{"id":32137,"date":"2019-10-31T21:45:21","date_gmt":"2019-10-31T18:45:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/nastrojka-ipsec-site-to-site-vpn-na-oborudovanii-palo-alto-networks\/"},"modified":"2019-10-31T21:45:21","modified_gmt":"2019-10-31T18:45:21","slug":"nastrojka-ipsec-site-to-site-vpn-na-oborudovanii-palo-alto-networks","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/nastrojka-ipsec-site-to-site-vpn-na-oborudovanii-palo-alto-networks","title":{"rendered":"Konfigurimi i IPSec Site-to-Site VPN n\u00eb pajisjet Palo Alto Networks","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Konfigurimi
\n
\nKy kjo artikull p\u00ebrb\u00ebn vazhdimin e materialit t\u00eb m\u00ebparsh\u00ebm<\/a><\/noindex>, i dedikuar ve\u00e7orive t\u00eb konfigurimit t\u00eb pajisjeve Palo Alto Networks <\/b>. K\u00ebtu d\u00ebshirojm\u00eb t\u00eb flasim p\u00ebr konfigurimin e IPSec Site-to-Site VPN<\/b> n\u00eb pajisje Palo Alto Networks<\/b> dhe p\u00ebr nj\u00eb mund\u00ebsi t\u00eb konfigurimit t\u00eb lidhjes me disa ofrues interneti.
\n<\/a><\/noindex>
\nP\u00ebr ilustrim do t\u00eb p\u00ebrdoret skema standarde e lidhjes s\u00eb zyr\u00ebs qendrore me deg\u00ebn. P\u00ebr t\u00eb siguruar nj\u00eb lidhje interneti t\u00eb q\u00ebndrueshme, n\u00eb zyr\u00ebn qendrore p\u00ebrdoren dy ofrues: ISP-1 dhe ISP-2. Dega ka lidhje vet\u00ebm me nj\u00eb ofrues, ISP-3. Mes firewalls PA-1 dhe PA-2 krijohen dy tunele. Tunelet punojn\u00eb n\u00eb modin Active-Standby<\/b>, Tunnel-1 \u00ebsht\u00eb aktiv, Tunnel-2 do t\u00eb filloj\u00eb t\u00eb transmetoj\u00eb trafik n\u00eb rast se Tunnel-1 d\u00ebshton. Tunnel-1 p\u00ebrdor lidhjen me ofruesin e internetit ISP-1, Tunnel-2 p\u00ebrdor lidhjen me ofruesin e internetit ISP-2. T\u00eb gjitha adresat IP jan\u00eb gjeneruar rast\u00ebsisht p\u00ebr q\u00ebllime ilustruese dhe nuk kan\u00eb t\u00eb b\u00ebjn\u00eb me realitetin.<\/p>\n

\"Konfigurimi
\n
\nP\u00ebr t\u00eb nd\u00ebrtuar Site-to-Site VPN do t\u00eb p\u00ebrdoret IPSec<\/b> - nj\u00eb grup protokollesh p\u00ebr sigurimin e mbrojtjes s\u00eb t\u00eb dh\u00ebnave t\u00eb transmetuara p\u00ebrmes protokollit IP. IPSec <\/b>do t\u00eb punoj\u00eb duke p\u00ebrdorur protokollin e siguris\u00eb ESP <\/b>(Encapsulating Security Payload), q\u00eb do t\u00eb siguroj\u00eb enkriptimin e t\u00eb dh\u00ebnave t\u00eb transmetuara.<\/p>\n

N\u00eb IPSec <\/b>jan\u00eb IKE <\/b>(Internet Key Exchange) - protokolli q\u00eb p\u00ebrgjigjet p\u00ebr negociat\u00ebn e SA (association security), parametrave t\u00eb siguris\u00eb q\u00eb p\u00ebrdoren p\u00ebr t\u00eb mbrojtur t\u00eb dh\u00ebnat e transmetuara. Firewalls PAN mb\u00ebshtesin IKEv1 <\/b>dhe IKEv2<\/b>.<\/p>\n

