Funksionet funksionale - \u00e7far\u00eb mundet nj\u00eb teknologji, t\u00eb cil\u00ebn tjetra nuk e mund dot? Dhe a \u00ebsht\u00eb kjo e r\u00ebnd\u00ebsishme?<\/li>\n<\/ul>\n<\/p>\n
N\u00eb \u00e7far\u00eb p\u00ebrb\u00ebhen dallimet arkitektonike dhe a jan\u00eb ato kaq t\u00eb r\u00ebnd\u00ebsishme?<\/h3>\n \nN\u00eb secil\u00ebn nga teknologjit\u00eb e p\u00ebrmendura ka shum\u00eb 'k\u00ebmb\u00ebngul\u00ebse', t\u00eb cil\u00ebt kan\u00eb rol t\u00eb ndrysh\u00ebm, por gjithashtu parime t\u00eb ndryshme bashk\u00ebpunimi midis tyre. Nga sa jan\u00eb menduar k\u00ebto parime, varet direkt shkall\u00ebzimi i zgjidhjes, q\u00ebndrueshm\u00ebria e saj dhe efikasiteti i p\u00ebrgjithsh\u00ebm. <\/p>\n
Le t\u00eb shqyrtojm\u00eb aspektet e ndryshme t\u00eb arkitektur\u00ebs m\u00eb n\u00eb detaje:<\/p>\n
Data-plane<\/b> - pjesa e zgjidhjes q\u00eb \u00ebsht\u00eb p\u00ebrgjegj\u00ebse p\u00ebr transmetimin e trafikut t\u00eb p\u00ebrdoruesve midis burimit dhe marr\u00ebsit. N\u00eb DMVPN dhe SD-WAN, kjo realizohet n\u00eb p\u00ebrgjith\u00ebsi n\u00eb t\u00eb nj\u00ebjt\u00ebn m\u00ebnyr\u00eb n\u00eb router\u00ebt p\u00ebrmes tunelave Multipoint GRE. Dallimi q\u00ebndron n\u00eb at\u00eb se si formohet grupi i nevojsh\u00ebm i parametrave t\u00eb k\u00ebtyre tunelave:<\/p>\n\nn\u00eb DMVPN\/PfR<\/b> - \u00ebsht\u00eb nj\u00eb hierarki dy-nivelash e nodave me nj\u00eb topologji t\u00eb tipit 'Yll' ose Hub-n-Spoke. Konfigurimi statik i Hub-it dhe lidhja statike e Spoke me Hub-in jan\u00eb t\u00eb detyrueshme, si dhe bashk\u00ebpunimi n\u00ebp\u00ebrmjet protokollit NHRP p\u00ebr formimin e lidhshm\u00ebris\u00eb data-plane. Si pasoj\u00eb, ndryshimet n\u00eb Hub<\/b>- jan\u00eb shum\u00eb t\u00eb v\u00ebshtira, t\u00eb tilla si ndryshimi\/lidhja e kanaleve t\u00eb reja WAN ose ndryshimi i parametrave t\u00eb atyre ekzistuesve.<\/li>\nn\u00eb SD-WAN<\/b> - \u00ebsht\u00eb nj\u00eb model plot\u00ebsisht dinamik p\u00ebr zbulimin e parametrave t\u00eb tunelave t\u00eb vendosura me mb\u00ebshtetje nga control-plane (protokolli OMP) dhe orchestration-plane (interaksioni me controller-in vBond p\u00ebr detyra zbulimi t\u00eb controller-\u00ebve dhe NAT traversal). N\u00eb k\u00ebt\u00eb rast, topologjit\u00eb mund t\u00eb jen\u00eb \u00e7far\u00ebdo, duke p\u00ebrfshir\u00eb hierarkike. Brenda topologjis\u00eb s\u00eb vendosur t\u00eb tunelave, \u00ebsht\u00eb e mundur nj\u00eb konfigurim fleksib\u00ebl i topologjis\u00eb logjike n\u00eb \u00e7do VPN (VRF) t\u00eb ve\u00e7ant\u00eb.<\/li>\n<\/ul>\n Control-plane<\/b> - funksionet e shk\u00ebmbimit, filtrimin dhe modifikimin e informacionit t\u00eb rrug\u00ebve dhe t\u00eb tjer\u00eb midis komponenteve t\u00eb zgjidhjes. <\/p>\n\nn\u00eb DMVPN\/PfR<\/b> - realizohet vet\u00ebm midis router\u00ebve Hub dhe Spoke. Shk\u00ebmbimi direkt i informacionit t\u00eb rrug\u00ebve midis Spoke nuk \u00ebsht\u00eb i mundur. Si rezultat, pa nj\u00eb Hub funksional, nuk mund t\u00eb funksionoj\u00eb control-plane dhe data-plane<\/b>, q\u00eb imponon k\u00ebrkesa shtes\u00eb p\u00ebr disponueshm\u00ebrin\u00eb e lart\u00eb t\u00eb Hub-it, t\u00eb cilat nuk mund t\u00eb p\u00ebrmbushen gjithmon\u00eb.<\/li>\nn\u00eb SD-WAN<\/b> \u2013 control-plane nuk i realizohet kurr\u00eb direkt mes ruter\u00ebve \u2013 interaksioni ndodh mbi baz\u00ebn e protokollit OMP dhe patjet\u00ebr realizohet p\u00ebrmes nj\u00eb tipi t\u00eb ve\u00e7ant\u00eb t\u00eb kontrolluesit vSmart, q\u00eb siguron mund\u00ebsin\u00eb e balancimit, geo-rezervimit dhe menaxhimit qendror t\u00eb ngarkesave t\u00eb sinjalit. Nj\u00eb ve\u00e7ori tjet\u00ebr e protokollit OMP \u00ebsht\u00eb q\u00ebndrueshm\u00ebria e tij e lart\u00eb ndaj humbjeve dhe pavar\u00ebsia nga shpejt\u00ebsia e kanaleve t\u00eb komunikimit me kontrolluesit (brenda kufijve t\u00eb arsyesh\u00ebm, sigurisht). Kjo gjithashtu lejon vendosjen e kontrolluesve SD-WAN n\u00eb cloud publik ose privat me qasje p\u00ebrmes Internetit.<\/li>\n<\/ul>\n Policy-plane<\/b> \u2013 pjesa e zgjidhjes q\u00eb \u00ebsht\u00eb p\u00ebrgjegj\u00ebse p\u00ebr p\u00ebrcaktimin, shp\u00ebrndarjen dhe zbatimin e politikave t\u00eb menaxhimit t\u00eb trafikut n\u00eb rrjetin e shp\u00ebrndar\u00eb.<\/p>\n\nDMVPN <\/b>\u2013 n\u00eb fakt kufizohet n\u00eb politikat e cil\u00ebsis\u00eb s\u00eb sh\u00ebrbimit (QoS), q\u00eb jan\u00eb t\u00eb konfigurueshme individualisht n\u00eb \u00e7do ruter p\u00ebrmes CLI ose shablloneve t\u00eb Infrastruktur\u00ebs Prime.