{"id":90211,"date":"2020-07-30T01:42:13","date_gmt":"2020-07-29T23:42:13","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/4-ngfw-dlya-malogo-biznesa-vpn"},"modified":"2020-07-30T01:42:13","modified_gmt":"2020-07-29T23:42:13","slug":"4-ngfw-dlya-malogo-biznesa-vpn","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/4-ngfw-dlya-malogo-biznesa-vpn","title":{"rendered":"4. NGFW p\u00ebr bizneset e vogla. VPN","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"4.
\n<\/p>\n

Vazhdhojm\u00eb me ciklin ton\u00eb t\u00eb artikujve mbi NGFW p\u00ebr biznesin e vog\u00ebl, duke kujtuar se po shqyrtojm\u00eb serin\u00eb e re t\u00eb modeleve 1500. N\u00eb pjes\u00ebn 1<\/a><\/noindex> e ciklit p\u00ebrmenda nj\u00eb nga opsionet m\u00eb t\u00eb dobishme kur blehet nj\u00eb pajisje SMB \u2014 sigurimi i porteve me licencat e integruara t\u00eb Mobile Access (nga 100 deri n\u00eb 200 p\u00ebrdorues n\u00eb var\u00ebsi t\u00eb modelit). N\u00eb k\u00ebt\u00eb artikull do t\u00eb shqyrtojm\u00eb konfigurimin e VPN p\u00ebr portat e seris\u00eb 1500, q\u00eb vijn\u00eb me Gaia 80.20 Embedded t\u00eb instaluar paraprakisht. Ja nj\u00eb p\u00ebrmbledhje:<\/p>\n

<\/p>\n

    \n
  1. Mund\u00ebsit\u00eb e VPN p\u00ebr SMB.<\/li>\n
  2. Organizimi i Access-it t\u00eb Larg\u00ebt p\u00ebr nj\u00eb zyr\u00eb t\u00eb vog\u00ebl.<\/li>\n
  3. Klient\u00ebt e disponuesh\u00ebm p\u00ebr lidhje.<\/li>\n<\/ol>\n

    <\/a><\/noindex><\/p>\n

    1. Mund\u00ebsit\u00eb e VPN p\u00ebr SMB<\/h3>\n

    <\/p>\n

    P\u00ebr t\u00eb p\u00ebrgatitur materialin e sot\u00ebm, u p\u00ebrdor brenda dokumentacionit zyrtar udh\u00ebzuesi i administratorit<\/a><\/noindex> i versionit R80.20.05 (n\u00eb momentin e publikimit t\u00eb artikullit \u2014 aktual). Sipas k\u00ebsaj, n\u00eb pjes\u00ebn e VPN n\u00eb Gaia 80.20 Embedded ka mb\u00ebshtetje p\u00ebr:<\/p>\n

    <\/p>\n

      \n
    1. Site-To-Site. Krijimi i VPN-tunel\u00ebve mes zyrave tuaja, ku p\u00ebrdoruesit do t\u00eb mund t\u00eb punojn\u00eb si n\u00eb nj\u00eb \"rrjet lokal\".\n

      \"4.\n<\/li>\n

    2. Access i Larg\u00ebt. Lidhja e larg\u00ebt me burimet e zyr\u00ebs suaj p\u00ebrmes pajisjeve t\u00eb p\u00ebrdoruesve (PC, telefona mobil etj.). S\u00eb bashku me k\u00ebt\u00eb, ekziston SSL Network Extender, i cili lejon publikimin e aplikacioneve t\u00eb ve\u00e7anta dhe ekzekutimin e tyre p\u00ebrmes Java Applet, duke u lidhur p\u00ebrmes SSL. V\u00ebrejtje:<\/u> mos e ngat\u00ebrroni me Mobile Access Portal (mb\u00ebshtetje n\u00eb Gaia Embedded nuk \u00ebsht\u00eb e disponueshme).
      \n<\/i>
      \n\"4.\n<\/li>\n<\/ol>\n

      <\/p>\n

      Shtes\u00eb<\/u><\/b> Theksoj shum\u00eb kursin autorit TS Solution \u2014 Check Point Remote Access VPN<\/a><\/noindex> ai zbardh teknologjit\u00eb e Check Point n\u00eb lidhje me VPN-n\u00eb, trajton \u00e7\u00ebshtje licencimi dhe p\u00ebrmban udh\u00ebzime shum\u00eb t\u00eb detajuara p\u00ebr konfigurimin.<\/p>\n

      <\/p>\n

      2. Access i Larg\u00ebt p\u00ebr nj\u00eb zyr\u00eb t\u00eb vog\u00ebl<\/h3>\n

      \nNe do t\u00eb fillojm\u00eb organizimin e lidhjes s\u00eb larg\u00ebt me zyr\u00ebn tuaj:<\/p>\n