N\u00eb IKEv1 <\/b>Lidhja VPN nd\u00ebrtohet n\u00eb dy etapa: IKEv1 Phase 1 <\/b>(tuneli IKE) dhe IKEv1 Phase 2<\/b> (tuneli IPSec), k\u00ebshtu krijohen dy tunele, nj\u00ebri prej t\u00eb cil\u00ebve sh\u00ebrben p\u00ebr shk\u00ebmbimin e informacionit administrativ nd\u00ebrmjet firewalls, tjetri - p\u00ebr transmetimin e trafikut. N\u00eb IKEv1 Phase 1<\/b> ekzistojn\u00eb dy m\u00ebnyra funksionimi - modus kryesor dhe modus agresiv. Modus agresiv p\u00ebrdor m\u00eb pak mesazhe dhe punon m\u00eb shpejt, por nuk mb\u00ebshtet Mbrojtjen e Identitetit t\u00eb Pal\u00ebs.<\/p>\n

IKEv2 <\/b>er\u00ebn e tij ishte IKEv1<\/b>, dhe krahasuar me IKEv1<\/b> avantazhi kryesor \u00ebsht\u00eb k\u00ebrkesat m\u00eb t\u00eb vogla p\u00ebr band\u00eb e gjer\u00eb dhe negociata m\u00eb e shpejt\u00eb e SA. N\u00eb IKEv2<\/b> p\u00ebrdoren m\u00eb pak mesazhe administrativ (vet\u00ebm 4), mb\u00ebshtetet protokolli EAP, MOBIKE dhe \u00ebsht\u00eb shtuar mekanizmi i kontrollit t\u00eb disponueshm\u00ebris\u00eb s\u00eb pal\u00ebs, me t\u00eb cil\u00ebn krijohet tuneli - Liveness Check<\/b>, i cili z\u00ebvend\u00ebson Dead Peer Detection n\u00eb IKEv1. N\u00ebse kontrolli nuk kalon, at\u00ebher\u00eb IKEv2 <\/b>mund t\u00eb riparoj\u00eb tunelin dhe pastaj t\u00eb rikthej\u00eb automatikisht kur t\u00eb jet\u00eb e mundur. M\u00eb shum\u00eb detaje mbi dallimet mund t\u00eb lexoni k\u00ebtu<\/a><\/noindex>.<\/p>\n

N\u00ebse tuneli krijohet midis firewalleve t\u00eb prodhuesve t\u00eb ndrysh\u00ebm, at\u00ebher\u00eb ka mund\u00ebsi t\u00eb ket\u00eb gabime n\u00eb implementim IKEv2<\/b>, dhe p\u00ebr kompatibilitet me nj\u00eb pajisje t\u00eb till\u00eb ka mund\u00ebsi t\u00eb p\u00ebrdoret IKEv1<\/b>. N\u00eb raste t\u00eb tjera, \u00ebsht\u00eb m\u00eb mir\u00eb t\u00eb p\u00ebrdoren IKEv2<\/b>.<\/p>\n

Hapat e konfigurimit:<\/p>\n

\u2022 Konfigurimi i dy ofruesve t\u00eb internetit n\u00eb modin ActiveStandby<\/b><\/p>\n