<\/li>\nDMVPN\/PfR<\/b> \u2013 politikat PfR formohen n\u00eb ruterin qendror Master Controller (MC) p\u00ebrmes CLI dhe m\u00eb pas shp\u00ebrndahen automatikisht n\u00eb MC t\u00eb filialeve. N\u00eb k\u00ebt\u00eb proces p\u00ebrdoren t\u00eb nj\u00ebjtat rrug\u00eb p\u00ebr transferimin e politikave si p\u00ebr data-plane. Nuk ka mund\u00ebsi t\u00eb ndahen shk\u00ebmbimet e politikave, informacionit t\u00eb \u043c\u0430\u0440\u0448\u0440\u0443t e t\u00eb dh\u00ebnave t\u00eb p\u00ebrdoruesve. Shp\u00ebrndarja e politikave k\u00ebrkon domosdoshm\u00ebrin\u00eb e lidhjes IP midis Hub dhe Spoke. Funksioni MC mund t\u00eb bashkohet me ruterin DMVPN n\u00ebse \u00ebsht\u00eb e nevojshme. P\u00ebr ndihm\u00eb (por jo e k\u00ebrkuar) mund t\u00eb p\u00ebrdoren shabllone t\u00eb Infrastruktur\u00ebs Prime p\u00ebr formimin qendror t\u00eb politikave. Nj\u00eb ve\u00e7ori e r\u00ebnd\u00ebsishme \u00ebsht\u00eb q\u00eb politika formohet globalisht n\u00eb t\u00eb gjith\u00eb rrjetin n\u00eb m\u00ebnyr\u00eb t\u00eb barabart\u00eb \u2013 politika individuale p\u00ebr segmente t\u00eb ve\u00e7anta nuk mb\u00ebshtetet<\/b>.<\/li>\nSD-WAN<\/b> \u2013 politikatat e menaxhimit t\u00eb trafikut dhe cil\u00ebsis\u00eb s\u00eb sh\u00ebrbimit p\u00ebrcaktohen qendrorisht p\u00ebrmes nd\u00ebrfaqes grafike Cisco vManage, e cila \u00ebsht\u00eb e aksesueshme edhe p\u00ebrmes Internetit (n\u00ebse \u00ebsht\u00eb e nevojshme). Ato shp\u00ebrndahen p\u00ebrmes kanaleve t\u00eb sinjalit drejtp\u00ebrdrejt ose n\u00eb m\u00ebnyr\u00eb t\u00eb t\u00ebrthort\u00eb p\u00ebrmes kontrolluesve vSmart (varet nga lloji i politik\u00ebs). Ato nuk varen nga lidhshm\u00ebria e data-plane midis ruter\u00ebve, pasi p\u00ebrdorin t\u00eb gjitha rrug\u00ebt e disponueshme p\u00ebr transferimin e trafikut midis kontrolluesit dhe ruterit.\n P\u00ebr segmente t\u00eb ndryshme t\u00eb rrjetit, \u00ebsht\u00eb e mundur formimi fleksib\u00ebl i politikave t\u00eb ndryshme \u2013 sfera e aplikimit t\u00eb politik\u00ebs p\u00ebrcaktohet nga shum\u00eb identifikues unik\u00eb q\u00eb parashikohen n\u00eb zgjidhje \u2013 numri i filialeve, lloji i aplikacionit, drejtimi i l\u00ebvizjes s\u00eb trafikut etj.\n<\/li>\n<\/ul>\n
Orchestration-plane<\/b> \u2013 mekanizmat q\u00eb lejojn\u00eb komponent\u00ebt t\u00eb zbulojn\u00eb dinamikisht nj\u00ebri-tjetrin, t\u00eb konfigurojn\u00eb dhe t\u00eb koordinojn\u00eb nd\u00ebrveprimin e m\u00ebpassh\u00ebm.<\/p>\n\nn\u00eb DMVPN\/PfR<\/b> zbulesa reciproke e ruter\u00ebve bazohet n\u00eb konfigurimin statik t\u00eb pajisjeve Hub dhe konfigurimin e duhur t\u00eb pajisjeve Spoke. Zbulesa dinamike ndodh vet\u00ebm p\u00ebr Spoke, i cili raporton parametrat e lidhjes s\u00eb tij n\u00eb pajisjen Hub, e cila gjithashtu \u00ebsht\u00eb futur paraprakisht n\u00eb konfigurimin e Spoke. Pa lidhshm\u00ebrin\u00eb IP t\u00eb Spoke me t\u00eb pakt\u00ebn nj\u00eb Hub, nuk \u00ebsht\u00eb e mundur t\u00eb formohet as data-plane as control-plane.<\/b><\/li>\nn\u00eb SD-WAN<\/b> orkestrimi i komponent\u00ebve t\u00eb zgjidhjes ndodh p\u00ebrmes kontrolluesit vBond, me t\u00eb cilin \u00e7do komponent (ruter\u00ebt dhe kontrolluesit vManage\/vSmart) duhet t\u00eb krijoj\u00eb m\u00eb par\u00eb lidhshm\u00ebrin\u00eb IP.\n Fillimisht, komponent\u00ebt nuk din\u00eb p\u00ebr parametrat e lidhjes s\u00eb nj\u00ebri-tjetrit \u2013 p\u00ebr k\u00ebt\u00eb ata kan\u00eb p\u00ebr t\u00eb nevojitur nj\u00eb nd\u00ebrmjet\u00ebs-orkestrues vBond. Parimi i p\u00ebrgjithsh\u00ebm \u00ebsht\u00eb \u2013 \u00e7do komponent n\u00eb faz\u00ebn fillestare merr informacion (automatikisht ose statikisht) vet\u00ebm p\u00ebr parametrat e lidhjes me vBond, pastaj vBond e informon ruterin p\u00ebr kontrolluesit vManage dhe vSmart (t\u00eb zbuluar m\u00eb par\u00eb), gj\u00eb q\u00eb b\u00ebn t\u00eb mundur krijimin automatik t\u00eb t\u00eb gjitha lidhjeve t\u00eb nevojshme t\u00eb sinjalit. <\/p>\n
Hapi tjet\u00ebr \u00ebsht\u00eb q\u00eb ruterit t\u00eb ri i jepet informacion mbi ruter\u00ebt e tjer\u00eb n\u00eb rrjet p\u00ebrmes shk\u00ebmbimit OMP me kontrolluesin vSmart. N\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb, nj\u00eb ruter q\u00eb fillimisht nuk di asgj\u00eb p\u00ebr parametrat e rrjetit mund t\u00eb zbuloj\u00eb dhe lidhet automatikisht me kontrolluesit dhe m\u00eb pas gjithashtu t\u00eb zbuloj\u00eb dhe t\u00eb formoj\u00eb lidhshm\u00ebrin\u00eb me ruter\u00ebt e tjer\u00eb. N\u00eb k\u00ebt\u00eb rast, parametrat e lidhjeve t\u00eb t\u00eb gjith\u00eb komponent\u00ebve fillimisht nuk dihen dhe gjat\u00eb procesit t\u00eb funksionimit mund t\u00eb ndryshojn\u00eb.\n<\/li>\n<\/ul>\n
