{"id":90211,"date":"2020-07-30T01:42:13","date_gmt":"2020-07-29T23:42:13","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/4-ngfw-dlya-malogo-biznesa-vpn"},"modified":"2020-07-30T01:42:13","modified_gmt":"2020-07-29T23:42:13","slug":"4-ngfw-dlya-malogo-biznesa-vpn","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/4-ngfw-dlya-malogo-biznesa-vpn","title":{"rendered":"4. NGFW p\u00ebr bizneset e vogla. VPN","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"4.
\n<\/p>\n

Vazhdojm\u00eb ciklin ton\u00eb t\u00eb artikujve mbi NGFW p\u00ebr biznesin e vog\u00ebl, dhe m\u00eb kujton se po shqyrtojm\u00eb serin\u00eb e re t\u00eb modeleve 1500. N\u00eb pjesa 1<\/a><\/noindex> ciklin p\u00ebrmenda nj\u00eb nga opsionet m\u00eb t\u00eb dobishme kur blini pajisjen SMB \u2014 dor\u00ebzimi i portave me licencat e integruara Mobile Access (nga 100 deri n\u00eb 200 p\u00ebrdorues var\u00ebsisht nga modeli). N\u00eb k\u00ebt\u00eb artikull do t\u00eb shqyrtojm\u00eb konfigurimin e VPN p\u00ebr portat e seris\u00eb 1500, q\u00eb vijn\u00eb me Gaia 80.20 Embedded t\u00eb instaluar paraprakisht. Ja nj\u00eb p\u00ebrmbledhje e shkurt\u00ebr:<\/p>\n

<\/p>\n

    \n
  1. Mund\u00ebsit\u00eb e VPN p\u00ebr SMB.<\/li>\n
  2. Organizimi i Remote Access p\u00ebr nj\u00eb zyr\u00eb t\u00eb vog\u00ebl.<\/li>\n
  3. KLIENT\u00cbT E DISPONUESHEM P\u00cbR LIDHJE.<\/li>\n<\/ol>\n

    <\/a><\/noindex><\/p>\n

    1. Mund\u00ebsit\u00eb e VPN p\u00ebr SMB<\/h3>\n

    <\/p>\n

    P\u00ebr t\u00eb p\u00ebrgatitur materialin e sot\u00ebm, u p\u00ebrdor guida zyrtare e administratorit<\/a><\/noindex> e versionit R80.20.05 (n\u00eb momentin e publikimit t\u00eb artikullit \u2014 aktual). Prandaj, n\u00eb pjes\u00ebn e VPN n\u00eb Gaia 80.20 Embedded ka mb\u00ebshtetje:<\/p>\n

    <\/p>\n

      \n
    1. Site-To-Site. Krijimi i tunel\u00ebve VPN mes zyrave tuaja, ku p\u00ebrdoruesit mund t\u00eb punojn\u00eb si n\u00eb nj\u00eb rrjet 'lokal'.\n

      \"4.\n<\/li>\n

    2. Aksesi n\u00eb distanc\u00eb. Aksesi n\u00eb burimet e zyr\u00ebs tuaj p\u00ebrmes pajisjeve t\u00eb p\u00ebrdoruesve (PC, telefoni celular etj.). P\u00ebr m\u00eb tep\u00ebr, ekziston SSL Network Extender, i cili lejon publikimin e aplikacioneve t\u00eb ve\u00e7anta dhe ekzekutimin e tyre p\u00ebrmes Java Applet, duke u lidhur p\u00ebrmes SSL. Sh\u00ebnim:<\/u> mos e ngat\u00ebrroni me Mobile Access Portal (podhtet n\u00eb Gaia Embedded nuk \u00ebsht\u00eb i mb\u00ebshtetur).
      \n<\/i>
      \n\"4.\n<\/li>\n<\/ol>\n

      <\/p>\n

      Shtes\u00eb<\/u><\/b> e rekomandoj fort kursin autorit TS Solution \u2014 Check Point Remote Access VPN<\/a><\/noindex> ai shqyrton teknologjit\u00eb e Check Point lidhur me VPN, trajton \u00e7\u00ebshtjet e licencimit dhe p\u00ebrmban udh\u00ebzime t\u00eb holl\u00ebsishme p\u00ebr konfigurimin.<\/p>\n

      <\/p>\n

      2. Aksesi n\u00eb distanc\u00eb p\u00ebr zyrat e vogla<\/h3>\n

      \nNe do t\u00eb fillojm\u00eb organizimin e lidhjes n\u00eb distanc\u00eb n\u00eb zyr\u00ebn tuaj:<\/p>\n