Ka disa m\u00ebnyra p\u00ebr t\u00eb realizuar k\u00ebt\u00eb funksionalitet. Nj\u00ebra nga to p\u00ebrfshin p\u00ebrdorimin e mekanizmit Path Monitoring<\/b>, i cili \u00ebsht\u00eb b\u00ebr\u00eb i disponuesh\u00ebm duke filluar nga versioni PAN-OS 8.0.0<\/b>. N\u00eb k\u00ebt\u00eb shembuj p\u00ebrdoret versioni 8.0.16. Ky funksion \u00ebsht\u00eb i ngjash\u00ebm me IP SLA n\u00eb routerat Cisco. N\u00eb parametrin e rrug\u00ebs statike defaulte konfigurimi d\u00ebrgon paketa ping n\u00eb nj\u00eb IP t\u00eb caktuar nga nj\u00eb adres\u00eb burimi e caktuar. N\u00eb k\u00ebt\u00eb rast, nd\u00ebrfaqja ethernet1\/1 b\u00ebn ping n\u00eb portin e paracaktuar \u00e7do sekond\u00eb. N\u00ebse nuk ka p\u00ebrgjigje p\u00ebr tre ping pas nj\u00ebri-tjetrit, rruga konsiderohet e papunuar dhe hiqet nga tabela e routing-ut. Nj\u00eb rrug\u00eb e till\u00eb konfigurohet n\u00eb drejtim t\u00eb ofruesit t\u00eb dyt\u00eb t\u00eb internetit, por me nj\u00eb metrik\u00eb m\u00eb t\u00eb lart\u00eb (ai \u00ebsht\u00eb rezerv\u00eb). Pasi rruga e par\u00eb t\u00eb hiqet nga tabela, firewalli do t\u00eb filloj\u00eb t\u00eb d\u00ebrgoj\u00eb trafik p\u00ebrmes rrug\u00ebs s\u00eb dyt\u00eb \u2014 Fail-Over<\/b>. Kur ofruesi i par\u00eb fillon t\u00eb p\u00ebrgjigjet n\u00eb ping, rruga e tij do t\u00eb kthehet n\u00eb tabel\u00eb dhe do t\u00eb z\u00ebvend\u00ebsoj\u00eb t\u00eb dyt\u00ebn p\u00ebr shkak t\u00eb metrikes m\u00eb t\u00eb mir\u00eb \u2014 Fail-Back<\/b>. Procesi Fail-Over<\/b> zgjat disa sekonda n\u00eb var\u00ebsi t\u00eb intervaleve t\u00eb p\u00ebrcaktuara, por, n\u00eb \u00e7do rast, procesi nuk \u00ebsht\u00eb i menj\u00ebhersh\u00ebm, dhe gjat\u00eb k\u00ebsaj kohe humbet trafik. Fail-Back<\/b> ndryshe kalon pa humbje t\u00eb trafikut. Ka mund\u00ebsi ta b\u00ebsh Fail-Over<\/b> m\u00eb t\u00eb shpejt\u00eb, me an\u00eb t\u00eb BFD<\/b>, n\u00ebse ofruesi i internetit e ofron k\u00ebt\u00eb mund\u00ebsi. BFD <\/b>p\u00ebrkrahja fillon nga modeli PA-3000 Series<\/b> dhe VM-100<\/b>. Si adres\u00eb p\u00ebr ping \u00ebsht\u00eb m\u00eb mir\u00eb t\u00eb p\u00ebrcaktohet nj\u00eb adres\u00eb publike, q\u00eb \u00ebsht\u00eb gjithmon\u00eb e aksesueshme.<\/p>\n

\"Konfigurimi
\n
\n\u2022 Krijimi i nj\u00eb nd\u00ebrfaqe tuneli<\/b><\/p>\n

Trafiku brenda tunelit kalon p\u00ebrmes nd\u00ebrfaqeve virtuale speciale. N\u00eb secil\u00ebn prej tyre duhet t\u00eb konfigurohet nj\u00eb IP nga rrjeti transit. N\u00eb k\u00ebt\u00eb shembuj, p\u00ebr Tunnel-1 do t\u00eb p\u00ebrdoret n\u00ebnrrjeti 172.16.1.0\/30, dhe p\u00ebr Tunnel-2 \u2014 n\u00ebnrrjeti 172.16.2.0\/30.
\nNd\u00ebrfaqja e tunelit krijohet n\u00eb seksionin Network -> Interfaces -> Tunnel<\/b>Duhet t\u00eb specifikoni nj\u00eb router virtual dhe nj\u00eb zon\u00eb sigurie, si dhe nj\u00eb adres\u00eb IP nga rrjeti p\u00ebrkat\u00ebs t\u00eb transportit. Numri i nd\u00ebrfaqes mund t\u00eb jet\u00eb \u00e7far\u00ebdo.<\/p>\n

\"Konfigurimi
\n
\n\"Konfigurimi
\n
\nN\u00eb seksionin T\u00eb avancuara <\/b>mund t\u00eb caktohet Profili i Menaxhimit<\/b>, i cili do t\u00eb lejoj\u00eb ping n\u00eb k\u00ebt\u00eb nd\u00ebrfaqe, kjo mund t\u00eb jet\u00eb e dobishme p\u00ebr testim.<\/p>\n