Management-plane<\/b> \u2013 pjesa e zgjidhjes q\u00eb siguron menaxhim dhe monitorim qendror.<\/p>\n\nDMVPN\/PfR<\/b> \u2013 nuk parashikohet nj\u00eb zgjidhje t\u00eb specializuar p\u00ebr management-plane. P\u00ebr automatizimin dhe monitorimin bazik, mund t\u00eb p\u00ebrdoren produkte si Cisco Prime Infrastructure. \u00c7do ruter ka mund\u00ebsin\u00eb e menaxhimit p\u00ebrmes komand\u00ebs s\u00eb linj\u00ebs CLI. Integrimet me sistemet e jashtme p\u00ebrmes API nuk parashikohen.<\/b><\/li>\nSD-WAN<\/b> \u2013 t\u00eb gjitha nd\u00ebrveprimet dhe monitorimi i zakonsh\u00ebm realizohet centralisht p\u00ebrmes nd\u00ebrfaqes grafike t\u00eb kontrollit vManage. T\u00eb gjitha mund\u00ebsit\u00eb e zgjidhjes, pa p\u00ebrjashtim, jan\u00eb t\u00eb disponueshme p\u00ebr konfigurim p\u00ebrmes vManage, si dhe p\u00ebrmes bibliotek\u00ebs s\u00eb dokumentuar t\u00eb nd\u00ebrfaqes s\u00eb programimit REST API.\n T\u00eb gjitha konfigurimet e rrjetit SD-WAN n\u00eb vManage p\u00ebrqendrohen n\u00eb dy konstruktet kryesore \u2013 formimi i template-ve t\u00eb pajisjeve (Device Template) dhe formimi i politik\u00ebs, e cila p\u00ebrcakton logjik\u00ebn e funksionimit t\u00eb rrjetit dhe p\u00ebrpunimit t\u00eb trafikut. Nd\u00ebrkoh\u00eb, vManage, duke transmetuar politik\u00ebn e formuar nga administrator\u00ebt, p\u00ebrzgjedh automatikisht cilat ndryshime dhe n\u00eb cilat pajisje\/kontrollues individuale duhet t\u00eb realizohen, gj\u00eb q\u00eb e rrit ndjesh\u00ebm efikasitetin dhe shkall\u00ebzueshm\u00ebrin\u00eb e zgjidhjes.<\/p>\n
P\u00ebrmes nd\u00ebrfaqes vManage, \u00ebsht\u00eb e mundur jo vet\u00ebm konfigurimi i zgjidhjes Cisco SD-WAN, por gjithashtu monitorimi i plot\u00eb i gjendjes s\u00eb t\u00eb gjitha komponenteve t\u00eb zgjidhjes, deri n\u00eb gjendjen aktuale t\u00eb metrikeve t\u00eb tunel\u00ebve individual\u00eb dhe statistik\u00ebn e p\u00ebrdorimit t\u00eb aplikacioneve t\u00eb ndryshme n\u00eb baz\u00eb t\u00eb analiz\u00ebs DPI.<\/p>\n
Pavar\u00ebsisht centralizimit t\u00eb nd\u00ebrveprimit, t\u00eb gjitha komponent\u00ebt (kontrolluesit dhe ruter\u00ebt) disponojn\u00eb gjithashtu nj\u00eb terminal t\u00eb plot\u00eb CLI, i cili nevojitet n\u00eb faz\u00ebn e implementimit ose n\u00eb rast situatash t\u00eb jashtzakonshme p\u00ebr diagnostikim lokal. N\u00eb modalitetin e zakonsh\u00ebm (me prani t\u00eb kanalit sinjalizues midis komponent\u00ebve), n\u00eb ruter\u00ebt, terminali \u00ebsht\u00eb i disponuesh\u00ebm vet\u00ebm p\u00ebr diagnostikim dhe nuk \u00ebsht\u00eb i disponuesh\u00ebm p\u00ebr ndryshime lokale, gj\u00eb q\u00eb garanton sigurin\u00eb lokale dhe burimin e vet\u00ebm t\u00eb ndryshimeve n\u00eb nj\u00eb rrjet t\u00eb till\u00eb \u2013 vManage.<\/li>\n<\/ul>\n
\nSiguria e integruar<\/b> \u2013 k\u00ebtu duhet t\u00eb flitet jo vet\u00ebm p\u00ebr mbrojtjen e t\u00eb dh\u00ebnave t\u00eb p\u00ebrdoruesve gjat\u00eb transmetimit n\u00eb kanale t\u00eb hapura, por gjithashtu p\u00ebr sigurin\u00eb e p\u00ebrgjithshme t\u00eb rrjetit WAN mbi baz\u00ebn e teknologjis\u00eb s\u00eb zgjedhur.<\/p>\n\nn\u00eb DMVPN\/PfR<\/b> \u00ebsht\u00eb parashikuar mund\u00ebsia e enkriptimit t\u00eb t\u00eb dh\u00ebnave t\u00eb p\u00ebrdoruesve dhe protokolleve t\u00eb sinjalizimit. Me p\u00ebrdorimin e modeleve t\u00eb caktuara t\u00eb ruter\u00ebve, jan\u00eb gjithashtu t\u00eb disponueshme funksionalitete t\u00eb firewall-it me inspektim t\u00eb trafikut, IPS\/IDS. Ekziston mund\u00ebsia e segmentimit t\u00eb rrjeteve t\u00eb deg\u00ebve duke p\u00ebrdorur VRF. Ka mund\u00ebsi autentifikimi (nj\u00eb-faktor) t\u00eb protokolleve t\u00eb kontrollit.\n Megjithat\u00eb, ruter\u00ebt e larg\u00ebt konsiderohen si element\u00eb t\u00eb besuesh\u00ebm t\u00eb rrjetit \u2013 dmth. nuk parashikohen dhe nuk merret parasysh rastet e komprometimit fizik t\u00eb pajisjeve individuale dhe mund\u00ebsia e qasjeve t\u00eb paautorizuara n\u00eb to, nuk ekziston autentifikimi me dy faktor\u00eb p\u00ebr komponent\u00ebt e zgjidhjes, gj\u00eb q\u00eb n\u00eb rastin e nj\u00eb rrjeti t\u00eb shp\u00ebrndar\u00eb gjeografikisht mund t\u00eb ket\u00eb rreziqe t\u00eb konsiderueshme shtes\u00eb.<\/b> <\/li>\nn\u00eb SD-WAN<\/b> n\u00eb p\u00ebrputhje me DMVPN \u00ebsht\u00eb parashikuar mund\u00ebsia e enkriptimit t\u00eb t\u00eb dh\u00ebnave t\u00eb p\u00ebrdoruesve, por me funksionalitete t\u00eb zgjeruara t\u00eb siguris\u00eb s\u00eb rrjetit dhe segmentim L3\/VRF (M\u00c7E, IPS\/IDS, filtrimi i URL-ve, filtrimi DNS, AMP\/TG, SASE, TLS\/SSL proxy etj.). Nd\u00ebrkoh\u00eb, shk\u00ebmbimi i \u00e7el\u00ebsave t\u00eb enkriptimit realizohet m\u00eb efektivisht p\u00ebrmes kontrolluesve vSmart (dhe jo direkt), p\u00ebrmes kanaleve t\u00eb sinjalizimit t\u00eb p\u00ebrcaktuara paraprakisht, t\u00eb mbrojtura nga enkriptimi DTLS\/TLS mbi baz\u00ebn e certifikatave t\u00eb siguris\u00eb. Kjo, nga ana e vet, garanton sigurin\u00eb e k\u00ebtij shk\u00ebmbimi dhe siguron nj\u00eb shkall\u00ebzim m\u00eb t\u00eb mir\u00eb t\u00eb zgjidhjes deri n\u00eb dhjet\u00ebra mij\u00ebra pajisje n\u00eb nj\u00eb rrjet.\n T\u00eb gjitha lidhjet e sinjalizimit (kontrollues-kontrollues, kontrollues-ruter) gjithashtu jan\u00eb t\u00eb mbrojtura mbi baz\u00ebn e DTLS\/TLS. Ruter\u00ebt furnizohen me certifikata sigurie n\u00eb prodhim me mund\u00ebsin\u00eb e z\u00ebvend\u00ebsimit\/zgjatjes. Autentifikimi me dy faktor\u00eb arrihet p\u00ebrmes p\u00ebrmbushjes s\u00eb detyruar dhe nj\u00ebkoh\u00ebsisht t\u00eb dy kushteve p\u00ebr mund\u00ebsin\u00eb e funksionimit t\u00eb ruterit\/kontrolluesit n\u00eb rrjetin SD-WAN:<\/p>\n