        \n
      1. P\u00ebr t\u00eb lejuar p\u00ebrdoruesit t\u00eb nd\u00ebrtojn\u00eb nj\u00eb VPN-tunel me gateway-in, duhet t\u00eb keni nj\u00eb adres\u00eb IP publike. N\u00ebse keni kryer konfigurimin fillestar (2 artikuj<\/a><\/noindex> nga cikli), at\u00ebher\u00eb zakonisht \u2014 External Link \u00ebsht\u00eb aktiv. Informacionin mund ta merrni duke kaluar n\u00eb Gaia Portal: Device \u2192 Network \u2192 Internet<\/b>\n

        \"4.
        \n<\/p>\n

        N\u00eb rast se kompania juaj p\u00ebrdor nj\u00eb adres\u00eb IP publike dinamike, at\u00ebher\u00eb mund t\u00eb p\u00ebrcaktoni Dynamic DNS. Kaloni n\u00eb Device <\/strong>\u2192 DDNS & Device Access<\/strong>\n<\/p>\n

        \"4.
        \n<\/p>\n

        Aktualisht ka mb\u00ebshtetje nga dy ofrues: DynDns dhe no-ip.com. P\u00ebr t\u00eb aktivizuar opsionin, duhet t\u00eb jepni akreditimet tuaja (login, fjal\u00ebkalim).\n<\/p>\n<\/li>\n

      2. M\u00eb pas do t\u00eb krijojm\u00eb nj\u00eb llogari p\u00ebrdoruesi, e cila do t\u00eb jet\u00eb e nevojshme p\u00ebr testimin e konfigurimeve: VPN \u2192 Remote Access \u2192 Remote Access Users<\/strong>\n

        \"4.
        \n<\/p>\n

        N\u00eb grupin (p\u00ebr shembull: remoteaccess) do t\u00eb krijojm\u00eb nj\u00eb p\u00ebrdorues, duke ndjekur udh\u00ebzimet n\u00eb screenshot. Konfigurimi i llogaris\u00eb \u00ebsht\u00eb standard, vendosim login dhe fjal\u00ebkalim, dhe p\u00ebr m\u00eb tep\u00ebr aktivizojm\u00eb opsionin Remote Access permissions. \n<\/p>\n

        \"4.
        \n<\/p>\n

        N\u00ebse keni aplikuar me sukses konfigurimet, duhet t\u00eb shfaqen dy objekte: p\u00ebrdoruesi lokal, grupi lokal i p\u00ebrdoruesve.<\/p>\n

        \"4.<\/li>\n

      3. Hapi tjet\u00ebr \u00ebsht\u00eb t\u00eb kalojm\u00eb n\u00eb VPN \u2192 Remote Access \u2192 Blade Control. <\/strong>Sigurohuni q\u00eb bladi juaj t\u00eb jet\u00eb aktiv dhe trafiku nga p\u00ebrdoruesit e larg\u00ebt t\u00eb jet\u00eb i lejuar.\n

        \"4. <\/li>\n

      4. *M\u00eb sip\u00ebr \u00ebsht\u00eb prezantuar nj\u00eb set minimal hap\u00ebsh p\u00ebr t\u00eb konfigurimin e Remote Access. Por para se t\u00eb testojm\u00eb lidhjen, le t\u00eb shqyrtojm\u00eb konfigurime t\u00eb tjera, duke kaluar n\u00eb tabin VPN \u2192 Remote Access \u2192 Advanced <\/strong>\n

        \"4.
        \n<\/p>\n

        Duke nga konfigurimet aktuale, ne shohim se p\u00ebrdoruesit e p\u00ebrjashtuar gjat\u00eb lidhjes do t\u00eb marrin nj\u00eb IP nga rrjeti 172.16.11.0\/24, fal\u00eb opsionit Office Mode. Kjo \u00ebsht\u00eb m\u00eb se e mjaftueshme p\u00ebr t\u00eb p\u00ebrdorur 200 licenca konkurrente (t\u00eb cilat jan\u00eb t\u00eb specifikuara p\u00ebr 1590 NGFW Check Point). \n<\/p>\n

        <\/p>\n

        Opcioni \u00abRrjeti i internetit t\u00eb trafikut nga klient\u00ebt e lidhur p\u00ebrmes k\u00ebtij gateway\u00bb<\/i> \u00ebsht\u00eb opsionale dhe merret me drejtimin e t\u00eb gjith\u00eb trafikut nga p\u00ebrdoruesi i larg\u00ebt p\u00ebrmes k\u00ebtij gateway (p\u00ebrfshir\u00eb lidhjet n\u00eb internet). Kjo lejon inspektimin e trafikut t\u00eb p\u00ebrdoruesit dhe mbrojtjen e stacionit t\u00eb tij t\u00eb pun\u00ebs nga k\u00ebrc\u00ebnime dhe malware t\u00eb ndryshme. \n<\/p>\n<\/li>\n

