{"id":31395,"date":"2019-10-31T21:41:01","date_gmt":"2019-10-31T18:41:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-tretya\/"},"modified":"2019-10-31T21:41:01","modified_gmt":"2019-10-31T18:41:01","slug":"kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-tretya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-tretya","title":{"rendered":"Si t\u00eb merrni n\u00ebn kontroll infrastruktur\u00ebn rrjet\u00ebrore. Kapteri i tret\u00eb. Siguria rrjet\u00ebrore. Pjesa e tret\u00eb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><i>Ky artikull \u00ebsht\u00eb i pesti n\u00eb ciklin e artikujve \"Si t\u00eb merrni n\u00ebn kontroll infrastruktur\u00ebn e rrjetit\". P\u00ebrmbajtja e t\u00eb gjith\u00eb artikujve t\u00eb ciklit dhe lidhjet mund t\u00eb gjenden <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/447008\/\">k\u00ebtu<\/a><\/noindex><\/i>.<\/p>\n<p>Kjo pjes\u00eb do t'i kushtohet segmenteve Campus (Zyra) &amp; VPN p\u00ebr akses t\u00eb larg\u00ebt. <\/p>\n<p><img decoding=\"async\" alt=\"Si t\u00eb merrni n\u00ebn kontroll infrastruktur\u00ebn rrjet\u00ebrore. Kapteri i tret\u00eb. Siguria rrjet\u00ebrore. Pjesa e tret\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/c20ea5e670105b5bf9b655a97b82f62f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMund t\u00eb duket sikur dizajni i rrjetit t\u00eb zyr\u00ebs \u00ebsht\u00eb i thjesht\u00eb. <\/p>\n<p>N\u00eb t\u00eb v\u00ebrtet\u00eb, marrim switch-e L2\/L3, i lidhim ata me nj\u00ebri-tjetrin. M\u00eb pas, b\u00ebjm\u00eb konfigurimin elementar t\u00eb VLAN-eve, portave t\u00eb paracaktuar, aktivizojm\u00eb routing t\u00eb thjesht\u00eb, lidhemi me kontrollet WiFi, pika qasje, instalojm\u00eb dhe konfigurojm\u00eb ASA p\u00ebr akses t\u00eb larg\u00ebt, jemi t\u00eb k\u00ebnaqur q\u00eb gjith\u00e7ka funksionon. N\u00eb p\u00ebrgjith\u00ebsi, si\u00e7 kam shkruar n\u00eb nj\u00eb nga artikujt e m\u00ebparsh\u00ebm <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/434750\/\">artikull<\/a><\/noindex> t\u00eb k\u00ebtij cikli, t\u00eb projektojm\u00eb dhe konfigurimin e rrjetit t\u00eb zyr\u00ebs q\u00eb \"si\u00e7 duhet t\u00eb funksionoj\u00eb\", mund ta b\u00ebj\u00eb pothuajse \u00e7do student q\u00eb ka ndjekur (dhe ka m\u00ebsuar) dy semestra t\u00eb nj\u00eb kursi telekomunikacionesh.<\/p>\n<p>Por sa m\u00eb shum\u00eb t\u00eb m\u00ebsoni, aq m\u00eb pak e thjesht\u00eb duket kjo detyr\u00eb. Personalish, kjo tem\u00eb, tema e dizajnit t\u00eb rrjetit t\u00eb zyr\u00ebs, aspak nuk m\u00eb duket e leht\u00eb, dhe n\u00eb k\u00ebt\u00eb artikull do t\u00eb p\u00ebrpiqem t\u00eb shpjegoj pse.<\/p>\n<p>N\u00ebse e p\u00ebrmbledhim, duhet t\u00eb merret parasysh nj\u00eb num\u00ebr t\u00eb konsideruesh\u00ebm faktor\u00ebsh. Shpesh k\u00ebta faktor\u00eb ndodhen n\u00eb kontradikt\u00eb me nj\u00ebri-tjetrin dhe duhet t\u00eb k\u00ebrkoni nj\u00eb kompromis t\u00eb arsyesh\u00ebm. <br \/>\nKjo paqart\u00ebsi \u00ebsht\u00eb sfida kryesore. Pra, duke folur p\u00ebr sigurin\u00eb, kemi nj\u00eb trek\u00ebnd\u00ebsh me tre maja: siguria, komoditeti p\u00ebr punonj\u00ebsit, kostoja e zgjidhjes. <br \/>\nDhe \u00e7do her\u00eb na duhet t\u00eb k\u00ebrkojm\u00eb nj\u00eb kompromis midis k\u00ebtyre tre.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Arkitektura<\/h2>\n<p>\nSi nj\u00eb shembull arkitekture p\u00ebr k\u00ebto dy segmente, si\u00e7 e kam rekomanduar n\u00eb artikujt e m\u00ebparsh\u00ebm, sugjeroj <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/solutions\/Enterprise\/Security\/SAFE_RG\/SAFE_rg\/chap1.html\">Cisco SAFE<\/a><\/noindex> modelin: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/solutions\/Enterprise\/Security\/SAFE_RG\/SAFE_rg\/chap5.html#wpxref51616\">Enterprise Campus<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/solutions\/Enterprise\/Security\/SAFE_RG\/SAFE_rg\/chap6.html#wpxref74611\">Enterprise Internet Edge<\/a><\/noindex>.<\/p>\n<p>K\u00ebto jan\u00eb dokumente disi t\u00eb vjetruara. I sjell k\u00ebtu sepse schemat dhe qasja thelb\u00ebsore nuk kan\u00eb ndryshuar, por gjithsesi m\u00eb p\u00eblqen m\u00ebnyra se si jan\u00eb prezantuar m\u00eb shum\u00eb se n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/solutions\/enterprise\/design-zone-security\/landing_safe.html#~tab-architecture\">dokumentacionin e ri<\/a><\/noindex>.<\/p>\n<p>Pa ju d\u00ebshmuar t\u00eb p\u00ebrdorni zgjidhjet Cisco, un\u00eb megjithat\u00eb mendoj se \u00ebsht\u00eb e dobishme t\u00eb shqyrtoni me kujdes k\u00ebt\u00eb dizajn. <\/p>\n<p>Ky artikull, si zakonisht, s'do t\u00eb k\u00ebrkoj\u00eb n\u00eb asnj\u00eb m\u00ebnyr\u00eb p\u00ebrmbushjen e plot\u00eb, \u00ebsht\u00eb m\u00eb shum\u00eb nj\u00eb shtes\u00eb p\u00ebr k\u00ebt\u00eb informacion. <\/p>\n<p>N\u00eb fund t\u00eb artikullit, do t\u00eb analizojm\u00eb dizajnin Cisco SAFE p\u00ebr zyr\u00ebn nga pik\u00ebpamja e koncepteve t\u00eb paraqitura k\u00ebtu.<\/p>\n<h2>Parimet e p\u00ebrgjithshme<\/h2>\n<p>\nDizajni i rrjetit t\u00eb zyr\u00ebs, sigurisht, duhet t\u00eb plot\u00ebsoj\u00eb k\u00ebrkesat e p\u00ebrgjithshme q\u00eb jan\u00eb shqyrtuar <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/434750\/\">k\u00ebtu<\/a><\/noindex> n\u00eb kapitullin \"Kriteret e vler\u00ebsimit t\u00eb cil\u00ebsis\u00eb s\u00eb dizajnit\". P\u00ebrve\u00e7 \u00e7mimit dhe siguris\u00eb, t\u00eb cilat do t'i diskutojm\u00eb n\u00eb k\u00ebt\u00eb artikull, mbeten edhe tre kritere t\u00eb tjera q\u00eb duhet t\u00eb marrim parasysh gjat\u00eb projektimit (apo gjat\u00eb ndryshimeve):<\/p>\n<ul>\n<li>shkall\u00ebzueshm\u00ebria (scalability)<\/li>\n<li>p\u00ebrshtatshm\u00ebria n\u00eb menaxhim (manageability)<\/li>\n<li>disponueshm\u00ebria (availability)<\/li>\n<\/ul>\n<p>\nShum\u00eb nga ato q\u00eb u diskutuan p\u00ebr <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">qendrat e t\u00eb dh\u00ebnave<\/a><\/noindex> jan\u00eb po ashtu t\u00eb vlefshme p\u00ebr zyr\u00ebn. <\/p>\n<p>Megjithat\u00eb, segmenti i zyr\u00ebs ka specifik\u00ebn e tij, e cila \u00ebsht\u00eb kritike n\u00eb aspektin e siguris\u00eb. Thelbi i k\u00ebsaj specifike \u00ebsht\u00eb q\u00eb ky segment krijohet p\u00ebr t\u00eb ofruar sh\u00ebrbime rrjetore p\u00ebr punonj\u00ebsit (po ashtu edhe p\u00ebr partner\u00ebt dhe mysafir\u00ebt) e kompanis\u00eb, dhe, si pasoj\u00eb, n\u00eb nivelin m\u00eb t\u00eb lart\u00eb t\u00eb shqyrtimit t\u00eb problemit, kemi dy detyra:<\/p>\n<ul>\n<li>t\u00eb mbrojn\u00eb burimet e kompanis\u00eb nga veprime t\u00eb d\u00ebmshme q\u00eb mund t\u00eb vijn\u00eb nga punonj\u00ebsit (mysafir\u00ebt, partner\u00ebt) dhe nga softueri q\u00eb ata p\u00ebrdorin. Kjo p\u00ebrfshin gjithashtu mbrojtjen nga lidhjet e paautorizuara n\u00eb rrjet. <\/li>\n<li>t\u00eb mbrojn\u00eb sistemet dhe t\u00eb dh\u00ebnat e vet\u00eb p\u00ebrdoruesve.