\nCertifikata e siguris\u00eb n\u00eb fuqi<\/li>\n Shtimi t\u00eb gjith\u00eb komponent\u00ebve nga administratori n\u00eb list\u00ebn e t\u00eb lejuarave t\u00eb pajisjeve.<\/li>\n<\/ul>\n\n<\/li>\n<\/ul>\n
Dallimet funksionale mes SD-WAN dhe DMVPN\/PfR<\/h2>\n \nDuke kaluar n\u00eb diskutimin e dallimeve funksionale, duhet theksuar se shum\u00eb nga ato jan\u00eb vazhdim i atyre arkitekturore - nuk \u00ebsht\u00eb sekret se gjat\u00eb formimit t\u00eb arkitektur\u00ebs s\u00eb zgjidhjes, zhvilluesit drejtohen nga ato mund\u00ebsi q\u00eb d\u00ebshirojn\u00eb t\u00eb arrijn\u00eb si rezultat. Le t\u00eb shqyrtojm\u00eb dallimet m\u00eb t\u00eb r\u00ebnd\u00ebsishme mes dy teknologjive.<\/p>\n
AppQ (Cil\u00ebsia e Aplikacionit)\u2013 funksione q\u00eb sigurojn\u00eb cil\u00ebsi n\u00eb transmetimin e trafik t\u00eb aplikacioneve biznesore.<\/h3>\n \nFunksionet kryesore t\u00eb teknologjive t\u00eb shqyrtuara kan\u00eb si q\u00ebllim t\u00eb p\u00ebrmir\u00ebsojn\u00eb sa m\u00eb shum\u00eb t\u00eb jet\u00eb e mundur p\u00ebrvoj\u00ebn e p\u00ebrdoruesit gjat\u00eb p\u00ebrdorimit t\u00eb aplikacioneve kritike p\u00ebr biznes n\u00eb nj\u00eb rrjet t\u00eb shp\u00ebrndar\u00eb. Kjo \u00ebsht\u00eb ve\u00e7an\u00ebrisht e r\u00ebnd\u00ebsishme n\u00eb kushte kur nj\u00eb pjes\u00eb e infrastruktur\u00ebs nuk kontrollohet nga IT apo madje nuk garanton transmetimin e suksessh\u00ebm t\u00eb t\u00eb dh\u00ebnave.<\/p>\n
DMVPN nuk ofron vet\u00eb mekanizmat e till\u00eb. M\u00eb e mira q\u00eb mund t\u00eb b\u00ebhet n\u00eb nj\u00eb rrjet klasik DMVPN \u00ebsht\u00eb klasifikimi i trafikut nga aplikacionet dhe p\u00ebrpar\u00ebsimi i tij kur d\u00ebrgohet n\u00eb drejtim t\u00eb kanaleve WAN. Zgjedhja e tunelit DMVPN n\u00eb k\u00ebt\u00eb rast \u00ebsht\u00eb thjesht e bazuar n\u00eb disponueshm\u00ebrin\u00eb e tij dhe rezultatet e protokollit t\u00eb routing-ut. N\u00eb k\u00ebt\u00eb rast, nuk merret parasysh gjendja e kalimit\/tunelit dhe degradimi i mundsh\u00ebm i tij nga pik\u00ebpamja e metrikave kryesore, t\u00eb r\u00ebnd\u00ebsishme p\u00ebr aplikacionet rrjet\u00ebrore \u2013 vonesa, variacioni i vones\u00ebs (jitter) dhe humbjet (%). Si pasoj\u00eb, krahasimi i drejtp\u00ebrdrejt\u00eb i DMVPN klasik me SD-WAN p\u00ebr zgjidhjen e problemeve AppQ humbet \u00e7do kuptim \u2013 DMVPN nuk mund ta zgjidh\u00eb k\u00ebt\u00eb problem. Nj\u00eb situat\u00eb ndryshe krijohet me integrimin e teknologjis\u00eb Cisco Performance Routing (PfR) n\u00eb k\u00ebt\u00eb kontekst, duke b\u00ebr\u00eb krahasimin me Cisco SD-WAN m\u00eb t\u00eb arsyesh\u00ebm. <\/p>\n
Para se t\u00eb kalojm\u00eb n\u00eb diskutimin e ndryshimeve, le t\u00eb flasim shkurtimisht p\u00ebr ngjashm\u00ebrit\u00eb midis teknologjive. Pra, t\u00eb dyja teknologjit\u00eb:<\/p>\n
\nkan\u00eb n\u00eb dispozicion nj\u00eb mekaniz\u00ebm q\u00eb lejon vler\u00ebsimin dinamik t\u00eb gjendjes s\u00eb secilit tunel t\u00eb vendosur sipas metrikave t\u00eb caktuara \u2013 s\u00eb paku, vonesa, variacioni i vones\u00ebs dhe humbjet e paketave (%)<\/li>\n p\u00ebrdorin nj\u00eb grup t\u00eb caktuar mjetesh p\u00ebr formimin, shp\u00ebrndarjen dhe zbatimin e rregullave (politikat) t\u00eb menaxhimit t\u00eb trafikut, duke marr\u00eb parasysh rezultatet e matjes s\u00eb gjendjes s\u00eb metrikave kryesore t\u00eb tunel\u00ebve.<\/li>\n klasifikojn\u00eb trafikun e aplikacioneve n\u00eb nivelet L3-L4 (DSCP) t\u00eb modelit OSI ose sipas n\u00ebnshkrimeve L7 t\u00eb aplikacioneve, bazuar n\u00eb mekanizmat e DPI t\u00eb integruar n\u00eb router.<\/li>\n lejojn\u00eb q\u00eb p\u00ebr aplikacionet e r\u00ebnd\u00ebsishme t\u00eb p\u00ebrcaktohen vlerat e pragut t\u00eb metrikave, rregullat e d\u00ebrgimit t\u00eb trafikut n\u00eb parazgjedhje dhe rregullat e ri-rutimit t\u00eb trafikut kur tejkalohen vlerat e pragut.<\/li>\n kur inkapsullohet trafiku n\u00eb GRE\/IPSec, p\u00ebrdorin mekanizmin e vendosur n\u00eb industri p\u00ebr transfert\u00ebn e markimeve t\u00eb brendshme DSCP n\u00eb titullin e jasht\u00ebm t\u00eb paket\u00ebs GRE\/IPSEC, duke lejuar sinkronizimin e politikave QoS t\u00eb organizat\u00ebs dhe operatorit t\u00eb komunikimit (n\u00eb rastin e nj\u00eb SLA p\u00ebrkat\u00ebs).<\/li>\n<\/ul>\n\n