      5. *Puna me politikat e aksesit p\u00ebr Remote Access \n

        Pas konfigurimit t\u00eb Remote Access, u krijua nj\u00eb rregull automatik akses n\u00eb nivelin Firewall; p\u00ebr ta par\u00eb, duhet t\u00eb kaloni te mums tab: Politika e Aksesit \u2192 Firewall \u2192 Politika <\/strong><\/p>\n

        \n\"4.
        \n<\/p>\n

        N\u00eb k\u00ebt\u00eb rast, p\u00ebrdoruesit e larg\u00ebt, q\u00eb po hyjn\u00eb n\u00eb grupin e krijuar m\u00eb par\u00eb, do t\u00eb ken\u00eb qasje n\u00eb t\u00eb gjitha burimet e brendshme t\u00eb kompanis\u00eb, p\u00ebr t'u theksuar se rregulli \u00ebsht\u00eb n\u00eb seksionin e p\u00ebrgjithsh\u00ebm \u201cTrafiku i ardhsh\u00ebm, t\u00eb brendsh\u00ebm dhe VPN\u201d<\/i>. P\u00ebr t\u00eb lejuar trafikun e p\u00ebrdoruesve t\u00eb VPN n\u00eb internet, do t\u00eb duhet t\u00eb krijoni nj\u00eb rregull t\u00eb ve\u00e7ant\u00eb n\u00eb seksionin e p\u00ebrgjithsh\u00ebm \u201cQasja e dh\u00ebn\u00eb n\u00eb Internet<\/i>\u201d.<\/p>\n<\/li>\n

      6. \n

        N\u00eb fund, na mbetet t\u00eb sigurohemi se p\u00ebrdoruesi mund t\u00eb krijoj\u00eb me sukses nj\u00eb tunel VPN deri te porta jon\u00eb NGFW dhe t\u00eb ket\u00eb qasje n\u00eb burimet e brendshme t\u00eb kompanis\u00eb. P\u00ebr k\u00ebt\u00eb, \u00ebsht\u00eb e nevojshme t\u00eb instalohet nj\u00eb klient VPN n\u00eb hostin e testuar, n\u00eb ndihm\u00eb bashk\u00ebngjitet link<\/a><\/noindex> p\u00ebr shkarkim. Pas instalimit, do t\u00eb duhet t\u00eb ndiqet procedura standarde p\u00ebr shtimin e nj\u00eb site t\u00eb ri (adresa publike IP e port\u00ebs suaj p\u00ebrcaktohet). P\u00ebr leht\u00ebsim, procesi \u00ebsht\u00eb i paraqitur si GIF<\/p>\n

        \n\"4.
        \n
        \nKur lidhja \u00ebsht\u00eb vendosur, verifikojm\u00eb adres\u00ebn IP t\u00eb marr\u00eb n\u00eb makin\u00ebn host duke p\u00ebrdorur komand\u00ebn n\u00eb CMD: ipconfig<\/i><\/p>\n

        \"4.
        \n<\/p>\n

        Kemi konfirmuar q\u00eb adapteri virtual i rrjetit mori adres\u00ebn IP nga M\u00ebnyra Office e NGFW ton\u00eb, paketat d\u00ebrgohen me sukses. P\u00ebr t\u00eb p\u00ebrfunduar, mund t\u00eb kalojm\u00eb n\u00eb Gaia Portal: VPN \u2192 Remote Access \u2192 P\u00ebrdoruesit e Lidhur t\u00eb Uj\u00ebrave<\/strong>\n<\/p>\n

        \"4.
        \n<\/p>\n

        P\u00ebrdoruesi \u201cntuser\u201d shfaqet si i lidhur, le t\u00eb kontrollojm\u00eb regjistrimin e ngjarjeve duke kaluar n\u00eb Logs & Monitoring \u2192 Regjistrat e Siguris\u00eb<\/strong>\n<\/p>\n

        \"4.
        \n<\/p>\n

        Regjistrimi i lidhjes ndodhi, si burimi sh\u00ebrben adresa IP: 172.16.10.1 \u2014 ky \u00ebsht\u00eb adresa e marr\u00eb nga p\u00ebrdoruesi yn\u00eb p\u00ebrmes m\u00ebnyr\u00ebs Office Mode. \n<\/p>\n

        <\/p>\n

        3. Klient\u00ebt e mb\u00ebshtetur p\u00ebr Qasjen e Larg\u00ebt<\/h3>\n

        <\/p>\n

        Pasi kemi shqyrtuar procedur\u00ebn p\u00ebr konfigurimin e lidhjes s\u00eb larg\u00ebt n\u00eb zyr\u00ebn tuaj, me ndihm\u00ebn e NGFW Check Point t\u00eb familjes SMB, d\u00ebshiroj t\u00eb shkruaj p\u00ebr mb\u00ebshtetje klient\u00ebsh p\u00ebr pajisje t\u00eb ndryshme:<\/p>\n

        <\/p>\n