ~0.5 - 2.5 milion dollar\u00eb.<\/p>\n<p>Pra, dizajni yn\u00eb fillon t\u00eb ngjaj\u00eb me shembullin e m\u00ebparsh\u00ebm.<\/p>\n<p>A do t\u00eb thot\u00eb kjo se ky dizajn \u00ebsht\u00eb i gabuar?<br \/>\nJo, nuk do t\u00eb thot\u00eb. Cisco ju ofron mbrojtjen maksimale t\u00eb mundshme bazuar n\u00eb linj\u00ebn e produkteve q\u00eb ata kan\u00eb. Por kjo nuk do t\u00eb thot\u00eb q\u00eb \u00ebsht\u00eb \"must-do\" p\u00ebr ju. <\/p>\n<p>N\u00eb thelb, kjo \u00ebsht\u00eb nj\u00eb pyetje e zakonshme q\u00eb paraqitet gjat\u00eb dizajnimit t\u00eb nj\u00eb zyre ose qend\u00ebr t\u00eb t\u00eb dh\u00ebnave, dhe kjo do t\u00eb thot\u00eb se duhet t\u00eb k\u00ebrkoni nj\u00eb kompromis. <\/p>\n<p>P\u00ebr shembull, t\u00eb mos lejoni t\u00eb gjith\u00eb trafikun t\u00eb kaloj\u00eb p\u00ebrmes firewall-it, dhe n\u00eb k\u00ebt\u00eb rast, mund\u00ebsia e tret\u00eb m\u00eb duket mjaft simpatike, ose (shih seksionin e m\u00ebparsh\u00ebm), ndoshta nuk ju nevojitet \"Threat Defense\" apo p\u00ebrgjith\u00ebsisht nuk ju nevojitet nj\u00eb firewall n\u00eb k\u00ebt\u00eb segment t\u00eb rrjetit, dhe \u00ebsht\u00eb e mjaftueshme t\u00eb kufizoheni me monitorimin pasiv duke p\u00ebrdorur zgjidhje t\u00eb paguara (t\u00eb lira) ose open source, ose ju nevojitet nj\u00eb firewall, por nga nj\u00eb shit\u00ebs tjet\u00ebr.<\/p>\n<p>N\u00eb p\u00ebrgjith\u00ebsi gjithmon\u00eb ka k\u00ebt\u00eb pasiguri dhe nuk ka nj\u00eb p\u00ebrgjigje t\u00eb qart\u00eb se cila zgjidhje \u00ebsht\u00eb m\u00eb e mira p\u00ebr ju.<br \/>\nKjo \u00ebsht\u00eb komplekse dhe bukuria e k\u00ebtij problemi.<br \/>\n<br \/>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/447610\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u044f\u0442\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb. \u0421\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u0441\u0442\u0430\u0442\u0435\u0439 \u0446\u0438\u043a\u043b\u0430 \u0438 \u0441\u0441\u044b\u043b\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0437\u0434\u0435\u0441\u044c. \u042d\u0442\u0430 \u0447\u0430\u0441\u0442\u044c \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u0430 Campus (Office) &amp; Remote access VPN \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0430\u043c. \u041c\u043e\u0436\u0435\u0442 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u044c\u0441\u044f, \u0447\u0442\u043e \u0434\u0438\u0437\u0430\u0439\u043d \u043e\u0444\u0438\u0441\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u2013 \u044d\u0442\u043e \u043f\u0440\u043e\u0441\u0442\u043e. \u0414\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e, \u0431\u0435\u0440\u0435\u043c L2\/L3 \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u044b, \u0441\u043e\u0435\u0434\u0438\u043d\u044f\u0435\u043c \u0438\u0445 \u043c\u0435\u0436\u0434\u0443 \u0441\u043e\u0431\u043e\u0439. \u0414\u0430\u043b\u0435\u0435, \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u0430\u0440\u043d\u0443\u044e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0443 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23359,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31395","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u044f\u0442\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb. \u0421\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u0441\u0442\u0430\u0442\u0435\u0439 \u0446\u0438\u043a\u043b\u0430 \u0438 \u0441\u0441\u044b\u043b\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0437\u0434\u0435\u0441\u044c. \u042d\u0442\u0430 \u0447\u0430\u0441\u0442\u044c \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u0430 Campus (Office) &amp; Remote access VPN \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0430\u043c. \u041c\u043e\u0436\u0435\u0442 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u044c\u0441\u044f, \u0447\u0442\u043e \u0434\u0438\u0437\u0430\u0439\u043d \u043e\u0444\u0438\u0441\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u2013 \u044d\u0442\u043e \u043f\u0440\u043e\u0441\u0442\u043e. \u0414\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e, \u0431\u0435\u0440\u0435\u043c L2\/L3 \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u044b, \u0441\u043e\u0435\u0434\u0438\u043d\u044f\u0435\u043c \u0438\u0445 \u043c\u0435\u0436\u0434\u0443 \u0441\u043e\u0431\u043e\u0439. \u0414\u0430\u043b\u0435\u0435, \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u0430\u0440\u043d\u0443\u044e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0443\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-tretya\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c. \u0413\u043b\u0430\u0432\u0430 \u0442\u0440\u0435\u0442\u044c\u044f. \u0421\u0435\u0442\u0435\u0432\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c. \u0427\u0430\u0441\u0442\u044c \u0442\u0440\u0435\u0442\u044c\u044f | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u044f\u0442\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb. \u0421\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u0441\u0442\u0430\u0442\u0435\u0439 \u0446\u0438\u043a\u043b\u0430 \u0438 \u0441\u0441\u044b\u043b\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0437\u0434\u0435\u0441\u044c. \u042d\u0442\u0430 \u0447\u0430\u0441\u0442\u044c \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u0430 Campus (Office) &amp; Remote access VPN \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0430\u043c. \u041c\u043e\u0436\u0435\u0442 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u044c\u0441\u044f, \u0447\u0442\u043e \u0434\u0438\u0437\u0430\u0439\u043d \u043e\u0444\u0438\u0441\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u2013 \u044d\u0442\u043e \u043f\u0440\u043e\u0441\u0442\u043e. \u0414\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e, \u0431\u0435\u0440\u0435\u043c L2\/L3 \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u044b, \u0441\u043e\u0435\u0434\u0438\u043d\u044f\u0435\u043c \u0438\u0445 \u043c\u0435\u0436\u0434\u0443 \u0441\u043e\u0431\u043e\u0439. \u0414\u0430\u043b\u0435\u0435, \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u0430\u0440\u043d\u0443\u044e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0443\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-tretya\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:41:01+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:41:01+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Si si merrni kontrollin mbi infrastruktur\u00ebn rrjetore. Kapitulli i tret\u00eb. Siguria e rrjetit. Pjesa e tret\u00eb | ProHoster","description":"Kyky \u00ebsht\u00eb artikulli i pest\u00eb n\u00eb ciklin e artikujve \"Si t\u00eb merrni n\u00ebn kontroll infrastruktur\u00ebn e rrjetit\". P\u00ebrmbajtja e t\u00eb gjith\u00eb artikujve t\u00eb ciklit dhe lidhjet mund t\u00eb gjenden k\u00ebtu. Ky pjes\u00eb do t\u00eb p\u00ebrqendrohet n\u00eb segmentet e VPN p\u00ebr Campus (Zyr\u00eb) &amp; Qasje t\u00eb Larg\u00ebt. Mund t\u00eb duket se dizajni i rrjetit t\u00eb zyr\u00ebs \u00ebsht\u00eb i thjesht\u00eb. N\u00eb t\u00eb v\u00ebrtet\u00eb, marrim switch-e L2\/L3, i lidhim mes tyre. M\u00eb pas, b\u00ebjm\u00eb nj\u00eb konfigurim elementar.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-tretya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c. \u0413\u043b\u0430\u0432\u0430 \u0442\u0440\u0435\u0442\u044c\u044f. \u0421\u0435\u0442\u0435\u0432\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c. \u0427\u0430\u0441\u0442\u044c \u0442\u0440\u0435\u0442\u044c\u044f | ProHoster","og:description":"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u044f\u0442\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb. \u0421\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u0441\u0442\u0430\u0442\u0435\u0439 \u0446\u0438\u043a\u043b\u0430 \u0438 \u0441\u0441\u044b\u043b\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0437\u0434\u0435\u0441\u044c. \u042d\u0442\u0430 \u0447\u0430\u0441\u0442\u044c \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u0430 Campus (Office) &amp; Remote access VPN \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0430\u043c. \u041c\u043e\u0436\u0435\u0442 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u044c\u0441\u044f, \u0447\u0442\u043e \u0434\u0438\u0437\u0430\u0439\u043d \u043e\u0444\u0438\u0441\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u2013 \u044d\u0442\u043e \u043f\u0440\u043e\u0441\u0442\u043e. \u0414\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e, \u0431\u0435\u0440\u0435\u043c L2\/L3 \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u044b, \u0441\u043e\u0435\u0434\u0438\u043d\u044f\u0435\u043c \u0438\u0445 \u043c\u0435\u0436\u0434\u0443 \u0441\u043e\u0431\u043e\u0439. \u0414\u0430\u043b\u0435\u0435, \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u0430\u0440\u043d\u0443\u044e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0443","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-tretya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:41:01+00:00","article:modified_time":"2019-10-31T18:41:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31395","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 05:58:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:17:26","updated":"2026-01-21 05:58:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/31395","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=31395"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/31395\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/23359"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=31395"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=31395"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=31395"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}