<\/li>\n<\/ul>\n<p>\nDhe kjo \u00ebsht\u00eb vet\u00ebm nj\u00ebra an\u00eb e problemit (m\u00eb sakt\u00eb, nj\u00eb maja e trek\u00ebnd\u00ebshit). N\u00eb an\u00ebn tjet\u00ebr \u00ebsht\u00eb komoditeti i p\u00ebrdoruesit dhe \u00e7mimi i zgjidhjeve q\u00eb aplikohet.<\/p>\n<p>Le t\u00eb fillojm\u00eb duke shqyrtuar se \u00e7far\u00eb pret p\u00ebrdoruesi nga nj\u00eb rrjet modern zyre. <\/p>\n<h2>Leht\u00ebsira<\/h2>\n<p>\nK\u00ebtu \u00ebsht\u00eb se si duket \"komforti rrjetor\" p\u00ebr p\u00ebrdoruesin e zyr\u00ebs:<\/p>\n<ul>\n<li>Mobiliteti<\/li>\n<li>Mund\u00ebsia p\u00ebr t\u00eb p\u00ebrdorur t\u00eb gjith\u00eb spektrin e pajisjeve dhe sistemeve operative t\u00eb njohura<\/li>\n<li>Qasja e leht\u00eb n\u00eb t\u00eb gjitha burimet e nevojshme t\u00eb kompanis\u00eb <\/li>\n<li>Disponueshm\u00ebria e burimeve t\u00eb internetit, duke p\u00ebrfshir\u00eb sh\u00ebrbime t\u00eb ndryshme n\u00eb re<\/li>\n<li>\"T\u00eb punoj\u00eb shpejt\" rrjeti<\/li>\n<\/ul>\n<p>\nK\u00ebto lidhen si me punonj\u00ebsit, ashtu edhe me mysafir\u00ebt (apo partner\u00ebt), dhe kjo tashm\u00eb \u00ebsht\u00eb nj\u00eb detyr\u00eb p\u00ebr inxhinier\u00ebt e kompanis\u00eb q\u00eb, n\u00eb baz\u00eb t\u00eb autorizimit, t\u00eb ndajn\u00eb qasjet p\u00ebr grupe t\u00eb ndryshme p\u00ebrdoruesish.<\/p>\n<p>Le t\u00eb shqyrtojm\u00eb pak m\u00eb shum\u00eb secilin nga k\u00ebto aspekte.<\/p>\n<h3>Mobiliteti<\/h3>\n<p>\nB\u00ebhet fjal\u00eb p\u00ebr mund\u00ebsin\u00eb p\u00ebr t\u00eb punuar dhe p\u00ebrdorur t\u00eb gjitha burimet e nevojshme t\u00eb kompanis\u00eb nga \u00e7do pik\u00eb t\u00eb bot\u00ebs (sigurisht, ku ka internet).<\/p>\n<p>Kjo \u00ebsht\u00eb gjithashtu e v\u00ebrtet\u00eb p\u00ebr zyr\u00ebn. \u00cbsht\u00eb e p\u00ebrshtatshme kur nga \u00e7do pik\u00eb e zyr\u00ebs keni mund\u00ebsin\u00eb t\u00eb vazhdoni t\u00eb punoni, p\u00ebr shembull, t\u00eb merrni email, t\u00eb komunikoni n\u00eb mesazherin korporativ, t\u00eb jeni t\u00eb disponuesh\u00ebm p\u00ebr nj\u00eb thirrje video, ... K\u00ebshtu, kjo ju lejon nga nj\u00ebra an\u00eb t\u00eb zgjidhni disa \u00e7\u00ebshtje p\u00ebrmes komunikimit \"n\u00eb jet\u00eb\" (p\u00ebr shembull, t\u00eb merrni pjes\u00eb n\u00eb takime), dhe nga ana tjet\u00ebr, t\u00eb jeni gjithmon\u00eb online, t\u00eb mbani dor\u00ebn mbi puls dhe t\u00eb zgjidhni shpejt disa detyra urgjente me prioritet t\u00eb lart\u00eb. Kjo \u00ebsht\u00eb shum\u00eb e p\u00ebrshtatshme dhe, v\u00ebrtet, p\u00ebrmir\u00ebson cil\u00ebsin\u00eb e komunikimeve.<\/p>\n<p>Kjo arrihet p\u00ebrmes dizajnit t\u00eb duhur t\u00eb rrjetit WiFi.<\/p>\n<blockquote><p><b>V\u00ebrejtje<\/b><\/p>\n<p>K\u00ebtu zakonisht lind pyetja, a mjafton t\u00eb p\u00ebrdoret vet\u00ebm WiFi? N\u00ebnkupton kjo se mund t\u00eb heqim dor\u00eb nga p\u00ebrdorimi i porteve Ethernet n\u00eb zyr\u00eb? N\u00ebse flasim vet\u00ebm p\u00ebr p\u00ebrdoruesit dhe jo p\u00ebr server\u00ebt, t\u00eb cil\u00ebt, megjithat\u00eb, \u00ebsht\u00eb e arsyeshme t'i lidhni me nj\u00eb port Ethernet t\u00eb zakonshme, p\u00ebrgjigjja e p\u00ebrgjithshme \u00ebsht\u00eb: po, mund t\u00eb kufizoheni vet\u00ebm n\u00eb WiFi. Por ka nuanca.<\/p>\n<p>Ka grupe t\u00eb r\u00ebnd\u00ebsishme p\u00ebrdoruesish q\u00eb k\u00ebrkojn\u00eb nj\u00eb qasje t\u00eb ve\u00e7ant\u00eb. K\u00ebta, sigurisht, jan\u00eb administrator\u00ebt. N\u00eb parim, lidhja WiFi \u00ebsht\u00eb m\u00eb pak e besueshme (nga pik\u00ebpamja e humbjes s\u00eb trafikut) dhe m\u00eb pak e shpejt\u00eb se nj\u00eb port Ethernet i zakonsh\u00ebm. Kjo mund t\u00eb jet\u00eb e r\u00ebnd\u00ebsishme p\u00ebr administrator\u00ebt. P\u00ebrve\u00e7 k\u00ebsaj, p\u00ebr administrator\u00ebt e rrjetit, p\u00ebr shembull, mund t\u00eb ket\u00eb nj\u00eb rrjet Ethernet t\u00eb dedikuar p\u00ebr lidhje jasht\u00eb brezit.<\/p>\n<p>Ndoshta, n\u00eb kompanin\u00eb tuaj ka n\u00eb dispozicion edhe grupe\/t\u00eb tjera departamentesh, p\u00ebr t\u00eb cilat k\u00ebto faktor\u00eb jan\u00eb gjithashtu t\u00eb r\u00ebnd\u00ebsishme.<\/p>\n<p>Ka nj\u00eb tjet\u00ebr moment t\u00eb r\u00ebnd\u00ebsish\u00ebm \u2013 telefonia. Ndoshta, p\u00ebr ndonj\u00eb arsye, nuk d\u00ebshironi t\u00eb p\u00ebrdorni Wireless VoIP dhe d\u00ebshironi t\u00eb p\u00ebrdorni telefonat IP me lidhje Ethernet t\u00eb zakonshme. <\/p>\n<p>N\u00eb p\u00ebrgjith\u00ebsi, n\u00eb ato kompani ku kam punuar, zakonisht kishte mund\u00ebsi si p\u00ebr lidhje WiFi, ashtu edhe p\u00ebr port Ethernet.<\/p><\/blockquote>\n<p>\nDo t\u00eb doja q\u00eb mobiliteti t\u00eb mos ishte i kufizuar vet\u00ebm n\u00eb zyr\u00eb.<\/p>\n<p>P\u00ebr t\u00eb siguruar mund\u00ebsin\u00eb e pun\u00ebs nga sht\u00ebpia (ose nga \u00e7do vend tjet\u00ebr me akses n\u00eb internet) p\u00ebrdoret lidhja VPN. N\u00eb k\u00ebt\u00eb rast, \u00ebsht\u00eb e d\u00ebshirueshme q\u00eb punonj\u00ebsit t\u00eb mos ndjejn\u00eb diferenc\u00ebn midis pun\u00ebs nga sht\u00ebpia dhe pun\u00ebs n\u00eb distanc\u00eb, gj\u00eb q\u00eb n\u00ebnkupton pranin\u00eb e aksesit t\u00eb nj\u00ebjt\u00eb. Si t\u00eb organizohet kjo do ta diskutojm\u00eb pak m\u00eb von\u00eb n\u00eb kapitullin \"Sistemi i centralizuar i autentifikimit dhe autorizimit\".<\/p>\n<blockquote><p><b>V\u00ebrejtje<\/b><\/p>\n<p>Mbasejsh\u00ebm, nuk do t\u00eb mund t\u00eb ofroni t\u00eb nj\u00ebjt\u00ebn cil\u00ebsi sh\u00ebrbimesh p\u00ebr pun\u00eb t\u00eb larg\u00ebt si\u00e7 keni n\u00eb zyr\u00eb. Le t\u00eb supozojm\u00eb se si nj\u00eb kalim VPN p\u00ebrdorni Cisco ASA 5520. Sipas <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/products\/security\/asa-5500-series-next-generation-firewalls\/data_sheet_c78-345385.html\">flet\u00ebs s\u00eb t\u00eb dh\u00ebnave<\/a><\/noindex> ky pajisje \u00ebsht\u00eb e aft\u00eb t\u00eb \"p\u00ebrpunoj\u00eb\" vet\u00ebm 225 Mbit trafik VPN. K\u00ebshtu q\u00eb, natyrisht, nga perspektiva e kapacitetit, lidhja p\u00ebrmes VPN ndjesh\u00ebm ndryshon nga puna nga zyra. Gjithashtu, n\u00ebse, p\u00ebr ndonj\u00eb arsye, vonesa, humbje, jitter (p\u00ebr shembull, n\u00ebse d\u00ebshironi t\u00eb p\u00ebrdorni telefonin\u00eb IP t\u00eb zyr\u00ebs) p\u00ebr sh\u00ebrbimet tuaja t\u00eb rrjetit jan\u00eb t\u00eb r\u00ebnd\u00ebsishme, nuk do t\u00eb merrni at\u00eb cil\u00ebsin\u00eb si\u00e7 do t\u00eb kishit n\u00eb zyr\u00eb. Prandaj, duke folur p\u00ebr l\u00ebvizshm\u00ebrin\u00eb, ne duhet t\u00eb kujtojm\u00eb kufizimet e mundshme.<\/p><\/blockquote>\n<p><\/p>\n<h3>Qasje e leht\u00eb n\u00eb t\u00eb gjitha burimet e kompanis\u00eb<\/h3>\n<p>\nKy problem duhet t\u00eb adresohet n\u00eb m\u00ebnyr\u00eb t\u00eb p\u00ebrbashk\u00ebt me departamentet e tjera teknike.<br \/>\nSituata ideale \u00ebsht\u00eb kur p\u00ebrdoruesi duhet t\u00eb identifikohet vet\u00ebm nj\u00eb her\u00eb dhe pas k\u00ebsaj ai merr akses n\u00eb t\u00eb gjitha burimet e nevojshme.