        \n
      1. P\u00ebr t\u00eb lejuar p\u00ebrdoruesit t\u00eb krijojn\u00eb nj\u00eb VPN-tunel me port\u00ebn, ju nevojitet nj\u00eb adres\u00eb IP publike. N\u00ebse keni p\u00ebrfunduar konfigurimin fillestar (artikulli 2<\/a><\/noindex> nga cikli), at\u00ebher\u00eb zakonisht \u2014 External Link tashm\u00eb \u00ebsht\u00eb aktiv. Informacionin mund ta merrni duke e vizituar Gaia Portal: Device \u2192 Network \u2192 Internet<\/b>\n

        \"4.
        \n<\/p>\n

        N\u00eb rastin kur kompania juaj p\u00ebrdor nj\u00eb adres\u00eb IP publike dinamike, mund t\u00eb vendosni Dynamic DNS. Shkoni n\u00eb Pajisja <\/strong>\u2192 DDNS & Device Access<\/strong>\n<\/p>\n

        \"4.
        \n<\/p>\n

        Aktualisht ka mb\u00ebshtetje nga dy ofrues: DynDns dhe no-ip.com. P\u00ebr ta aktivizuar opsionin, duhet t\u00eb vendosni t\u00eb dh\u00ebnat tuaja t\u00eb identifikimit (emri i p\u00ebrdoruesit, fjal\u00ebkalimi).\n<\/p>\n<\/li>\n

      2. Tani do t\u00eb krijojm\u00eb nj\u00eb llogari p\u00ebrdoruesi, e cila do t\u00eb jet\u00eb e dobishme p\u00ebr testimin e konfigurimeve: VPN \u2192 Remote Access \u2192 Remote Access Users<\/strong>\n

        \"4.
        \n<\/p>\n

        N\u00eb grupin (p\u00ebr shembull: remoteaccess) do t\u00eb krijojm\u00eb nj\u00eb p\u00ebrdorues, duke ndjekur udh\u00ebzimet n\u00eb ekran. Konfigurimi i llogaris\u00eb \u00ebsht\u00eb standard, caktoni emrin e p\u00ebrdoruesit dhe fjal\u00ebkalimin, m\u00eb tej aktivizoni opsionin e lejeve p\u00ebr Qasje t\u00eb Larg\u00ebt. \n<\/p>\n

        \"4.
        \n<\/p>\n

        N\u00ebse keni aplikuar me sukses konfigurimet, duhet t\u00eb shfaqen dy objekte: p\u00ebrdorues lokal, grup lokal i p\u00ebrdoruesve.<\/p>\n

        \"4.<\/li>\n

      3. Hapi tjet\u00ebr \u00ebsht\u00eb t\u00eb kaloni te VPN \u2192 Qasje e Larg\u00ebt \u2192 Kontrolli i Bladit. <\/strong>Sigurohuni q\u00eb bladi juaj t\u00eb jet\u00eb aktivizuar dhe trafiku nga p\u00ebrdoruesit e larg\u00ebt t\u00eb lejohet.\n

        \"4. <\/li>\n

      4. *M\u00eb sip\u00ebr \u00ebsht\u00eb paraqitur minimumi i hapave p\u00ebr t\u00eb konfiguruar Qasjen e Larg\u00ebt. Por p\u00ebrpara se t\u00eb testojm\u00eb lidhjen, le t\u00eb shqyrtojm\u00eb konfigurimet shtes\u00eb, duke kaluar n\u00eb sked\u00ebn VPN \u2192 Qasje e Larg\u00ebt \u2192 Avancuar <\/strong>\n

        \"4.
        \n<\/p>\n

        Duke u bazuar n\u00eb konfigurimet aktuale, ne shohim se p\u00ebrdoruesit e larg\u00ebt, kur lidhen, do t\u00eb marrin nj\u00eb adres\u00eb IP nga rrjeti 172.16.11.0\/24, p\u00ebr shkak t\u00eb opsionit t\u00eb Modalitetit t\u00eb Zyr\u00ebs. Kjo \u00ebsht\u00eb mjaft e mjaftueshme p\u00ebr t\u00eb p\u00ebrdorur 200 licenca konkurruese (t\u00eb dh\u00ebna p\u00ebr 1590 NGFW t\u00eb Check Point). \n<\/p>\n

        <\/p>\n

        Opcioni \u00abRrjetat trafikun e Internetit nga klient\u00ebt e lidhur p\u00ebrmes k\u00ebtij gateway\u00bb<\/i> \u00ebsht\u00eb fakultative dhe p\u00ebrgjigjet p\u00ebr rrjetimin e t\u00eb gjith\u00eb trafikut nga p\u00ebrdoruesi i larg\u00ebt n\u00ebp\u00ebr k\u00ebt\u00eb gateway (p\u00ebrfshir\u00eb edhe lidhjet n\u00eb Internet). Kjo lejon inspektimin e trafik t\u00eb p\u00ebrdoruesit dhe mbrojtjen e stacionit t\u00eb tij t\u00eb pun\u00ebs nga k\u00ebrc\u00ebnime dhe malware t\u00eb ndryshme. \n<\/p>\n<\/li>\n