\"Konfigurimi
\n
\n\u2022 Konfigurimi i IKE Profile<\/b><\/p>\n

IKE Profile<\/b> \u00ebsht\u00eb p\u00ebrgjegj\u00ebs p\u00ebr faz\u00ebn e par\u00eb t\u00eb krijimit t\u00eb lidhjes VPN, k\u00ebtu specifikohen parametrat e tunelit IKE Faza 1<\/b>. Profili krijohet n\u00eb seksionin Network -> Network Profiles -> IKE Crypto<\/b>. Duhet t\u00eb specifikoni algoritmin e enkriptimit, hash, grupin e Diffie-Hellman dhe koh\u00ebn e jet\u00ebs s\u00eb \u00e7el\u00ebsave. N\u00eb p\u00ebrgjith\u00ebsi, sa m\u00eb t\u00eb komplikuar t\u00eb jen\u00eb algoritmat, aq m\u00eb keq \u00ebsht\u00eb performanca, ata duhet t\u00eb zgjidhen duke u bazuar n\u00eb k\u00ebrkesat specifike p\u00ebr sigurin\u00eb. Megjithat\u00eb, nuk rekomandohet kategorizikisht t\u00eb p\u00ebrdoret grupi i Diffie-Hellman n\u00ebn 14 p\u00ebr mbrojtjen e informacionit t\u00eb r\u00ebnd\u00ebsish\u00ebm. Kjo ndodhi p\u00ebr shkak t\u00eb dob\u00ebsis\u00eb s\u00eb protokollit, e cila mund t\u00eb neutralizohet vet\u00ebm duke p\u00ebrdorur madh\u00ebsin\u00eb e moduleve 2048 bit ose m\u00eb lart, ose algoritmet e kriptografis\u00eb eliptike, t\u00eb cilat p\u00ebrdoren n\u00eb grupet 19, 20, 21, 24. K\u00ebto algoritme kan\u00eb performanc\u00eb m\u00eb t\u00eb mir\u00eb krahasuar me kriptografin\u00eb tradicionale. M\u00eb shum\u00eb informacion k\u00ebtu<\/a><\/noindex>. Dhe k\u00ebtu<\/a><\/noindex>.<\/p>\n

\"Konfigurimi
\n
\n\u2022 Konfigurimi i IPSec Profile<\/b><\/p>\n

Faza e dyt\u00eb e krijimit t\u00eb lidhjes VPN \u2014 tuneli IPSec. Parametrat SA p\u00ebr t\u00eb konfigurohen n\u00eb Network -> Network Profiles -> IPSec Crypto Profile<\/b>. K\u00ebtu duhet t\u00eb specifikoni protokollin IPSec \u2014 AH <\/b>ose ESP<\/b>, si dhe parametrat SA <\/b> \u2014 algoritmet e hash, enkriptimit, grupet e Diffie-Hellman dhe koh\u00ebn e jet\u00ebs s\u00eb \u00e7el\u00ebsave. Parametrat SA n\u00eb IKE Crypto Profile dhe IPSec Crypto Profile mund t\u00eb mos p\u00ebrputhen.<\/p>\n

\"Konfigurimi
\n
\n\u2022 Konfigurimi i IKE Gateway<\/b><\/p>\n

IKE Gateway<\/b> \u2014 \u00ebsht\u00eb nj\u00eb objekt q\u00ebkat\u00ebson nj\u00eb router ose nj\u00eb firewall, me t\u00eb cilin ndodhet tuneli VPN. P\u00ebr \u00e7do tunel duhet t\u00eb krijohet nj\u00eb IKE Gateway<\/b>. N\u00eb k\u00ebt\u00eb rast, krijohen dy tunel, nj\u00ebri p\u00ebrmes secilit ofrues t\u00eb internetit. Specifikohet nd\u00ebrfaqja p\u00ebrkat\u00ebse dal\u00ebse dhe adresa e saj IP, adresa IP e partnerit, dhe \u00e7el\u00ebsi i p\u00ebrgjithsh\u00ebm. Si nj\u00eb alternativ\u00eb ndaj \u00e7el\u00ebsit t\u00eb p\u00ebrgjithsh\u00ebm mund t\u00eb p\u00ebrdoren certifikatat.<\/p>\n