<br \/>\nOfrimi i qasjes s\u00eb leht\u00eb pa comprometuara sigurin\u00eb mund t\u00eb rris\u00eb ndjesh\u00ebm efikasitetin e pun\u00ebs dhe t\u00eb ul\u00eb nivelin e stresit t\u00eb koleg\u00ebve tuaj.<\/p>\n<blockquote><p><b>Sh\u00ebnim 1<\/b><\/p>\n<p>Leht\u00ebsia e qasjes nuk ka t\u00eb b\u00ebj\u00eb vet\u00ebm me sa her\u00eb duhet t\u00eb futni fjal\u00ebkalimin. N\u00ebse, p\u00ebr shembull, sipas politik\u00ebs tuaj t\u00eb siguris\u00eb, p\u00ebr t'u lidhur nga zyrat n\u00eb qendr\u00ebn e t\u00eb dh\u00ebnave duhet s\u00eb pari t\u00eb lidheni me nj\u00eb kalim VPN dhe n\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb humbni qasjen n\u00eb burimet e zyr\u00ebs, at\u00ebher\u00eb kjo \u00ebsht\u00eb gjithashtu shum\u00eb e, shum\u00eb e pak\u00ebndshme.\n<\/p><\/blockquote>\n<blockquote><p><b>Sh\u00ebnim 2<\/b><\/p>\n<p>Ekzistojn\u00eb sh\u00ebrbime (p\u00ebr shembull, akses n\u00eb pajisjet e rrjetit), ku zakonisht kemi servera t\u00eb dedikuar AAA dhe \u00ebsht\u00eb standard q\u00eb n\u00eb k\u00ebt\u00eb rast t\u00eb nevojitet t\u00eb identifikohesh disa her\u00eb.\n<\/p><\/blockquote>\n<p><\/p>\n<h3>Disponueshm\u00ebria e burimeve internet<\/h3>\n<p>\nInternet \u00ebsht\u00eb jo vet\u00ebm arg\u00ebtim, por gjithashtu nj\u00eb grup sh\u00ebrbimesh q\u00eb mund t\u00eb jet\u00eb shum\u00eb e dobishme p\u00ebr pun\u00eb. Ka gjithashtu faktor\u00eb t\u00eb past\u00ebr psikologjik. Njeriu modern \u00ebsht\u00eb lidhur me shum\u00eb njer\u00ebz p\u00ebrmes internetit me shum\u00eb fij\u00eb virtuale dhe, sipas mendimit tim, nuk ka asgj\u00eb t\u00eb keqe n\u00ebse ai vazhdon t\u00eb ndiej\u00eb k\u00ebt\u00eb lidhje edhe gjat\u00eb pun\u00ebs.<\/p>\n<p>Nga perspektiva e humbjes s\u00eb koh\u00ebs, nuk ka asgj\u00eb shqet\u00ebsuese n\u00ebse nj\u00eb punonj\u00ebs, p\u00ebr shembull, ka hapur Skype dhe ai kalon 5 minuta p\u00ebr t\u00eb biseduar me nj\u00eb person t\u00eb af\u00ebrt n\u00eb rast nevoje.<\/p>\n<p>A do this mean that the internet should always be accessible, does it mean that employees can access all resources without any control?<\/p>\n<p>No, it certainly doesn't. The level of internet openness can vary for different companies \u2013 from complete closure to full openness. We will discuss the ways to control traffic later in the sections dedicated to security tools. <\/p>\n<h3>The ability to use the full range of familiar devices<\/h3>\n<p>\nIt's convenient when you, for example, have the ability to continue using all the communication tools you're accustomed to at work. It's not technically complicated to implement this. You need WiFi and a guest VLAN for that.<\/p>\n<p>It's also good if you can use the operating system you're accustomed to. However, in my observation, this is usually only allowed for managers, administrators, and developers. <\/p>\n<blockquote><p><b>Shembulli<\/b><\/p>\n<p>Of course, one could go the route of prohibitions, banning remote access, prohibiting connections from mobile devices, limiting everything to static Ethernet connections, restricting internet access, and necessarily confiscating mobile phones and gadgets at the entrance... and indeed, some organizations with heightened security requirements take this approach, which may be justified in certain cases, but... let's agree, it looks like an attempt to stop progress in a given organization. Certainly, it would be desirable to combine the opportunities that modern technologies offer with an adequate level of security.<\/p><\/blockquote>\n<p><\/p>\n<h3>\"T\u00eb punoj\u00eb shpejt\" rrjeti<\/h3>\n<p>\nData transmission speed technically consists of many factors. And the speed of your connection port is usually not the most important one. Slow application performance is not always related to network problems, but we are currently interested only in the network part. The most common issue of local network \"slowing down\" is related to packet loss. This usually occurs with a bottleneck effect or L1 (OSI) problems. Less commonly, in certain designs (for example, when the default gateways in your subnets are firewalls and thus all traffic goes through them), performance may be insufficient. <\/p>\n<p>Prandaj, kur zgjidhni pajisjet dhe arkitektur\u00ebn, duhet t\u00eb lidhni shpejt\u00ebsit\u00eb e porteve p\u00ebrfundimtare, trar\u00ebt dhe performanc\u00ebn e pajisjeve.<\/p>\n<blockquote><p><b>Shembulli<\/b><\/p>\n<p>Supozoni se po p\u00ebrdorni si nd\u00ebrprer\u00ebs nivelin e aksesit me nd\u00ebrprer\u00ebs me porte 1 gigabit. Ata jan\u00eb t\u00eb lidhur me nj\u00ebri-tjetrin p\u00ebrmes Etherchannel 2 x 10 gigabit. Si nyje e paracaktuar p\u00ebrdorni nj\u00eb firewall me porte gigabit, p\u00ebr t\u00eb cilin n\u00eb rrjetin L2 t\u00eb zyr\u00ebs e lidhni me 2 porte gigabit, t\u00eb kombinuara n\u00eb Etherchannel. <\/p>\n<p>Kjo arkitektur\u00eb \u00ebsht\u00eb mjaft e p\u00ebrshtatshme n\u00eb aspektin e funksionalitetit, pasi e gjith\u00eb trafiku kalon p\u00ebrmes firewall-it, dhe mund t\u00eb menaxhoni rehat politik\u00ebn e qasjes dhe t\u00eb aplikoni algoritme t\u00eb nd\u00ebrlikuara p\u00ebr kontrollin e trafikut dhe parandalimin e sulmeve t\u00eb mundshme (shih m\u00eb posht\u00eb), por n\u00eb aspektin e kapacitetit dhe performanc\u00ebs, ky dizajn ka probleme potenciale. P\u00ebr shembull, 2 hoste q\u00eb shkarkojn\u00eb t\u00eb dh\u00ebna (me shpejt\u00ebsin\u00eb e portit 1 gigabit) mund t\u00eb ngarkojn\u00eb plot\u00ebsisht nj\u00eb lidhje 2 gigabit me firewall-in dhe k\u00ebshtu t\u00eb sjellin degradimin e sh\u00ebrbimit p\u00ebr t\u00eb gjith\u00eb segmentin zyrar.<\/p><\/blockquote>\n<p>\nKemi shqyrtuar nj\u00eb pik\u00eb t\u00eb trek\u00ebnd\u00ebshit, tani le t\u00eb shohim se si mund t\u00eb sigurojm\u00eb sigurin\u00eb.<\/p>\n<h2>Mjetet e mbrojtjes<\/h2>\n<p>\nPra, padyshim, zakonisht d\u00ebshira jon\u00eb (n\u00eb fakt, d\u00ebshira e menaxhmentit ton\u00eb) \u00ebsht\u00eb t\u00eb arrijm\u00eb t\u00eb pamundur\u00ebn, dometh\u00ebn\u00eb, t\u00eb ofrojm\u00eb maksimumin e komoditetit me maksimumin e siguris\u00eb dhe minimalin e \u00e7mimit.<\/p>\n<p>Le t\u00eb shqyrtojm\u00eb se cilat metoda kemi p\u00ebr ofrimin e mbrojtjes.<\/p>\n<p>P\u00ebr zyr\u00ebn do t\u00eb ve\u00e7oja k\u00ebto:<\/p>\n<ul>\n<li>qasje zero trust n\u00eb dizajn<\/li>\n<li>nivel i lart\u00eb mbrojtjeje <\/li>\n<li>sh\u00ebmb\u00eblltyra e rrjetit<\/li>\n<li>nj\u00eb sistem unik dhe t\u00eb centralizuar t\u00eb autentifikimit dhe autorizimit<\/li>\n<li>kontrolli i hostit (host checking) <\/li>\n<\/ul>\n<p>\nTani do t\u00eb ndalemi pak m\u00eb shum\u00eb n\u00eb secilin nga k\u00ebto aspekte.