Si ndryshojn\u00eb mekanizmat e vler\u00ebsimit t\u00eb metrikave t\u00eb kalimit SD-WAN dhe DMVPN\/PfR?<\/h3>\n \nDMVPN\/PfR <\/b><\/p>\n\nP\u00ebr vler\u00ebsimin e metrikave standard t\u00eb gjendjes s\u00eb tunelit p\u00ebrdoren sensor\u00eb (Probes) aktiv\u00eb dhe pasiv\u00eb. Aktiv\u00ebt \u2013 ndihmojn\u00eb bazuar n\u00eb trafikun e p\u00ebrdoruesve, pasiv\u00ebt imitojn\u00eb nj\u00eb trafik t\u00eb till\u00eb (n\u00eb munges\u00eb t\u00eb tij). <\/li>\n Rregullimi i holl\u00ebsish\u00ebm i timer\u00ebve dhe kushteve p\u00ebr t\u00eb zbuluar degradimin mungon \u2013 algoritmi \u00ebsht\u00eb i fiksuar.<\/li>\n P\u00ebr m\u00eb tep\u00ebr, \u00ebsht\u00eb n\u00eb dispozicion matja e bandwidth-it t\u00eb p\u00ebrdorur n\u00eb drejtimin e daljes. Kjo i ofron DMVPN\/PfR fleksibilitet t\u00eb shtuar n\u00eb menaxhimin e trafikut.<\/li>\n Megjithat\u00eb, disa mekanizma t\u00eb PfR, kur metrikat tejkalohen, mb\u00ebshteten n\u00eb komunikimin e pasm\u00eb n\u00eb form\u00ebn e mesazheve t\u00eb ve\u00e7anta TCA (Threshold Crossing Alert), t\u00eb cilat duhet t\u00eb vijn\u00eb nga marr\u00ebsi i trafikut n\u00eb drejtim t\u00eb burimit, q\u00eb, n\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb, n\u00ebnkupton se gjendja e kanaleve t\u00eb matur duhet t\u00eb jet\u00eb t\u00eb pakt\u00ebn e mjaftueshme p\u00ebr d\u00ebrgimin e till\u00eb t\u00eb mesazheve TCA. Kjo, n\u00eb shumic\u00ebn e rasteve, nuk paraqet problem, por \u00ebsht\u00eb e qart\u00eb q\u00eb nuk mund t\u00eb garantoh\u00ebt. <\/li>\n<\/ul>\n\nSD-WAN <\/b><\/p>\n\nP\u00ebr vler\u00ebsimin e metrikave standard t\u00eb gjendjes s\u00eb tunelit p\u00ebrdoret protokolli BFD n\u00eb modin echo. N\u00eb k\u00ebt\u00eb rast, nj\u00eb feedback i ve\u00e7ant\u00eb n\u00eb form\u00ebn e mesazheve TCA ose t\u00eb ngjash\u00ebm nuk \u00ebsht\u00eb i nevojsh\u00ebm \u2013 respektohet izolimi i domenit t\u00eb d\u00ebshtimit. Po ashtu, nuk \u00ebsht\u00eb e nevojshme q\u00eb t\u00eb ket\u00eb trafik p\u00ebrdorues p\u00ebr t\u00eb vler\u00ebsuar gjendjen e tunelit.<\/li>\n Ekziston mund\u00ebsia e rregullimit t\u00eb holl\u00ebsish\u00ebm t\u00eb timer\u00ebve BFD p\u00ebr t\u00eb rregulluar shpejt\u00ebsin\u00eb e aktivizimit dhe ndjeshm\u00ebrin\u00eb e algoritmit ndaj degradimeve t\u00eb kanalit t\u00eb komunikimit nga disa sekonda deri n\u00eb minuta.\n
N\u00eb momentin kur \u00ebsht\u00eb shkruar ky artikull, n\u00eb secilin nga tunel\u00ebt \u00ebsht\u00eb parashikuar vet\u00ebm nj\u00eb seanc\u00eb BFD. Kjo potencialisht krijon nj\u00eb granularitet m\u00eb t\u00eb ul\u00ebt n\u00eb analizimin e gjendjes s\u00eb tunelit. N\u00eb t\u00eb v\u00ebrtet\u00eb, kjo mund t\u00eb b\u00ebhet nj\u00eb kufizim vet\u00ebm n\u00eb rastin e p\u00ebrdorimit t\u00eb lidhjeve WAN t\u00eb bazuara n\u00eb MPLS L2\/L3 VPN me SLA t\u00eb r\u00ebn\u00eb dakord p\u00ebr QoS \u2013 n\u00ebse markimi DSCP i trafikut BFD (pasi \u00ebsht\u00eb inkapsuluar n\u00eb IPSec\/GRE) do t\u00eb p\u00ebrputhej me radh\u00ebn me p\u00ebrpar\u00ebsi t\u00eb lart\u00eb n\u00eb rrjetin e operatorit t\u00eb komunikimit, kjo mund t\u00eb ndikoj\u00eb n\u00eb sakt\u00ebsin\u00eb dhe shpejt\u00ebsin\u00eb e zbulimit t\u00eb degradimeve p\u00ebr trafikun me prioritet t\u00eb ul\u00ebt. N\u00eb k\u00ebt\u00eb rast, ka mund\u00ebsi ndryshimi t\u00eb markimit t\u00eb BFD p\u00ebr uljen e rrezikut t\u00eb ndodhis\u00eb s\u00eb situatave t\u00eb tilla. N\u00eb versionet e ardhshme t\u00eb softuerit Cisco SD-WAN pritet t\u00eb ket\u00eb nj\u00eb rregullim m\u00eb t\u00eb holl\u00eb t\u00eb BFD, si dhe mund\u00ebsin\u00eb e aktivizimit t\u00eb disa seancave BFD n\u00eb kuad\u00ebr t\u00eb nj\u00eb tuneli me vlera t\u00eb ve\u00e7anta DSCP (p\u00ebr aplikacione t\u00eb ndryshme).<\/li>\n BFD gjithashtu lejon vler\u00ebsimin e madh\u00ebsis\u00eb maksimale t\u00eb paketave q\u00eb mund t\u00eb transmetohen p\u00ebrmes nj\u00eb tuneli t\u00eb caktuar pa fragmentim. Kjo lejon q\u00eb SD-WAN t\u00eb vendos\u00eb dinamikisht parametra si MTU dhe TCP MSS Adjust, p\u00ebr t\u00eb shfryt\u00ebzuar sa m\u00eb shum\u00eb mund\u00ebsit\u00eb e disponueshme t\u00eb bandwidth-it n\u00eb \u00e7do kanal.<\/li>\n N\u00eb SD-WAN, gjithashtu ekziston opsioni p\u00ebr t\u00eb sinkronizuar QoS me operator\u00ebt e komunikimit jo vet\u00ebm mbi baz\u00ebn e fush\u00ebs L3 DSCP, por edhe mbi baz\u00ebn e vlerave L2 CoS, t\u00eb cilat mund t\u00eb formohen automatikisht n\u00eb rrjetin filial nga pajisje t\u00eb specializuara \u2014 p\u00ebr shembull, telefonat IP.<\/li>\n<\/ul>\n<\/p>\n
Si dallojn\u00eb mund\u00ebsit\u00eb, metodat e identifikimit dhe zbatimi i politikave AppQ?<\/h3>\n <\/p>\n
Politikat DMVPN\/PfR:<\/h4>\n <\/p>\n
\nP\u00ebrcaktohen n\u00eb router-in(e) e filialit qendror (CQ) p\u00ebrmes komandave CLI ose shabllon\u00ebve t\u00eb konfigurimeve CLI. Krijimi i shabllon\u00ebve CLI k\u00ebrkon p\u00ebrgatitje dhe njohuri mbi sintaks\u00ebn e politikave.\n
P\u00ebrcaktohen globalisht pa mund\u00ebsi individuale p\u00ebr personalizim\/n\u00eb p\u00ebrmbushje t\u00eb k\u00ebrkesave t\u00eb segmenteve t\u00eb ve\u00e7anta t\u00eb rrjetit.<\/b><\/li>\nKrijimi interaktiv i politikave n\u00eb nd\u00ebrfaqen grafike nuk \u00ebsht\u00eb parashikuar.<\/li>\n Ndjekja e ndryshimeve, trash\u00ebgimia, krijimi i disa versioneve t\u00eb politikave p\u00ebr nd\u00ebrprerje t\u00eb shpejt\u00eb nuk \u00ebsht\u00eb parashikuar.<\/li>\n Shperndahen automatikisht n\u00eb router-at e deg\u00ebve t\u00eb larg\u00ebta. N\u00eb k\u00ebt\u00eb rast, p\u00ebrdoren t\u00eb nj\u00ebjtat kanale t\u00eb komunikimit si p\u00ebr transmetimin e t\u00eb dh\u00ebnave t\u00eb p\u00ebrdoruesit. N\u00eb munges\u00eb t\u00eb nj\u00eb kanali komunikimi midis qendr\u00ebs dhe deg\u00ebs t\u00eb larg\u00ebt, shp\u00ebrndarja\/modifikimi i politikave nuk mund t\u00eb kryhet.<\/li>\n Zbatohen n\u00eb \u00e7do router dhe kur \u00ebsht\u00eb e nevojshme modifikojn\u00eb rezultatin e protokolleve standarde t\u00eb routing, duke pasur nj\u00eb prioritet m\u00eb t\u00eb lart\u00eb. <\/li>\n P\u00ebr rastet kur t\u00eb gjitha kanalet WAN t\u00eb filialit p\u00ebrjetojn\u00eb humbje t\u00eb dukshme t\u00eb trafikut, mekanizmat e kompensimit nuk jan\u00eb parashikuar.<\/b>.<\/li>\n<\/ul>\n <\/p>\n