      5. *Puna me politikat e qasjes p\u00ebr Qasjen e Larg\u00ebt \n

        Pas konfigurimit t\u00eb Qasjes s\u00eb Larg\u00ebt, \u00ebsht\u00eb krijuar nj\u00eb rregull automatik qasjeje n\u00eb nivelin e Firewall, p\u00ebr ta par\u00eb at\u00eb, ne duhet t\u00eb kalojm\u00eb n\u00eb sked\u00ebn: Politika e Qasjes \u2192 Firewall \u2192 Politika <\/strong><\/p>\n

        \n\"4.
        \n<\/p>\n

        N\u00eb k\u00ebt\u00eb rast, p\u00ebrdoruesit e larg\u00ebt, q\u00eb b\u00ebjn\u00eb pjes\u00eb n\u00eb grupin e krijuar m\u00eb par\u00eb, do t\u00eb mund t\u00eb ken\u00eb akses n\u00eb t\u00eb gjitha burimet e brendshme t\u00eb kompanis\u00eb, v\u00ebrej se rregulli ndodhet n\u00eb seksionin e zakonsh\u00ebm \u201cTrafiku n\u00eb ardhje, t\u00eb brendsh\u00ebm dhe VPN\u201d<\/i>. P\u00ebr t\u00eb lejuar trafikun e p\u00ebrdoruesve VPN n\u00eb Internet, do t\u00eb nevojitet t\u00eb krijoni nj\u00eb rregull t\u00eb ve\u00e7ant\u00eb n\u00eb seksionin e zakonsh\u00ebm \u201cAksesi n\u00eb Internet n\u00eb dalje<\/i>\u201d.<\/p>\n<\/li>\n

      6. \n

        N\u00eb fund, na mbetet t\u00eb sigurohemi q\u00eb p\u00ebrdoruesi mund t\u00eb krijoj\u00eb me sukses nj\u00eb tunel VPN deri n\u00eb gateway-ngfj at\u00ebher\u00eb dhe t\u00eb ket\u00eb akses n\u00eb burimet e brendshme t\u00eb kompanis\u00eb. P\u00ebr k\u00ebt\u00eb duhet t\u00eb instaloni klientin VPN n\u00eb hostin q\u00eb po testohet, p\u00ebr ndihmes\u00eb \u00ebsht\u00eb bashkangjitur link<\/a><\/noindex> p\u00ebr shkarkim. Pas instalimit, do t\u00eb duhet t\u00eb kryeni procedur\u00ebn standarde p\u00ebr t\u00eb shtuar nj\u00eb site t\u00eb re (duhet t\u00eb jepni IP-n\u00eb publike t\u00eb gateway tuaj). P\u00ebr leht\u00ebsi, procesi \u00ebsht\u00eb paraqitur n\u00eb form\u00eb GIF.<\/p>\n

        \n\"4.
        \n
        \nKada lidhja \u00ebsht\u00eb vendosur, le t\u00eb shqyrtojm\u00eb adres\u00ebn IP t\u00eb marr\u00eb n\u00eb masin\u00eb prit\u00ebse me ndihm\u00ebn e komand\u00ebs n\u00eb CMD: ipconfig<\/i><\/p>\n

        \"4.
        \n<\/p>\n

        K\u00ebrkuam q\u00eb adaptori virtual i rrjetit ka marr\u00eb nj\u00eb adres\u00eb IP nga M\u00ebnyra Office e NGFW ton\u00eb, paketat d\u00ebrgohen me sukses. P\u00ebr t\u00eb p\u00ebrfunduar, mund t\u00eb kalojm\u00eb n\u00eb Gaia Portal: VPN \u2192 Aksesi i Larg\u00ebt \u2192 P\u00ebrdoruesit e Lidhur n\u00eb Larg<\/strong>\n<\/p>\n

        \"4.
        \n<\/p>\n

        P\u00ebrdoruesi \u201cntuser\u201d shfaqet si i lidhur, le t\u00eb kontrollojm\u00eb regjistrimin e ngjarjeve, duke kaluar n\u00eb Logs & Monitoring \u2192 Regjistrat e Siguris\u00eb<\/strong>\n<\/p>\n

        \"4.
        \n<\/p>\n

        Regjistrimi i lidhjes po ndodh, si burim shfaqet adresa IP: 172.16.10.1 \u2014 kjo \u00ebsht\u00eb adresa e marr\u00eb nga p\u00ebrdoruesi yn\u00eb p\u00ebrmes m\u00ebnyr\u00ebs Office. \n<\/p>\n

        <\/p>\n

        3. Klient\u00ebt e mb\u00ebshtetur p\u00ebr Aksesi t\u00eb Larg\u00ebt<\/h3>\n

        <\/p>\n

        Pasi kemi shqyrtuar procedur\u00ebn e konfigurimit t\u00eb lidhjes s\u00eb larg\u00ebt n\u00eb zyr\u00ebn tuaj, me ndihm\u00ebn e NGFW Check Point nga familja SMB, do t\u00eb doja t\u00eb flisja p\u00ebr mb\u00ebshtetje p\u00ebr klient\u00ebt p\u00ebr pajisje t\u00eb ndryshme:<\/p>\n

        <\/p>\n