<\/p>\n<h3>Besimi Zero<\/h3>\n<p>\nBota e IT po ndryshon shum\u00eb shpejt. N\u00eb vet\u00ebm 10 vitet e fundit, shfaqja e teknologjive dhe produkteve t\u00eb reja ka sjell\u00eb nj\u00eb rishikim t\u00eb r\u00ebnd\u00ebsish\u00ebm t\u00eb koncepteve t\u00eb siguris\u00eb. Dhjet\u00eb vjet m\u00eb par\u00eb, nga pik\u00ebpamja e siguris\u00eb, ne segmentonim rrjetin n\u00eb zona besimi, dmz dhe zona t\u00eb pabesueshme, dhe aplikohej ajo q\u00eb quhej \"mbrojtja p\u00ebr rreth\", e cila kishte dy linja mbrojtjeje: zona e pabesueshme -&gt; dmz dhe dmz -&gt; zona e besueshme. Po ashtu, mbrojtja zakonisht kufizohej n\u00eb listat e qasjeve t\u00eb bazuara n\u00eb titujt L3\/L4 (OSI) (IP, porta TCP\/UDP, flamuj TCP). \u00c7far\u00ebdo q\u00eb kishte t\u00eb b\u00ebnte me nivele m\u00eb t\u00eb larta, p\u00ebrfshir\u00eb L7, i jepej vet\u00ebm sistemit operativ dhe produkteve t\u00eb mbrojtjes t\u00eb vendosura n\u00eb hostet p\u00ebrfundimtare.<\/p>\n<p>Tani situata \u00ebsht\u00eb ndryshuar radikalisht. Koncepti modern <noindex><a rel=\"nofollow\" href=\"https:\/\/doubleoctopus.com\/security-wiki\/network-architecture\/zero-trust\/\">zero trust<\/a><\/noindex> pranon se nuk \u00ebsht\u00eb m\u00eb e mundur t\u00eb konsiderohen sistemet brenda, dmth ato q\u00eb ndodhen brenda rrethit, si t\u00eb besueshme, dhe vet\u00eb koncepti i rrethit \u00ebsht\u00eb b\u00ebr\u00eb i paqart\u00eb.<br \/>\nP\u00ebrve\u00e7 lidhjes me internetin, ne gjithashtu kemi<\/p>\n<ul>\n<li>remote access VPN t\u00eb p\u00ebrdoruesve<\/li>\n<li>gadgetet personale t\u00eb ndryshme, laptop\u00ebt e sjell\u00eb, t\u00eb lidhur p\u00ebrmes WiFi t\u00eb zyr\u00ebs<\/li>\n<li>zyra t\u00eb tjera (branch)<\/li>\n<li>integrimin me infrastruktur\u00ebn cloud <\/li>\n<\/ul>\n<p>\nSi duket qasja Zero Trust n\u00eb praktik\u00eb?<\/p>\n<p>N\u00eb ideal, lejohet vet\u00ebm trafiku q\u00eb k\u00ebrkohet dhe, n\u00ebse flasim p\u00ebr idealin, kontrolli duhet t\u00eb jet\u00eb jo vet\u00ebm n\u00eb nivelin L3\/L4, por edhe n\u00eb nivelin e aplikacionit. <\/p>\n<p>N\u00ebse, p\u00ebr shembull, keni mund\u00ebsin\u00eb t\u00eb kaloni gjith\u00eb trafikun p\u00ebrmes nj\u00eb firewall-i, at\u00ebher\u00eb mund t\u00eb p\u00ebrpiqeni t\u00eb afroheni me idealin. Por ky qasje mund t\u00eb zvog\u00ebloj\u00eb ndjesh\u00ebm band\u00ebn totale t\u00eb l\u00ebn\u00eb t\u00eb rrjetit tuaj, dhe p\u00ebr m\u00eb tep\u00ebr, filtrimi n\u00eb nivel aplikacioni nuk funksionon gjithmon\u00eb mir\u00eb.<\/p>\n<p>N\u00eb kontrollin e trafikut n\u00eb rrug\u00eb apo n\u00eb nj\u00eb kalues L3 (p\u00ebrdorimi i ACL standarde) p\u00ebrballeni me probleme t\u00eb tjera:<\/p>\n<ul>\n<li>kjo \u00ebsht\u00eb vet\u00ebm filtrimi L3\/L4. Asgj\u00eb nuk i pengon sulmuesit t\u00eb p\u00ebrdorin portat e lejuara (p.sh., TCP 80) p\u00ebr aplikacionin e tij (jo http)<\/li>\n<li>menaxhimi kompleks i ACL (e v\u00ebshtir\u00eb p\u00ebr t'u analizuar ACL)<\/li>\n<li>kjo nuk \u00ebsht\u00eb nj\u00eb firewall stateful, dmth ju duhet t\u00eb lejoni n\u00eb m\u00ebnyr\u00eb t\u00eb qart\u00eb trafikun e prapambetur<\/li>\n<li>n\u00eb rastin e kaluesve zakonisht jeni mjaft t\u00eb kufizuar nga madh\u00ebsia e TCAM, q\u00eb n\u00eb rastin e aplikimit t\u00eb qasjes \"lejo vet\u00ebm at\u00eb q\u00eb nevojitet\" mund t\u00eb b\u00ebhet shpejt nj\u00eb problem<\/li>\n<\/ul>\n<p><\/p>\n<blockquote><p><b>V\u00ebrejtje<\/b><\/p>\n<p>Duke folur p\u00ebr trafikun e prapambetur, duhet t\u00eb mbajm\u00eb mend se kemi mund\u00ebsin\u00eb n\u00eb vijim (Cisco) <\/p>\n<p>lejo tcp \u00e7do \u00e7do t\u00eb krijuar<\/p>\n<p>Poroshe t\u00eb kuptojm\u00eb q\u00eb kjo linj\u00eb \u00ebsht\u00eb ekuivalente me dy linja:<br \/>\nlejo tcp \u00e7do \u00e7do ack<br \/>\nlejo tcp \u00e7do \u00e7do rst<\/p>\n<p>Kjo do t\u00eb thot\u00eb se edhe n\u00ebse nuk ka pasur nj\u00eb segment fillestar TCP me flamurin SYN (pra, seanca TCP as q\u00eb ka filluar t\u00eb vendoset), ky ACL do t\u00eb lejoj\u00eb paket\u00ebn me flamurin ACK, q\u00eb nj\u00eb sulmues mund ta p\u00ebrdor\u00eb p\u00ebr t\u00eb transferuar t\u00eb dh\u00ebna.<\/p>\n<p>Pra, kjo linj\u00eb nuk e kthen asnj\u00ebher\u00eb router-in tuaj ose switch-in L3 n\u00eb nj\u00eb firewall stateful.<\/p><\/blockquote>\n<p><\/p>\n<h3>Nj\u00eb nivel i lart\u00eb mbrojtjeje<\/h3>\n<p>\nN\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">artikulli yn\u00eb<\/a><\/noindex> N\u00eb seksionin q\u00eb i kushtohet qendrave t\u00eb t\u00eb dh\u00ebnave, ne kemi shqyrtuar m\u00ebnyra t\u00eb ndryshme mbrojtjeje.<\/p>\n<ul>\n<li>firewall stateful (n\u00eb m\u00ebnyr\u00eb t\u00eb paracaktuar)<\/li>\n<li>mbrojtje ddos\/dos<\/li>\n<li>firewall aplikacioni<\/li>\n<li>parandalimi i k\u00ebrc\u00ebnimeve (antivirus, anti-spyware dhe dob\u00ebsi)<\/li>\n<li>filtrimi i URL-ve<\/li>\n<li>filtrimi i t\u00eb dh\u00ebnave (filtrimi i p\u00ebrmbajtjes)<\/li>\n<li>bllokimi i skedar\u00ebve (bllokimi i llojeve t\u00eb skedar\u00ebve)<\/li>\n<\/ul>\n<p>\nN\u00eb rastin e zyrave, situata \u00ebsht\u00eb e ngjashme, por prioritetet jan\u00eb pak m\u00eb ndryshe. Disponueshm\u00ebria e zyrave (disponueshm\u00ebria) zakonisht nuk \u00ebsht\u00eb aq kritike sa n\u00eb rastin e nj\u00eb qendre t\u00eb t\u00eb dh\u00ebnave, megjithat\u00eb, probabiliteti i trafikut t\u00eb d\u00ebmsh\u00ebm \"t\u00eb brendsh\u00ebm\" \u00ebsht\u00eb shum\u00eb m\u00eb i lart\u00eb. <br \/>\nPrandaj, metodat e m\u00ebposhtme t\u00eb mbrojtjes p\u00ebr k\u00ebt\u00eb segment b\u00ebhen kritike:<\/p>\n<ul>\n<li>firewall aplikacioni<\/li>\n<li>parandalimi i k\u00ebrc\u00ebnimeve (anti-virus, anti-spyware dhe dob\u00ebsi)<\/li>\n<li>filtrimi i URL-ve<\/li>\n<li>filtrimi i t\u00eb dh\u00ebnave (filtrimi i p\u00ebrmbajtjes)<\/li>\n<li>bllokimi i skedar\u00ebve (bllokimi i llojeve t\u00eb skedar\u00ebve)<\/li>\n<\/ul>\n<p>\nMegjith\u00ebse t\u00eb gjitha k\u00ebto metoda mbrojtjeje, p\u00ebrve\u00e7 firewall-it t\u00eb aplikacioneve, tradicionalisht jan\u00eb zgjidhur dhe vazhdojn\u00eb t\u00eb zgjidhen n\u00eb hostet p\u00ebrfundimtare (p\u00ebr shembull, p\u00ebrmes instalimit t\u00eb programeve antivirus) dhe p\u00ebrmes proxy, NGFW moderne gjithashtu ofrojn\u00eb k\u00ebto sh\u00ebrbime. <\/p>\n<p>Krijuesit e pajisjeve t\u00eb sigurimit synojn\u00eb t\u00eb create nj\u00eb mbrojtje t\u00eb integruar, prandaj, p\u00ebrve\u00e7 mbrojtjes n\u00eb kutin\u00eb lokale, ofrohen teknologji t\u00eb ndryshme cloud dhe software klienti p\u00ebr hostet (mbrojtja e pikave p\u00ebrfundimtare\/EPP). k\u00ebshtu, p\u00ebr shembull, nga <noindex><a rel=\"nofollow\" href=\"https:\/\/www.fairline.com.tw\/data\/editor\/files\/01%20%20Gartner%20-%20Magic%20Quad%20-%20Endpoint%20Protection%20Platforms%201-2018.pdf\">Magical Quadrant i Gartner-it (Gartner Magic Quadrant) p\u00ebr vitin 2018<\/a><\/noindex> shohim se Palo Alto dhe Cisco kan\u00eb EPP t\u00eb tyre (PA: Traps, Cisco: AMP), por nuk jan\u00eb shum\u00eb n\u00eb krye.