\"Konfigurimi
\n
\nK\u00ebtu specifikohet profili i krijuar m\u00eb par\u00eb IKE Crypto Profile<\/b>. Parametrat e objektit t\u00eb dyt\u00eb IKE Gateway<\/b> jan\u00eb t\u00eb ngjash\u00ebm, p\u00ebrve\u00e7 adresave IP. N\u00ebse firewall-i i Palo Alto Networks ndodhet pas nj\u00eb router NAT, at\u00ebher\u00eb duhet t\u00eb aktivizohet mekanizmi Shkalla e NAT Traversal<\/b>.<\/p>\n

\"Konfigurimi
\n
\n\u2022 Konfigurimi i Tunelit IPSec<\/b><\/p>\n

Tuneli IPSec<\/b> \u2014 \u00ebsht\u00eb nj\u00eb objekt, n\u00eb t\u00eb cilin specifikohen parametrat e tunelit IPSec, si\u00e7 tregohet nga emri. K\u00ebtu duhet t\u00eb specifikoni interfacin\u00eb e tunelit dhe objektet e krijuara m\u00eb par\u00eb. IKE Gateway<\/b>, Profili Crypto IPSec<\/b>. P\u00ebr t\u00eb siguruar kalimin automatik t\u00eb rrug\u00ebzim n\u00eb tunelin rezerv\u00eb, duhet t\u00eb aktivizoni Monitori i Tunelit<\/b>. Ky \u00ebsht\u00eb nj\u00eb mekaniz\u00ebm q\u00eb kontrollon n\u00ebse bashk\u00ebbiseduesi \u00ebsht\u00eb aktiv, n\u00ebp\u00ebrmjet trafikut ICMP. Si adres\u00eb destinacioni duhet t\u00eb specifikoni adres\u00ebn IP t\u00eb interfacin\u00eb t\u00eb tunelit t\u00eb bashk\u00ebbiseduesit me t\u00eb cilin nd\u00ebrtohet tuneli. N\u00eb profil specifikohen timerat dhe veprimi n\u00eb rast t\u00eb humbjes s\u00eb lidhjes. Prisni t\u00eb Rikthehet<\/b> \u2013 pritet q\u00eb lidhja t\u00eb rikthehet, Shkeli i D\u00ebshtimit<\/b> \u2014 d\u00ebrgoni trafikun p\u00ebrmes nj\u00eb rruge tjet\u00ebr, n\u00ebse ka. Konfigurimi i tunelit t\u00eb dyt\u00eb \u00ebsht\u00eb plot\u00ebsisht i ngjash\u00ebm, specifikohet interfaci i dyt\u00eb i tunelit dhe IKE Gateway.<\/p>\n

\"Konfigurimi
\n
\n\"Konfigurimi
\n
\n\u2022 Konfigurimi i rrug\u00ebzimit<\/b><\/p>\n

N\u00eb k\u00ebt\u00eb shembull p\u00ebrdoret rrug\u00ebzim statik. N\u00eb firewall-in PA-1, p\u00ebrve\u00e7 dy rrugeve default, duhet t\u00eb specifikoni dy rrug\u00eb deri n\u00eb subnet-in 10.10.10.0\/24 n\u00eb deg\u00eb. Nj\u00eb rrug\u00eb p\u00ebrdor Tunnel-1, tjetra Tunnel-2. Rrug\u00ebn p\u00ebrmes Tunnel-1 \u00ebsht\u00eb kryesorja, pasi ka metrik m\u00eb t\u00eb vog\u00ebl. Mekanizmi Path Monitoring<\/b> nuk p\u00ebrdoret p\u00ebr k\u00ebto rrug\u00eb. P\u00ebr kalimin \u00ebsht\u00eb p\u00ebrgjegj\u00ebs Monitori i Tunelit<\/b>.<\/p>\n