Politikat SD-WAN:<\/h4>\n <\/p>\n
\nP\u00ebrcaktohen n\u00eb nd\u00ebrfaqen grafike vManage p\u00ebrmes nj\u00eb asistenti interaktiv t\u00eb shabllon\u00ebve.<\/li>\n Mb\u00ebshtesin krijimin e disa politikave, kopjimin, trash\u00ebgimin\u00eb, kalimin midis politikave n\u00eb koh\u00eb reale.<\/li>\n Mb\u00ebshtesin personalizimin individual t\u00eb politikave p\u00ebr segmente t\u00eb ndryshme (filialet) t\u00eb rrjetit.<\/li>\n Shperndahen duke p\u00ebrdorur \u00e7do kanal sinjalizimi t\u00eb disponuesh\u00ebm midis kontrolleve dhe router\u00ebve dhe\/ose vSmart \u2014 nuk varen drejtp\u00ebrdrejt nga lidhshm\u00ebria e planeve t\u00eb dh\u00ebnave mes router\u00ebve. Sidoqoft\u00eb, k\u00ebrkohet lidhshm\u00ebria IP midis vet\u00eb router\u00ebve dhe kontrolleve.\n
P\u00ebr rastet kur t\u00eb gjitha kanalet e disponueshme t\u00eb filialit p\u00ebrjetojn\u00eb humbje t\u00eb dukshme t\u00eb t\u00eb dh\u00ebnave, q\u00eb tejkalojn\u00eb pragjet e pranueshme p\u00ebr aplikacionet kritike, \u00ebsht\u00eb e mundur p\u00ebrdorimi i mekanizmave shtes\u00eb q\u00eb rrisin besueshm\u00ebrin\u00eb e transmetimit:\n\nFEC (Korrigjimi i Gabimit p\u00ebrpara)<\/b> \u2013 p\u00ebrdor nj\u00eb algorit\u00ebm t\u00eb ve\u00e7ant\u00eb t\u00eb kodimit mbip\u00ebr\u00e7ues. Kur transmetoni trafik kritik p\u00ebrmes kanaleve me nj\u00eb p\u00ebrqindje t\u00eb konsiderueshme humbjesh, FEC mund t\u00eb aktivizohet automatikisht dhe lejon, sipas nevoj\u00ebs, rikthimin e pjes\u00ebve t\u00eb humbura t\u00eb t\u00eb dh\u00ebnave. Kjo rrit p\u00ebrdorimin e bandwidth-it n\u00eb m\u00ebnyr\u00eb t\u00eb par\u00ebnd\u00ebsishme, por rrit ndjesh\u00ebm besueshm\u00ebrin\u00eb.\n
Duplicimi i rrjedhave t\u00eb t\u00eb dh\u00ebnave<\/b> \u2013 p\u00ebrve\u00e7 FEC, politika mund t\u00eb parashikoj\u00eb duplicimin automatik t\u00eb trafikut t\u00eb aplikacioneve t\u00eb zgjedhura n\u00eb rastin e nj\u00eb niveli shum\u00eb m\u00eb t\u00eb r\u00ebnd\u00eb t\u00eb humbjeve, t\u00eb cilat nuk mund t\u00eb kompensohen me an\u00eb t\u00eb FEC. N\u00eb k\u00ebt\u00eb rast, t\u00eb dh\u00ebnat e zgjedhura do t\u00eb transmetohen p\u00ebrmes t\u00eb gjitha tunel\u00ebve n\u00eb drejtim t\u00eb filialit-marr\u00ebs me nj\u00eb deduplikim pasues (heqjen e kopjeve t\u00eb panevojshme t\u00eb paketeve). Mekanizmi rrit ndjesh\u00ebm p\u00ebrdorimin e kanaleve, por gjithashtu rrit ndjesh\u00ebm besueshm\u00ebrin\u00eb e transmetimit.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n <\/p>\n
Mund\u00ebsit\u00eb Cisco SD-WAN, pa analoge direkte n\u00eb DMVPN\/PfR<\/h3>\n \nArkitektura e zgjidhjes Cisco SD-WAN n\u00eb disa raste lejon arritjen e mund\u00ebsive, realizimi i t\u00eb cilave brenda DMVPN\/PfR \u00ebsht\u00eb ose jasht\u00ebzakonisht e v\u00ebshtir\u00eb, ose e pap\u00ebrshtatshme p\u00ebr shkak t\u00eb burimeve t\u00eb nevojshme, ose n\u00eb fakt e pamundur. Le t\u00eb shqyrtojm\u00eb ato q\u00eb jan\u00eb m\u00eb interesante prej tyre:<\/p>\n
Inxhinieria e Trafikut (TE)<\/h4>\n \nTE p\u00ebrfshin mekanizma q\u00eb lejojn\u00eb devijimin e trafikut nga rruga standarde, t\u00eb formuar nga protokollet e routing. TE shpesh p\u00ebrdoret p\u00ebr t\u00eb siguruar disponueshm\u00ebrin\u00eb e lart\u00eb t\u00eb sh\u00ebrbimeve rrjet\u00ebrore, p\u00ebr shkak t\u00eb aft\u00ebsis\u00eb p\u00ebr t\u00eb shkuar shpejt dhe\/ose paraprakisht n\u00eb trafikun e r\u00ebnd\u00ebsish\u00ebm n\u00eb nj\u00eb rrug\u00eb alternative (jo t\u00eb nd\u00ebrthurrur), me q\u00ebllim sigurimin e nj\u00eb cil\u00ebsie m\u00eb t\u00eb mir\u00eb sh\u00ebrbimi ose shpejt\u00ebsis\u00eb s\u00eb rikuperimit n\u00eb rast t\u00eb d\u00ebshtimit n\u00eb rrug\u00ebn kryesore. <\/p>\n