<\/p>\n<p>Aktivizimi i k\u00ebtyre mbrojtjeve (zakonisht p\u00ebrmes blerjes s\u00eb licencave) n\u00eb firewall, natyrisht, nuk \u00ebsht\u00eb i detyruesh\u00ebm (mund t\u00eb ndiqni rrug\u00ebn tradicionale), por ofron disa p\u00ebrpar\u00ebsi:<\/p>\n<ul>\n<li>n\u00eb k\u00ebt\u00eb rast, krijohet nj\u00eb pik\u00eb e vetme e aplikimit t\u00eb metodave t\u00eb mbrojtjes, e cila p\u00ebrmir\u00ebson visibility (shihni tem\u00ebn tjet\u00ebr). <\/li>\n<li>n\u00ebse n\u00eb rrjetin tuaj ka nj\u00eb pajisje t\u00eb pasigurt, ajo prap\u00eb do t\u00eb jet\u00eb n\u00ebn \"mburoj\u00ebn\" e mbrojtjes s\u00eb firewall-it.<\/li>\n<li> Duke p\u00ebrdorimit t\u00eb mbrojtjes n\u00eb firewall n\u00eb bashk\u00ebpunim me mbrojtjen n\u00eb hostet p\u00ebrfundimtar\u00eb, ne rrisim mund\u00ebsin\u00eb e zbulimit t\u00eb trafikut t\u00eb d\u00ebmsh\u00ebm. P\u00ebr shembull, p\u00ebrdorimi i parandalimit t\u00eb k\u00ebrc\u00ebnimeve n\u00eb hostet lokale dhe n\u00eb firewall rrit mund\u00ebsin\u00eb e zbulimit (me kushte, sigurisht, q\u00eb k\u00ebto zgjidhje bazohen n\u00eb produkte t\u00eb ndryshme software).<\/li>\n<\/ul>\n<blockquote><p><b>V\u00ebrejtje<\/b><\/p>\n<p>N\u00ebse, p\u00ebr shembull, p\u00ebrdorni Kaspersky si antivirus si n\u00eb firewall ashtu edhe n\u00eb hostet p\u00ebrfundimtar\u00eb, at\u00ebher\u00eb \u00ebsht\u00eb e qart\u00eb se kjo nuk do ta rris\u00eb shum\u00eb mund\u00ebsin\u00eb tuaj p\u00ebr t\u00eb parandalua nj\u00eb sulm virus n\u00eb rrjetin tuaj.<\/p><\/blockquote>\n<p><\/p>\n<h3>Shikueshm\u00ebria e rrjetit<\/h3>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/blog.gigamon.com\/2017\/11\/01\/what-is-network-visibility\/\">Ideja kryesore<\/a><\/noindex> \u00ebsht\u00eb e thjesht\u00eb \u2013 \"t\u00eb shoh\u00ebsh\" se \u00e7far\u00eb po ndodh n\u00eb rrjetin t\u00ebnd, si n\u00eb koh\u00eb reale ashtu edhe t\u00eb dh\u00ebnat historike. <\/p>\n<p>Do ta ndaja k\u00ebt\u00eb \"shikim\" n\u00eb dy grupe:<\/p>\n<p><b>Grupi i par\u00eb:<\/b> \u00e7far\u00eb zakonisht ju ofron sistemi juaj i monitorimit.<\/p>\n<ul>\n<li>ngarkesa e pajisjeve<\/li>\n<li>ngarkesa e kanaleve<\/li>\n<li>p\u00ebrdorimi i memories<\/li>\n<li>p\u00ebrdorimi i disqeve<\/li>\n<li>ndryshimi i tabel\u00ebs s\u00eb rrug\u00ebs <\/li>\n<li>gjendja e lidhjeve<\/li>\n<li>disponibiliteti i pajisjeve (ose hosteve)<\/li>\n<li>\u2026<\/li>\n<\/ul>\n<p><b>Grupi i dyt\u00eb: <\/b>informacione t\u00eb lidhura me sigurin\u00eb.<\/p>\n<ul>\n<li>statistika t\u00eb ndryshme (p\u00ebr shembuj, p\u00ebr aplikacionet, p\u00ebr frekuenc\u00ebn e URL-ve, \u00e7far\u00eb lloj t\u00eb dh\u00ebnash jan\u00eb shkarkuar, t\u00eb dh\u00ebna p\u00ebr p\u00ebrdoruesit)<\/li>\n<li>\u00e7far\u00eb u bllokua nga politikat e siguris\u00eb dhe p\u00ebr \u00e7far\u00eb arsyeje, pra\n<ul>\n<li>aplikacione t\u00eb ndaluara<\/li>\n<li>e bllokuar n\u00eb baz\u00eb t\u00eb ip\/protokoll\/port\/flags\/zona<\/li>\n<li>parandalimi i k\u00ebrc\u00ebnimeve<\/li>\n<li>filtrimi i URL-ve<\/li>\n<li>filtrimi i t\u00eb dh\u00ebnave<\/li>\n<li>bllokimi i skedar\u00ebve<\/li>\n<li>\u2026<\/li>\n<\/ul>\n<\/li>\n<li>statistika p\u00ebr sulmet DOS\/DDOS<\/li>\n<li>p\u00ebrpjekjet e d\u00ebshtuara p\u00ebr identifikim dhe autorizim<\/li>\n<li>statistika p\u00ebr t\u00eb gjitha ngjarjet e m\u00ebsip\u00ebrme t\u00eb shkeljes s\u00eb politikave t\u00eb siguris\u00eb<\/li>\n<li>\u2026<\/li>\n<\/ul>\n<p>\nN\u00eb k\u00ebt\u00eb kapitull, q\u00eb i kushtohet siguris\u00eb, na intereson pik\u00ebrisht pjesa e dyt\u00eb.<\/p>\n<p>Disa firewall-e moderne (nga praktika ime, Palo Alto) ofrojn\u00eb nj\u00eb nivel t\u00eb mir\u00eb t\u00eb shikueshm\u00ebris\u00eb. Por, sigurisht, trafiku q\u00eb ju intereson duhet t\u00eb kaloj\u00eb p\u00ebrmes k\u00ebtij firewall-i (n\u00eb k\u00ebt\u00eb rast keni mund\u00ebsin\u00eb t\u00eb bllokoni trafikun) ose t\u00eb pasqyrohet n\u00eb firewall (p\u00ebrdoret vet\u00ebm p\u00ebr monitorim dhe analiz\u00eb), dhe duhet t\u00eb keni licencat q\u00eb lejojn\u00eb aktivizimin e t\u00eb gjitha k\u00ebtyre sh\u00ebrbimeve.<\/p>\n<p>Ka, sigurisht, dhe nj\u00eb rrug\u00eb alternative, ose m\u00eb sakt\u00eb nj\u00eb rrug\u00eb tradicionale, p\u00ebr shembull,<\/p>\n<ul>\n<li>statistik\u00ebn p\u00ebr sesionet mund t\u00eb mblidhet p\u00ebrmes netflow dhe pastaj t\u00eb p\u00ebrdoren mjete speciale p\u00ebr analizimin e informacionit dhe vizualizimin e t\u00eb dh\u00ebnave.<\/li>\n<li>parandalimi i k\u00ebrc\u00ebnimeve \u2013 programe speciale (anti-virus, anti-spyware, firewall) n\u00eb hostet p\u00ebrfundimtar\u00eb.<\/li>\n<li>Filtrimi i URL-ve, filtrimi i t\u00eb dh\u00ebnave, bllokimi i skedar\u00ebve \u2013 n\u00eb proxy<\/li>\n<li>mund t\u00eb analizoni gjithashtu tcpdump me ndihm\u00ebn e, p\u00ebr shembull, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/268207\/\">snort<\/a><\/noindex><\/li>\n<\/ul>\n<p>\nMund t\u00eb kombinoni k\u00ebto dy qasje, duke plot\u00ebsuar funksionet q\u00eb mungojn\u00eb ose duke i dyfishuar ato p\u00ebr t\u00eb rritur gjasat e zbules\u00ebs s\u00eb sulmit.<\/p>\n<p>Cila qasje duhet t\u00eb zgjidhni?<br \/>\nShum\u00eb varet nga kualifikimi dhe preferencat e ekipit tuaj.<br \/>\nN\u00eb t\u00eb dyja raste ka p\u00ebrpar\u00ebsi dhe disfat.<\/p>\n<h3>Nj\u00eb sistem i centralizuar p\u00ebr autentikimin dhe autorizimin<br \/>\n<\/h3>\n<p>\nMe nj\u00eb dizajn t\u00eb mir\u00eb, l\u00ebvizshm\u00ebria q\u00eb ne diskutonim n\u00eb k\u00ebt\u00eb artikull n\u00ebnkupton se keni t\u00eb nj\u00ebjtat t\u00eb drejta duke punuar nga zyra ose nga sht\u00ebpia, nga aeroporti, nga nj\u00eb kafene ose nga ndonj\u00eb pik\u00eb tjet\u00ebr (me kufizimet q\u00eb ne diskutuam m\u00eb sip\u00ebr). Si duket, ku \u00ebsht\u00eb problemi? <br \/>\nP\u00ebr t\u00eb kuptuar m\u00eb mir\u00eb kompleksitetin e k\u00ebtij detyre, le t\u00eb shqyrtojm\u00eb nj\u00eb dizajn tipik.<\/p>\n<blockquote><p><b>Shembulli<\/b><\/p>\n<ul>\n<li>Keni ndar\u00eb t\u00eb gjith\u00eb punonj\u00ebsit n\u00eb grupe. Keni vendosur t\u00eb jepni qasje sipas grupeve<\/li>\n<li>Brenda zyr\u00ebs kontrolloni qasjet n\u00eb firewall-in e zyr\u00ebs<\/li>\n<li>Trafiku nga zyra n\u00eb qendr\u00ebn e t\u00eb dh\u00ebnave e kontrolloni n\u00eb firewall-in e qendr\u00ebs s\u00eb t\u00eb dh\u00ebnave<\/li>\n<li>Si VPN ju p\u00ebrdorni Cisco ASA dhe p\u00ebr kontrollin e trafik\u00ebve q\u00eb hyjn\u00eb n\u00eb rrjetin tuaj nga klient\u00ebt e dedikuar, aplikoni ACL lokale (n\u00eb ASA)<\/li>\n<\/ul>\n<p>\nTani, le t\u00eb supozojm\u00eb se ju k\u00ebrkohet t\u00eb shtoni qasje t\u00eb m\u00ebtejshme p\u00ebr nj\u00eb punonj\u00ebs t\u00eb caktuar. N\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb, ju k\u00ebrkohet t\u00eb jepni qasje vet\u00ebm atij dhe askujt tjet\u00ebr nga grupi i tij.