\"Konfigurimi
\n
\nRrug\u00eb t\u00eb ngjashme p\u00ebr subnet-in 192.168.30.0\/24 duhet t\u00eb konfiguroni n\u00eb PA-2.<\/p>\n

\"Konfigurimi
\n
\n\u2022 Konfigurimi i rregullave t\u00eb rrjetit<\/b><\/p>\n

P\u00ebr funksionimin e tunelit, nevojiten tre rregulla:<\/p>\n

    \n
  1. P\u00ebr funksionimin Monitori i Rrug\u00ebs<\/b> lejoni ICMP n\u00eb interfacin\u00eb e jashtme.<\/li>\n
  2. P\u00ebr IPSec <\/b>lejoni aplikacionet ike <\/b>dhe ipsec <\/b>n\u00eb interfacin\u00eb e jashtme.<\/li>\n
  3. Lejoni trafikun midis subneteve t\u00eb brendshme dhe interfacin\u00ebve t\u00eb tunelit.<\/li>\n<\/ol>\n

    \n\"Konfigurimi
    \n
    \nP\u00ebrfundim<\/b><\/p>\n

    N\u00eb k\u00ebt\u00eb artikull shqyrtohet nj\u00eb variant i konfigurimit t\u00eb lidhjes s\u00eb besueshme t\u00eb internetit dhe Site-to-Site VPN<\/b>. Shpresojm\u00eb q\u00eb informacioni ka qen\u00eb i dobish\u00ebm dhe lexuesi ka marr\u00eb nj\u00eb ide p\u00ebr teknologjit\u00eb e p\u00ebrdorura n\u00eb Palo Alto Networks<\/b>. N\u00ebse keni pyetje p\u00ebr konfigurimin dhe d\u00ebshira p\u00ebr temat e artikujve t\u00eb ardhsh\u00ebm \u2014 shkruani ato n\u00eb komentet, do t\u00eb jemi t\u00eb lumtur t\u00eb p\u00ebrgjigjemi.
    \n
    Burimi:     habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u0414\u0430\u043d\u043d\u0430\u044f \u0441\u0442\u0430\u0442\u044c\u044f \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0435\u043d\u0438\u0435 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0433\u043e \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0430, \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u044f\u043c \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f Palo Alto Networks . \u0417\u0434\u0435\u0441\u044c \u043c\u044b \u0445\u043e\u0442\u0438\u043c \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u0442\u044c \u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 IPSec Site-to-Site VPN \u043d\u0430 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0438 Palo Alto Networks \u0438 \u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u043c \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u0435 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432. \u0414\u043b\u044f \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u0431\u0443\u0434\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u0430\u044f \u0441\u0445\u0435\u043c\u0430 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0433\u043e\u043b\u043e\u0432\u043d\u043e\u0433\u043e \u043e\u0444\u0438\u0441\u0430 \u043a \u0444\u0438\u043b\u0438\u0430\u043b\u0443. \u0414\u043b\u044f \u0442\u043e\u0433\u043e, \u0447\u0442\u043e\u0431\u044b \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0442\u044c \u043e\u0442\u043a\u0430\u0437\u043e\u0443\u0441\u0442\u043e\u0439\u0447\u0438\u0432\u043e\u0435 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435, \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23973,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-32137","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Konfigurimi i IPSec Site-to-Site VPN n\u00eb pajisjet Palo Alto Networks | ProHoster","description":"Ky artikull.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/nastrojka-ipsec-site-to-site-vpn-na-oborudovanii-palo-alto-networks","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 IPSec Site-to-Site VPN \u043d\u0430 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0438 Palo Alto Networks | ProHoster","og:description":"\u0414\u0430\u043d\u043d\u0430\u044f \u0441\u0442\u0430\u0442\u044c\u044f.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/nastrojka-ipsec-site-to-site-vpn-na-oborudovanii-palo-alto-networks","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:45:21+00:00","article:modified_time":"2019-10-31T18:45:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"32137","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 09:27:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:04:40","updated":"2026-01-21 09:27:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/32137","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=32137"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/32137\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/23973"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=32137"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=32137"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=32137"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}