Sfidha e realizimit t\u00eb TE q\u00ebndron n\u00eb nevoj\u00ebn p\u00ebr t\u00eb p\u00ebrllogaritur dhe rezervuar (kontrolluar) paraprakisht nj\u00eb rrug\u00eb alternative. N\u00eb rrjetet MPLS t\u00eb operatosve t\u00eb komunikacionit, ky problem zgjidhet duke p\u00ebrdorur teknologji si MPLS Traffic-Engineering me zgjerime t\u00eb protokolleve IGP dhe protokollit RSVP. Gjithashtu, s\u00eb fundmi, teknologjia Segment Routing po fiton gjithnj\u00eb e m\u00eb shum\u00eb popullaritet, e cila \u00ebsht\u00eb m\u00eb e optimizuar p\u00ebr konfigurim dhe orkestrim t\u00eb centralizuar. N\u00eb rrjetet klasike WAN, k\u00ebto teknologji, zakonisht, nuk jan\u00eb t\u00eb pranishme ose jan\u00eb t\u00eb limituara n\u00eb p\u00ebrdorimin e mekanizmave hop-by-hop si Policy-Based Routing (PBR), t\u00eb cilat kan\u00eb aft\u00ebsin\u00eb t\u00eb drejtojn\u00eb trafik, por e realizojn\u00eb k\u00ebt\u00eb n\u00eb \u00e7do router ve\u00e7mas \u2013 pa marr\u00eb parasysh gjendjen e p\u00ebrgjithshme t\u00eb rrjetit ose rezultatet e PBR n\u00eb hapat e m\u00ebparsh\u00ebm ose t\u00eb m\u00ebvonsh\u00ebm. Rezultati i p\u00ebrdorimit t\u00eb k\u00ebtyre varianteve TE \u00ebsht\u00eb i dhimbsh\u00ebm - MPLS TE, p\u00ebr shkak t\u00eb kompleksitetit t\u00eb konfigurimit dhe operimit, zakonisht p\u00ebrdoret vet\u00ebm n\u00eb pjes\u00ebn m\u00eb kritike t\u00eb rrjetit (n\u00eb thelb), nd\u00ebrsa PBR p\u00ebrdoret n\u00eb router t\u00eb ve\u00e7uar pa mund\u00ebsin\u00eb p\u00ebr t\u00eb formuar nj\u00eb politik\u00eb t\u00eb vetme PBR n\u00eb t\u00eb gjith\u00eb rrjetin. Kjo i referohet gjithashtu rrjeteve t\u00eb bazuara n\u00eb DMVPN.<\/p>\n
Service-chaining (Zinxhir\u00ebt e sh\u00ebrbimeve) <\/h4>\n \nFormimi i zinxhir\u00ebve t\u00eb sh\u00ebrbimeve \u00ebsht\u00eb nj\u00eb detyr\u00eb edhe m\u00eb e pun\u00ebs intensive n\u00eb rrug\u00ebzimin klasik, sesa mekanizmi i p\u00ebrshkruar tashm\u00eb Traffic-Engineering. Sepse n\u00eb k\u00ebt\u00eb rast, \u00ebsht\u00eb e nevojshme t\u00eb formohet jo vet\u00ebm nj\u00eb rrug\u00eb e ve\u00e7ant\u00eb p\u00ebr nj\u00eb aplikacion t\u00eb caktuar rrjet, por gjithashtu t\u00eb sigurohet mund\u00ebsia p\u00ebr t\u00eb derdhur trafikun nga rrjeti n\u00eb nyje t\u00eb caktuara (ose n\u00eb t\u00eb gjitha) t\u00eb rrjetit SD-WAN p\u00ebr t\u00eb trajtuar me nj\u00eb aplikacion ose sh\u00ebrbim t\u00eb ve\u00e7ant\u00eb (MSE, Balancimi, Cache, Inspektimi i trafikut etj.). N\u00eb k\u00ebt\u00eb proces, duhet t\u00eb ket\u00eb mund\u00ebsin\u00eb p\u00ebr t\u00eb kontrolluar gjendjen e k\u00ebtyre sh\u00ebrbimeve t\u00eb jashtme, p\u00ebr t\u00eb parandaluar situatat e black-holing, si dhe duhen mekanizma q\u00eb lejojn\u00eb vendosjen e k\u00ebtyre sh\u00ebrbimeve t\u00eb jashtme t\u00eb ngjashme n\u00eb lokacione t\u00eb ndryshme gjeo-lokale me mund\u00ebsin\u00eb q\u00eb rrjeti t\u00eb zgjedh\u00eb automatikisht nyj\u00ebn m\u00eb optimale t\u00eb sh\u00ebrbimit p\u00ebr trajtimin e trafikut t\u00eb deg\u00ebs s\u00eb caktuar. N\u00eb rastin e Cisco SD-WAN, \u00ebsht\u00eb mjaft e leht\u00eb t\u00eb arrihet kjo, duke krijuar nj\u00eb politik\u00eb qendrore p\u00ebrkat\u00ebse, e cila \"ngjit\" t\u00eb gjitha aspektet e zinxhirit t\u00eb sh\u00ebrbimit t\u00eb synuar n\u00eb nj\u00eb nj\u00ebsi dhe nd\u00ebrron automatikisht logjik\u00ebn e data-plane dhe control-plane vet\u00ebm aty dhe at\u00ebher\u00eb ku \u00ebsht\u00eb e nevojshme.<\/p>\n
\u00c7far\u00eb doli p\u00ebrfundimisht?<\/h2>\n \nSigurisht, edhe DMVPN (n\u00eb bashk\u00ebpunim ose pa Performance Routing) dhe Cisco SD-WAN zgjidhin n\u00eb fund t\u00eb fundit detyra shum\u00eb t\u00eb ngjashme<\/b> n\u00eb lidhje me rrjetin WAN t\u00eb shp\u00ebrndar\u00eb t\u00eb organizat\u00ebs. Nd\u00ebrkoh\u00eb, dallimet e r\u00ebnd\u00ebsishme arkitekturore dhe funksionale t\u00eb teknologjis\u00eb Cisco SD-WAN e \u00e7ojn\u00eb procesin e zgjidhjes s\u00eb k\u00ebtyre detyrave n\u00eb nj\u00eb nivel cil\u00ebsor tjet\u00ebr<\/b>. N\u00eb p\u00ebrmbledhje, mund t\u00eb theksohen k\u00ebto ndryshime t\u00eb r\u00ebnd\u00ebsishme midis teknologjive SD-WAN dhe DMVPN\/PfR:<\/p>\n\nDMVPN\/PfR n\u00eb p\u00ebrgjith\u00ebsi p\u00ebrdorin teknologji t\u00eb provuara me koh\u00eb p\u00ebr nd\u00ebrtimin e rrjeteve VPN t\u00eb mbivendosur dhe n\u00eb pjes\u00ebn e data-plane jan\u00eb t\u00eb ngjashme me teknologjin\u00eb m\u00eb moderne SD-WAN, megjithat\u00eb, ka disa kufizime n\u00eb form\u00ebn e konfigurimit t\u00eb detyruesh\u00ebm statik t\u00eb routerave dhe zgjedhja e topologjive \u00ebsht\u00eb e limituar n\u00eb Hub-n-Spoke. N\u00eb an\u00ebn tjet\u00ebr, DMVPN\/PfR kan\u00eb disa funksionalitete q\u00eb deri tani nuk jan\u00eb t\u00eb disponueshme brenda SD-WAN (fjal\u00eb \u00ebsht\u00eb p\u00ebr per-application BFD).<\/li>\n N\u00eb kuad\u00ebr t\u00eb teknologjis\u00eb control-plane, nd\u00ebrlikimet jan\u00eb t\u00ebr\u00ebsisht t\u00eb ndryshme. Duke marr\u00eb parasysh p\u00ebrpunimin e centralizuar t\u00eb protokolleve sinjalizuese, SD-WAN lejon, sidomos, t\u00eb zvog\u00ebloj\u00eb ndjesh\u00ebm fushat e d\u00ebshtimit dhe t\u00eb \"dgjeg\" procesin e transferimit t\u00eb trafikut t\u00eb p\u00ebrdoruesit nga nd\u00ebrveprimi sinjalizues \u2013 nj\u00eb munges\u00eb p\u00ebrkohshme e kontrolluesve nuk ndikon n\u00eb mund\u00ebsin\u00eb e transferimit t\u00eb trafikut t\u00eb p\u00ebrdoruesit. N\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb, nj\u00eb munges\u00eb p\u00ebrkohshme e ndonj\u00eb filiali (p\u00ebrfshir\u00eb qendrorin) nuk ndikon n\u00eb mund\u00ebsin\u00eb q\u00eb filialet e tjera t\u00eb nd\u00ebrveprojn\u00eb me nj\u00ebra-tjetr\u00ebn dhe me kontrolluesit.