<\/p>\n<p>P\u00ebr k\u00ebt\u00eb, ne duhet t\u00eb krijojm\u00eb nj\u00eb grup t\u00eb ve\u00e7ant\u00eb p\u00ebr k\u00ebt\u00eb punonj\u00ebs, pra<\/p>\n<ul>\n<li>n\u00eb ASA t\u00eb krijojm\u00eb nj\u00eb pool IP t\u00eb ve\u00e7ant\u00eb p\u00ebr k\u00ebt\u00eb punonj\u00ebs<\/li>\n<li>t\u00eb shtojm\u00eb nj\u00eb ACL t\u00eb re n\u00eb ASA dhe ta lidhim at\u00eb me k\u00ebt\u00eb klient t\u00eb larg\u00ebt<\/li>\n<li>t\u00eb krijojm\u00eb politika t\u00eb reja sigurie n\u00eb firewall-at e zyr\u00ebs dhe t\u00eb qendr\u00ebs s\u00eb t\u00eb dh\u00ebnave<\/li>\n<\/ul>\n<p>\nMir\u00eb, n\u00ebse ky ndodhi \u00ebsht\u00eb i rrall\u00eb. Por n\u00eb praktik\u00ebn time ka pasur raste kur punonj\u00ebsit merrnin pjes\u00eb n\u00eb projekte t\u00eb ndryshme dhe ky grup projektesh p\u00ebr disa prej tyre ndryshonte shpesh, dhe nuk ishin 1-2 njer\u00ebz, por dhjet\u00ebra. Sigurisht, k\u00ebtu duhej b\u00ebr\u00eb di\u00e7ka.<\/p>\n<p>Kjo u zgjidh n\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb.<\/p>\n<p>Ne vendos\u00ebm q\u00eb burimi i vet\u00ebm i s\u00eb v\u00ebrtet\u00ebs, q\u00eb p\u00ebrcakton t\u00eb gjitha qasjet e mundshme p\u00ebr punonj\u00ebsin do t\u00eb ishte LDAP. Krijuam t\u00eb gjitha grupet e mundshme q\u00eb p\u00ebrcaktojn\u00eb grupet e qasjes dhe \u00e7do p\u00ebrdorues e lidh\u00ebm me nj\u00eb ose m\u00eb shum\u00eb grupe. <\/p>\n<p>K\u00ebshtu, p\u00ebr shembull, supozojm\u00eb se ka pasur grupe <\/p>\n<ul>\n<li>guest (qasje n\u00eb Internet)<\/li>\n<li>common access (qasje n\u00eb burime t\u00eb p\u00ebrbashk\u00ebta: post\u00eb, baz\u00eb t\u00eb njohurive, \u2026)<\/li>\n<li>accounting<\/li>\n<li>projekti 1<\/li>\n<li>projekti 2<\/li>\n<li>administrator i baz\u00ebs s\u00eb t\u00eb dh\u00ebnave<\/li>\n<li>administrator linux<\/li>\n<li>\u2026<\/li>\n<\/ul>\n<p>\nDhe n\u00ebse ndonj\u00eb staf ishte i angazhuar si n\u00eb projektin 1 ashtu edhe n\u00eb projektin 2, dhe i duhej akses p\u00ebr t\u00eb punuar n\u00eb k\u00ebto projekte, at\u00ebher\u00eb ky staf u lidh p\u00ebrkat\u00ebsisht me grupet:<\/p>\n<ul>\n<li>guest <\/li>\n<li>aksesi i zakonsh\u00ebm<\/li>\n<li>projekti 1<\/li>\n<li>projekti 2<\/li>\n<\/ul>\n<p>\nSi mund ta kthejm\u00eb tani k\u00ebt\u00eb informacion n\u00eb aksese p\u00ebr pajisjet rrjetore? <\/p>\n<p>Cisco ASA Dynamic Access Policy (DAP) (shih <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/support\/docs\/security\/asa-5500-x-series-next-generation-firewalls\/108000-dap-deploy-guide.html\">www.cisco.com\/c\/en\/us\/support\/docs\/security\/asa-5500-x-series-next-generation-firewalls\/108000-dap-deploy-guide.html<\/a><\/noindex>) zgjidhja e p\u00ebrshtatshme p\u00ebr k\u00ebt\u00eb detyr\u00eb.<\/p>\n<p>N\u00ebse flasim shkurtimisht p\u00ebr realizimin ton\u00eb, gjat\u00eb procesit t\u00eb identifikimit\/autorizimit, ASA merr nga LDAP nj\u00eb grup t\u00eb grupeve p\u00ebrkat\u00ebse p\u00ebr k\u00ebt\u00eb p\u00ebrdorues dhe \"nd\u00ebrton\" nj\u00eb ACL dinamik nga disa ACL lokale (secila q\u00eb p\u00ebrkon me nj\u00eb grup) me t\u00eb gjitha akseset e nevojshme, q\u00eb plot\u00ebson plot\u00ebsisht d\u00ebshirat tona.<\/p>\n<p>Por kjo \u00ebsht\u00eb vet\u00ebm p\u00ebr lidhjet VPN. P\u00ebr t\u00eb b\u00ebr\u00eb situat\u00ebn t\u00eb nj\u00ebjt\u00eb p\u00ebr punonj\u00ebsit q\u00eb jan\u00eb lidhur p\u00ebrmes VPN dhe p\u00ebr ata q\u00eb jan\u00eb n\u00eb zyr\u00eb \u00ebsht\u00eb b\u00ebr\u00eb hapi i m\u00ebposht\u00ebm. <\/p>\n<p>Kur lidhesh nga zyra, p\u00ebrdoruesit n\u00ebp\u00ebrmjet protokollit 802.1x kalonin ose n\u00eb VLAN-in e mysafir\u00ebve (p\u00ebr mysafir\u00ebt), ose n\u00eb VLAN me akses t\u00eb zakonsh\u00ebm (p\u00ebr punonj\u00ebsit e kompanis\u00eb). M\u00eb pas, p\u00ebr t\u00eb marr\u00eb akseset specifike (p\u00ebr shembull, p\u00ebr projektet n\u00eb qend\u00ebr t\u00eb t\u00eb dh\u00ebnave), punonj\u00ebsit duhej t\u00eb lidhen p\u00ebrmes VPN.<\/p>\n<p>P\u00ebr lidhjen nga zyra dhe nga sht\u00ebpia jan\u00eb p\u00ebrdorur grupe t\u00eb ndryshme tunelesh n\u00eb ASA. Kjo \u00ebsht\u00eb e nevojshme n\u00eb m\u00ebnyr\u00eb q\u00eb, p\u00ebr ata q\u00eb lidhen nga zyra, trafiku p\u00ebr burimet e p\u00ebrbashk\u00ebta (t\u00eb p\u00ebrdorura nga t\u00eb gjith\u00eb punonj\u00ebsit, si\u00e7 jan\u00eb posta, server\u00ebt e skedar\u00ebve, sistemi i tiketeve, dns, \u2026) t\u00eb kaloj\u00eb jo p\u00ebrmes ASA, por p\u00ebrmes rrjetit lokal. N\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb, ne nuk e ngarkonim ASA-n\u00eb me trafik t\u00eb panevojsh\u00ebm, p\u00ebrfshir\u00eb dhe trafikun me intensitet t\u00eb lart\u00eb.<\/p>\n<p>K\u00ebshtu, problemi u zgjidh. <br \/>\nNe mor\u00ebm <\/p>\n<ul>\n<li>n\u00eb nj\u00eb grup t\u00eb nj\u00ebjt\u00eb accesesh, si p\u00ebr lidhjet nga zyra ashtu dhe p\u00ebr lidhjet e larg\u00ebta<\/li>\n<li>munges\u00ebn e degradimit t\u00eb sh\u00ebrbimit gjat\u00eb pun\u00ebs nga zyra, e lidhur me kalimin e trafikut t\u00eb lart\u00eb p\u00ebrmes ASA<\/li>\n<\/ul>\n<p>\nCili \u00ebsht\u00eb edhe nj\u00eb avantazh tjet\u00ebr i k\u00ebtij qasje?<br \/>\nN\u00eb administrimin e akseseve. Aksesi ndryshohet leht\u00ebsisht, n\u00eb nj\u00eb vend.<br \/>\nP\u00ebr shembull, n\u00ebse nj\u00eb punonj\u00ebs largohet nga kompania, thjesht e fshini at\u00eb nga LDAP, dhe ai automatikisht humbet t\u00eb gjitha akseset.\n<\/p><\/blockquote>\n<p><\/p>\n<h3>Kontrolli i hostit (host checking)<\/h3>\n<p>\nMe lidhjen e mundshme n\u00eb distanc\u00eb, ne rrezikojm\u00eb t\u00eb lejojm\u00eb n\u00eb rrjet jo vet\u00ebm punonj\u00ebsin e kompanis\u00eb, por gjithashtu \u00e7do soft t\u00eb d\u00ebmsh\u00ebm q\u00eb me shum\u00eb gjasa ndodhet n\u00eb kompjuterin e tij (p\u00ebr shembull, n\u00eb sht\u00ebpi), dhe m\u00eb shum\u00eb, p\u00ebrmes k\u00ebtij softi, ne ndoshta po hapim aksesin n\u00eb rrjetin ton\u00eb p\u00ebr nj\u00eb sulmues q\u00eb po p\u00ebrdor k\u00ebt\u00eb host si nj\u00eb proxy.<\/p>\n<p>\u00cbsht\u00eb kuptimplot\u00eb q\u00eb hosti i lidhur n\u00eb distanc\u00eb t\u00eb aplikoj\u00eb t\u00eb nj\u00ebjtat k\u00ebrkesa p\u00ebr siguri si ai q\u00eb ndodhet n\u00eb zyr\u00eb.<\/p>\n<p>Kjo p\u00ebrfshin gjithashtu versionin e 'duhur' t\u00eb OS-s\u00eb, anti-virus, anti-spyware dhe softin p\u00ebr firewall dhe p\u00ebrdit\u00ebsimet. Zakonisht, kjo mund\u00ebsi ekziston n\u00eb port\u00ebn VPN (p\u00ebr ASA, shih, p\u00ebr shembull, <noindex><a rel=\"nofollow\" href=\"https:\/\/community.cisco.com\/t5\/security-documents\/how-to-configure-anyconnect-host-scan\/ta-p\/3118732\">k\u00ebtu<\/a><\/noindex>).<\/p>\n<p>Gjithashtu \u00ebsht\u00eb kuptimplot\u00eb t\u00eb aplikohet t\u00eb nj\u00ebjtat metoda t\u00eb analiz\u00ebs dhe bllokimit t\u00eb trafikut (shih 'Niveli i Lart\u00eb i Mbrojtjes'), q\u00eb n\u00eb p\u00ebrputhje me politik\u00ebn tuaj t\u00eb siguris\u00eb aplikohet p\u00ebr trafikun zyrtar. <\/p>\n<p>\u00cbsht\u00eb kuptimplot\u00eb t\u00eb njihet se tani rrjeti juaj zyrtar nuk \u00ebsht\u00eb i kufizuar vet\u00ebm n\u00eb nd\u00ebrtes\u00ebn e zyr\u00ebs dhe hostet q\u00eb ndodhen aty.<\/p>\n<blockquote><p><b>Shembulli<\/b><\/p>\n<p>Nj\u00eb praktik\u00eb e mir\u00eb \u00ebsht\u00eb t\u00eb pajisni \u00e7do punonj\u00ebs q\u00eb ka nevoj\u00eb p\u00ebr akses n\u00eb distanc\u00eb me nj\u00eb laptop t\u00eb mir\u00eb dhe t\u00eb rehatsh\u00ebm dhe t\u00eb k\u00ebrkoni t\u00eb punojn\u00eb, si n\u00eb zyr\u00eb ashtu edhe nga sht\u00ebpia, vet\u00ebm me t\u00eb.<\/p>\n<p>Kjo jo vet\u00ebm q\u00eb rrit nivelin e siguris\u00eb s\u00eb rrjetit tuaj, por gjithashtu \u00ebsht\u00eb v\u00ebrtet e p\u00ebrshtatshme dhe zakonisht merret mir\u00eb nga punonj\u00ebsit (n\u00ebse \u00ebsht\u00eb v\u00ebrtet nj\u00eb laptop i mir\u00eb dhe i rehatsh\u00ebm).<\/p><\/blockquote>\n<p><\/p>\n<h2>N\u00eb lidhje me ndjenj\u00ebn e mas\u00ebs dhe balanc\u00ebs<\/h2>\n<p>\nN\u00eb parim, ky \u00ebsht\u00eb nj\u00eb bised\u00eb p\u00ebr maj\u00ebn e tret\u00eb t\u00eb trek\u00ebndeshit ton\u00eb \u2014 p\u00ebr \u00e7mimin.<br \/>\nLe t\u00eb shqyrtojm\u00eb nj\u00eb shembull hipotetik.<\/p>\n<blockquote><p><b>Shembulli<\/b><\/p>\n<p>Keni nj\u00eb zyr\u00eb me 200 njer\u00ebz. Keni vendosur ta b\u00ebni at\u00eb sa m\u00eb t\u00eb rehatshme dhe sa m\u00eb t\u00eb sigurt.<\/p>\n<p>Prandaj, gjith\u00eb trafiku keni vendosur ta kaloni p\u00ebrmes firewall-it dhe n\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb p\u00ebr t\u00eb gjitha subnetet e zyr\u00ebs, firewall-i \u00ebsht\u00eb porta e paracaktuar. P\u00ebrve\u00e7 softit t\u00eb siguris\u00eb i instaluar n\u00eb \u00e7do host t\u00eb fundit (anti-virus, anti-spyware dhe softi p\u00ebr firewall), gjithashtu keni vendosur t\u00eb aplikoni t\u00eb gjitha metodat e mundshme t\u00eb mbrojtjes n\u00eb firewall.<\/p>\n<p>P\u00ebr t\u00eb garantuar nj\u00eb shpejt\u00ebsi t\u00eb lart\u00eb lidhjeje (gjith\u00e7ka p\u00ebr rehatin\u00eb) si switch-e akses keni zgjedhur switch-e me porte 10-gigabit, si firewall-e keni zgjedhur firewall-e me performanc\u00eb t\u00eb lart\u00eb NGFW, p\u00ebr shembull, Palo Alto seria 7K (me porte 40-gigabit), natyrisht me t\u00eb gjitha licencat e fikura dhe, natyrisht, \u00e7iftin e Lart\u00eb Disponueshm\u00ebris\u00eb.<\/p>\n<p>Sigurisht, p\u00ebr t\u00eb punuar me k\u00ebt\u00eb linj\u00eb pajisjesh, na duhen t\u00eb pakt\u00ebn disa inxhinier\u00eb t\u00eb kualifikuar t\u00eb siguris\u00eb.<\/p>\n<p>M\u00eb pas, vendos\u00ebt t'i jepni \u00e7do punonj\u00ebsi nj\u00eb laptop t\u00eb mir\u00eb.<\/p>\n<p>N\u00eb total, rreth 10 milion dollar\u00eb p\u00ebr implementim, qindra mij\u00ebra dollar\u00eb (mendoj m\u00eb af\u00ebr nj\u00eb milioni) p\u00ebr mb\u00ebshtetje vjetore dhe paga p\u00ebr inxhinier\u00ebt.<\/p>\n<p>Zyra, 200 njer\u00ebz...<br \/>\nA \u00ebsht\u00eb kjo e p\u00ebrshtatshme? Ndoshta, po. <\/p>\n<p>Ju e paraqitni k\u00ebt\u00eb propozim tek menaxhmenti juaj...<br \/>\nKa ndoshta disa kompani n\u00eb bot\u00eb p\u00ebr t\u00eb cilat kjo \u00ebsht\u00eb nj\u00eb zgjidhje e pranueshme dhe e duhur. N\u00ebse ju jeni punonj\u00ebs i k\u00ebsaj kompanie \u2014 urime, por n\u00eb shumic\u00ebn e rasteve, jam i sigurt se njohurit\u00eb tuaja nuk do t\u00eb vler\u00ebsohen nga menaxhmenti.<\/p><\/blockquote>\n<p>\nA \u00ebsht\u00eb ky nj\u00eb shembull i tepruar? Kapitulli i ardhsh\u00ebm do t'ju jap\u00eb p\u00ebrgjigje p\u00ebr k\u00ebt\u00eb pyetje.<\/p>\n<p>N\u00ebse n\u00eb rrjetin tuaj nuk shihni asgj\u00eb nga ato t\u00eb m\u00ebsip\u00ebrmet, at\u00ebher\u00eb kjo \u00ebsht\u00eb normale.<br \/>\nP\u00ebr \u00e7do rast t\u00eb ve\u00e7ant\u00eb, ju nevojitet t\u00eb gjeni kompromisin tuaj t\u00eb arsyesh\u00ebm midis komfortit, \u00e7mimit dhe siguris\u00eb. Shpesh nuk k\u00ebrkohet fare nj\u00eb NGFW n\u00eb zyr\u00ebn tuaj, nuk k\u00ebrkohet mbrojtje L7 n\u00eb firewall. Mjafton t\u00eb sigurohet nj\u00eb nivel i mir\u00eb vizibiliteti dhe alarmesh, dhe kjo mund t\u00eb b\u00ebhet me p\u00ebrdorimin e produkteve open source, p\u00ebr shembull. Po, reagimi juaj ndaj sulmit nuk do t\u00eb jet\u00eb i menj\u00ebhersh\u00ebm, por \u00ebsht\u00eb e r\u00ebnd\u00ebsishme q\u00eb ta shihni at\u00eb, dhe n\u00ebse keni proceset e duhura n\u00eb departamentin tuaj, do t\u00eb jeni n\u00eb gjendje ta neutralizoni at\u00eb shpejt.<\/p>\n<p>Dhe, dua t'ju kujtoj se sipas planit t\u00eb k\u00ebtij cikli artikujsh, ju nuk jeni duke e projektuar rrjetin, thjesht po p\u00ebrpiqeni t\u00eb p\u00ebrmir\u00ebsoni at\u00eb q\u00eb keni.<\/p>\n<h2>Analiza e arkitektur\u00ebs SAFE t\u00eb zyr\u00ebs<\/h2>\n<p>\nShikoni k\u00ebt\u00eb katror t\u00eb kuq, t\u00eb cilin e kam theksuar n\u00eb diagramin nga <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/dam\/en\/us\/solutions\/collateral\/enterprise\/design-zone-security\/safe-architecture-guide-secure-campus.pdf\">SAFE Secure Campus Architecture Guide<\/a><\/noindex>, i cili \u00ebsht\u00eb tema q\u00eb do t\u00eb diskutojm\u00eb k\u00ebtu.<\/p>\n<p><img decoding=\"async\" alt=\"Si t\u00eb merrni n\u00ebn kontroll infrastruktur\u00ebn rrjet\u00ebrore. Kapteri i tret\u00eb. Siguria rrjet\u00ebrore. Pjesa e tret\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/617b6561b6ebb17d4f015251abcadf9b.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKy \u00ebsht\u00eb nj\u00eb nga vendet ky\u00e7e t\u00eb arkitektur\u00ebs dhe nj\u00eb nga pasiguri m\u00eb t\u00eb r\u00ebnd\u00ebsishme.<\/p>\n<blockquote><p><b>V\u00ebrejtje<\/b><\/p>\n<p>Un\u00eb kurr\u00eb nuk kam konfiguruar dhe nuk kam punuar me FirePower (nga linja e firewalleve Cisco \u2014 vet\u00ebm me ASA), prandaj do ta shqyrtoj at\u00eb si \u00e7do firewall tjet\u00ebr, p\u00ebr shembull, si Juniper SRX ose Palo Alto, duke supozuar se ka t\u00eb nj\u00ebjtat mund\u00ebsi.<\/p><\/blockquote>\n<p>\nNga konstrukcionet e zakonshme, un\u00eb shoh vet\u00ebm 4 variante t\u00eb mundshme p\u00ebrdorimi t\u00eb firewall-it p\u00ebr k\u00ebt\u00eb lidhje:<\/p>\n<ul>\n<li>Gateway-i default p\u00ebr \u00e7do subnet \u00ebsht\u00eb switchi, nd\u00ebrsa firewall-i ndodhet n\u00eb modin transparent (do t\u00eb thot\u00eb se gjith\u00eb trafiku kalon p\u00ebrmes tij, por ai nuk formon nj\u00eb hop L3)<\/li>\n<li>shpallja si shkalla standarde p\u00ebr \u00e7do n\u00ebnrrjet jan\u00eb n\u00ebn-interfestat e firewall-it (ose SVI interfesat), nd\u00ebrsa \u00e7 switch-i luan rolin e L2<\/li>\n<li>n\u00eb switch p\u00ebrdoren VRF t\u00eb ndryshme, dhe trafikimi midis VRF kalon p\u00ebrmes firewall-it, trafiku brenda nj\u00eb VRF kontrollohet nga ACL n\u00eb switch<\/li>\n<li>t\u00eb gjith\u00eb trafiku pasqyrohet n\u00eb firewall p\u00ebr analiz\u00eb dhe monitorim, trafikimi p\u00ebrmes tij nuk kalon<\/li>\n<\/ul>\n<p><\/p>\n<blockquote><p><b>Sh\u00ebnim 1<\/b><\/p>\n<p>Kombinime t\u00eb k\u00ebtyre varianteve jan\u00eb t\u00eb mundshme, por p\u00ebr thjesht\u00ebsi ne nuk do t'i shqyrtojm\u00eb ato.