<\/li>\n Arkitektura e formimit dhe aplikimit t\u00eb politikave p\u00ebr menaxhimin e trafikut n\u00eb rastin e SD-WAN gjithashtu tejkalon at\u00eb n\u00eb DMVPN\/PfR \u2013 rezerva gjeografike jan\u00eb implementuar ndjesh\u00ebm m\u00eb mir\u00eb, nuk ka lidhje me Hub-in, m\u00eb shum\u00eb mund\u00ebsi p\u00ebr konfigurim t\u00eb avancuar t\u00eb politikave, lista e skenar\u00ebve t\u00eb menaxhimit t\u00eb trafikut gjithashtu \u00ebsht\u00eb ndjesh\u00ebm m\u00eb e madhe.<\/li>\n Procesi i orkestrimit t\u00eb zgjidhjes \u00ebsht\u00eb gjithashtu ndjesh\u00ebm i ndrysh\u00ebm. DMVPN supozon ekzistenc\u00ebn e parametrave t\u00eb njohur paraprakisht, t\u00eb cil\u00ebt duhet t\u00eb pasqyrohen ndonj\u00ebher\u00eb n\u00eb konfigurim, \u00e7ka e kufizon disi fleksibilitetin e zgjidhjes dhe mund\u00ebsin\u00eb e ndryshimeve dinamik. Nga ana tjet\u00ebr, SD-WAN \u00ebsht\u00eb i bazuar n\u00eb parimin se n\u00eb momentin fillestar t\u00eb lidhjes, router-i \"nuk di asgj\u00eb\" rreth kontrolluesve t\u00eb tij, por di \"k\u00eb t\u00eb pyet\" \u2013 kjo \u00ebsht\u00eb e mjaftueshme jo vet\u00ebm p\u00ebr t\u00eb vendosur automatikisht lidhjen me kontrolluesit, por edhe p\u00ebr t\u00eb formuar automatikisht nj\u00eb topologji t\u00eb plot\u00eb t\u00eb p\u00ebrhapjes s\u00eb dh\u00ebnave, e cila mund t\u00eb konfigurohet\/ndryshohet fleksib\u00ebl m\u00eb pas me an\u00eb t\u00eb politikave.<\/li>\n N\u00eb aspektin e menaxhimit t\u00eb centralizuar, automatizimit dhe monitorimit, SD-WAN parashikohet t\u00eb tejkaloj\u00eb mund\u00ebsit\u00eb e DMVPN\/PfR, t\u00eb cilat u zhvilluan n\u00ebp\u00ebrmjet teknologjive klasike dhe n\u00eb nj\u00eb mas\u00eb t\u00eb madhe mb\u00ebshteten n\u00eb komand\u00ebn e linj\u00ebs s\u00eb komand\u00ebs (CLI) dhe p\u00ebrdorimin e sistemeve NMS t\u00eb bazuara n\u00eb shabllone. <\/li>\n N\u00eb SD-WAN, krahasuar me DMVPN, k\u00ebrkesat e siguris\u00eb kan\u00eb arritur nj\u00eb nivel tjet\u00ebr cil\u00ebsor. Parimet kryesore \u2013 besueshm\u00ebria zero, shkall\u00ebzueshm\u00ebria dhe autentifikimi me dy faktor\u00eb.<\/li>\n<\/ul>\n\nNga k\u00ebto p\u00ebrfundime t\u00eb thjeshta, mund t\u00eb krijohet nj\u00eb p\u00ebrshtypje e gabuar se krijimi i nj\u00eb rrjeti mbi baz\u00ebn e DMVPN\/PfR ka humbur sot \u00e7do aktualitet. Kjo sigurisht nuk \u00ebsht\u00eb krejt sakt\u00eb. P\u00ebr shembull, n\u00eb rastet kur n\u00eb rrjet p\u00ebrdoren shum\u00eb pajisje t\u00eb vjetra dhe nuk ka mund\u00ebsi p\u00ebr t'i z\u00ebvend\u00ebsuar ato, DMVPN mund t\u00eb lejoj\u00eb bashkimin e pajisjeve \"t\u00eb vjetra\" dhe \"t\u00eb reja\" n\u00eb nj\u00eb rrjet gjeo-distribuar me shum\u00eb nga p\u00ebrfitimet e p\u00ebrmendura m\u00eb lart.<\/p>\n
Nga ana tjet\u00ebr, duhet t\u00eb mbahet mend se t\u00eb gjith\u00eb router\u00ebt korporativ\u00eb aktual\u00eb t\u00eb Cisco, t\u00eb bazuar n\u00eb IOS XE (ISR 1000, ISR 4000, ASR 1000, CSR 1000v) sot mb\u00ebshtesin \u00e7do mod t\u00eb funksionimit \u2013 dhe ruterimin klasik, dhe DMVPN, dhe SD-WAN \u2013 zgjedhja p\u00ebrcaktohet nga nevojat aktuale dhe kuptimi se n\u00eb \u00e7do moment n\u00eb at\u00eb pajisje t\u00eb nj\u00ebjt\u00eb mund t\u00eb fillohet t\u00eb shkohet drejt nj\u00eb teknologjie m\u00eb t\u00eb avancuar.<\/b>habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"\u0421 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 2017 \u0433\u043e\u0434\u0430, \u043a\u043e\u0433\u0434\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cisco \u043f\u0440\u0438\u043e\u0431\u0440\u0435\u043b\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044e Viptela, \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u043c\u043e\u0439 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 \u0441\u0442\u0430\u043b\u0430 Cisco SD-WAN. \u0417\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0438\u0435 3 \u0433\u043e\u0434\u0430 SD-WAN \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f \u043f\u0440\u043e\u0448\u043b\u0430 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439, \u043a\u0430\u043a \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e, \u0442\u0430\u043a \u0438 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u0430. \u0422\u0430\u043a \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0430\u0441\u0448\u0438\u0440\u0438\u043b\u0438\u0441\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0435 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438 \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 \u043d\u0430 \u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445 \u0441\u0435\u0440\u0438\u0439 Cisco ISR 1000, ISR 4000, ASR 1000 \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":91349,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-91348","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t