<\/p><\/blockquote>\n<blockquote><p><b>Sh\u00ebnim2<\/b><\/p>\n<p>Ka gjithashtu mund\u00ebsin\u00eb e p\u00ebrdorimit t\u00eb PBR (arkitektura e zinxhirit t\u00eb sh\u00ebrbimeve), por p\u00ebr momentin, edhe pse e besoj nj\u00eb zgjidhje t\u00eb bukur, \u00ebsht\u00eb m\u00eb shum\u00eb nj\u00eb ekzotike, prandaj nuk do ta shqyrtoj k\u00ebtu.<\/p><\/blockquote>\n<p>\nNga p\u00ebrshkrimi i rrjedhave n\u00eb dokument shohim se trafiku megjithat\u00eb kalon p\u00ebrmes firewall-it, pra, n\u00eb p\u00ebrputhje me dizajnin Cisco, varianti i kat\u00ebrt bie.<\/p>\n<p>Le t\u00eb shqyrtojm\u00eb s\u00eb pari dy variantet e para.<br \/>\nMe k\u00ebto variante t\u00eb gjith\u00eb trafiku kalon p\u00ebrmes firewall-it.<\/p>\n<p>Tani shikojm\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/products\/collateral\/security\/firepower-ngfw\/data_sheet-c78-736661.html\">flet\u00ebs s\u00eb t\u00eb dh\u00ebnave<\/a><\/noindex>, shikojm\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/itprice.com\">Cisco GPL<\/a><\/noindex> dhe shohim se n\u00ebse duam t\u00eb kemi nj\u00eb kapacitet t\u00eb p\u00ebrgjithsh\u00ebm band\u00eb p\u00ebr zyr\u00ebn ton\u00eb, t\u00eb pakt\u00ebn rreth 10 \u2014 20 gigabit, at\u00ebher\u00eb duhet t\u00eb blejm\u00eb versionin 4K.<\/p>\n<blockquote><p><b>V\u00ebrejtje<\/b><\/p>\n<p>Kur flas p\u00ebr kapacitetin e p\u00ebrgjithsh\u00ebm, kam parasysh trafikimin midis n\u00ebnrrjeteve (dhe jo brenda nj\u00eb VLAN-i).<\/p><\/blockquote>\n<p>\nNga GPL shohim se p\u00ebr HA Bundle me Threat Defense \u00e7mimi varion n\u00eb var\u00ebsi t\u00eb modelit (4110 \u2014 4150) nga ~0,5 \u2014 2,5 milion dollar\u00eb.<\/p>\n<p>K\u00ebshtu, dizajni yn\u00eb fillon t\u00eb ngjaj\u00eb me shembullin e m\u00ebparsh\u00ebm.<\/p>\n<p>A do t\u00eb thot\u00eb kjo se ky dizajn \u00ebsht\u00eb i gabuar?<br \/>\nJo, nuk do t\u00eb thot\u00eb. Cisco ju ofron mbrojtjen maksimale t\u00eb mundshme bazuar n\u00eb gam\u00ebn e produkteve q\u00eb ka. Por kjo nuk do t\u00eb thot\u00eb se \u00ebsht\u00eb \"e domosdoshme\" p\u00ebr ju. <\/p>\n<p>N\u00eb parim, ky \u00ebsht\u00eb nj\u00eb pyetje e zakonshme q\u00eb lind gjat\u00eb dizajnimit t\u00eb nj\u00eb zyre ose qend\u00ebr t\u00eb t\u00eb dh\u00ebnave, dhe kjo do t\u00eb thot\u00eb vet\u00ebm se duhet t\u00eb k\u00ebrkoni kompromis. <\/p>\n<p>P\u00ebr shembull, mos lejoni q\u00eb t\u00eb gjith\u00eb trafiku t\u00eb kaloj\u00eb p\u00ebrmes firewall-it, dhe n\u00eb k\u00ebt\u00eb rast varianti i tret\u00eb m\u00eb duket mjaft t\u00ebrheq\u00ebs, ose (shihni kapitullin e m\u00ebparsh\u00ebm), ndoshta nuk ju nevojitet \"Threat Defense\" ose p\u00ebrfundimisht nuk ju nevojitet firewall n\u00eb k\u00ebt\u00eb segment t\u00eb rrjetit, dhe ju mjafton t\u00eb kufizoheni me monitorimin pasiv duke p\u00ebrdorur zgjidhje t\u00eb paguara (m\u00eb t\u00eb lira) ose open source, ose ju nevojitet firewall, por nga nj\u00eb furnizues tjet\u00ebr.<\/p>\n<p>Zakonisht gjithmon\u00eb ka k\u00ebt\u00eb pasiguri dhe nuk ka nj\u00eb p\u00ebrgjigje t\u00eb qart\u00eb se cila zgjidhje \u00ebsht\u00eb m\u00eb e mira p\u00ebr ju.<br \/>\nK\u00ebtu q\u00ebndron kompleksiteti dhe bukuria e k\u00ebsaj sfide.<br \/>\n<br \/>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/447610\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u044f\u0442\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb. \u0421\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u0441\u0442\u0430\u0442\u0435\u0439 \u0446\u0438\u043a\u043b\u0430 \u0438 \u0441\u0441\u044b\u043b\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0437\u0434\u0435\u0441\u044c. \u042d\u0442\u0430 \u0447\u0430\u0441\u0442\u044c \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u0430 Campus (Office) &amp; Remote access VPN \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0430\u043c. \u041c\u043e\u0436\u0435\u0442 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u044c\u0441\u044f, \u0447\u0442\u043e \u0434\u0438\u0437\u0430\u0439\u043d \u043e\u0444\u0438\u0441\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u2013 \u044d\u0442\u043e \u043f\u0440\u043e\u0441\u0442\u043e. \u0414\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e, \u0431\u0435\u0440\u0435\u043c L2\/L3 \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u044b, \u0441\u043e\u0435\u0434\u0438\u043d\u044f\u0435\u043c \u0438\u0445 \u043c\u0435\u0436\u0434\u0443 \u0441\u043e\u0431\u043e\u0439. \u0414\u0430\u043b\u0435\u0435, \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u0430\u0440\u043d\u0443\u044e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0443 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23359,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31395","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u044f\u0442\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-tretya\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c. \u0413\u043b\u0430\u0432\u0430 \u0442\u0440\u0435\u0442\u044c\u044f. \u0421\u0435\u0442\u0435\u0432\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c. \u0427\u0430\u0441\u0442\u044c \u0442\u0440\u0435\u0442\u044c\u044f | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u044f\u0442\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-tretya\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:41:01+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:41:01+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Si ta kontrolloni infrastruktur\u00ebn tuaj rrjetesh. Kapitulli i tret\u00eb. Siguria e rrjetit. Pjesa e tret\u00eb | ProHoster","description":"Ky kjo artikull \u00ebsht\u00eb e pesta n\u00eb ciklin e artikujve \"Si ta kontrolloni infrastruktur\u00ebn tuaj rrjete.\"","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-tretya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c. \u0413\u043b\u0430\u0432\u0430 \u0442\u0440\u0435\u0442\u044c\u044f. \u0421\u0435\u0442\u0435\u0432\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c. \u0427\u0430\u0441\u0442\u044c \u0442\u0440\u0435\u0442\u044c\u044f | ProHoster","og:description":"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u044f\u0442\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-tretya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:41:01+00:00","article:modified_time":"2019-10-31T18:41:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31395","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 05:58:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:17:26","updated":"2026-01-21 05:58:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/31395","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=31395"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/31395\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/23359"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=31395"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=31395"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=31395"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}