{"id":94118,"date":"2020-09-13T07:42:29","date_gmt":"2020-09-13T05:42:29","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/7-ngfw-dlya-malogo-biznesa-proizvoditelnost-i-obshhie-rekomendaczii"},"modified":"2020-09-13T07:42:29","modified_gmt":"2020-09-13T05:42:29","slug":"7-ngfw-dlya-malogo-biznesa-proizvoditelnost-i-obshhie-rekomendaczii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/7-ngfw-dlya-malogo-biznesa-proizvoditelnost-i-obshhie-rekomendaczii","title":{"rendered":"7. NGFW p\u00ebr biznes t\u00eb vog\u00ebl. Performanca dhe rekomandime t\u00eb p\u00ebrgjithshme","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"7.<\/p>\n

Ka mb\u00ebrritur koha p\u00ebr t\u00eb p\u00ebrfunduar ciklin e artikujve mbi brezin e ri t\u00eb SMB Check Point (seria 1500). Shpresojm\u00eb se ky p\u00ebrvoj\u00eb ka qen\u00eb e dobishme p\u00ebr ju, dhe do t\u00eb vazhdoni t\u00eb q\u00ebndroni me ne n\u00eb blogun TS Solution. Tema p\u00ebr artikullin p\u00ebrfundimtar nuk \u00ebsht\u00eb trajtuar gjer\u00ebsisht, por \u00ebsht\u00eb po aq e r\u00ebnd\u00ebsishme \u2014 tunimi i performanc\u00ebs s\u00eb SMB. N\u00eb t\u00eb do t\u00eb diskutojm\u00eb mund\u00ebsit\u00eb e konfigurimit t\u00eb harduerit dhe softuerit t\u00eb pun\u00ebs s\u00eb NGFW, do t\u00eb p\u00ebrshkruajm\u00eb komandat e disponueshme dhe m\u00ebnyrat e bashk\u00ebpunimit.<\/p>\n

T\u00eb gjith\u00eb artikujt e ciklit mbi NGFW p\u00ebr biznes t\u00eb vog\u00ebl: <\/p>\n

    \n
  1. \n

    Seria e re e CheckPoint 1500 Security Gateway<\/u><\/a><\/noindex><\/p>\n<\/li>\n

  2. \n

    Shp\u00ebrndarja dhe konfigurimi<\/u><\/a><\/noindex><\/p>\n<\/li>\n

  3. \n

    Transferimi i t\u00eb dh\u00ebnave pa tel: WiFi dhe LTE<\/u><\/a><\/noindex><\/p>\n<\/li>\n

  4. \n

    VPN<\/u><\/a><\/noindex><\/p>\n<\/li>\n

  5. \n

    Menaxhimi n\u00eb cloud t\u00eb SMP<\/u><\/a><\/noindex><\/p>\n<\/li>\n

  6. \n

    Smart-1 Cloud<\/u><\/a><\/noindex><\/p>\n<\/li>\n<\/ol>\n

    Aktualisht, nuk ka shum\u00eb burime informacioni p\u00ebr optimizimin e performanc\u00ebs p\u00ebr zgjidhjet SMB p\u00ebr shkak t\u00eb kufizimeve<\/u><\/a><\/noindex> sistemi operativ t\u00eb brendsh\u00ebm \u2014 Gaia 80.20 Embedded. N\u00eb artikullin ton\u00eb do t\u00eb p\u00ebrdorim nj\u00eb model me menaxhim t\u00eb centralizuar (Server Menaxhimi t\u00eb dedikuar) \u2014 ai lejon p\u00ebrdorimin e nj\u00eb numri m\u00eb t\u00eb madh mjetesh gjat\u00eb pun\u00ebs me NGFW.<\/p>\n

    Pjesa hardware<\/h2>\n

    Para se t\u00eb trajtojm\u00eb arkitektur\u00ebn e familjes Check Point SMB, gjithmon\u00eb mund t\u00eb kontaktoni partnerin tuaj p\u00ebr t\u00eb p\u00ebrdorur utilitarin Appliance Sizing Tool<\/em>, p\u00ebr t\u00eb gjetur zgjidhjen optimale sipas karakteristikave t\u00eb caktuara (kapaciteti, numri i pritur i p\u00ebrdoruesve etj).<\/p>\n

    Sh\u00ebnime t\u00eb r\u00ebnd\u00ebsishme gjat\u00eb nd\u00ebrveprimit me harduerin e NGFW tuaj<\/p>\n

      \n
    1. \n

      Zgjidhjet NGFW t\u00eb familjes SMB nuk kan\u00eb mund\u00ebsin\u00eb e p\u00ebrmir\u00ebsimit t\u00eb harduerit t\u00eb p\u00ebrb\u00ebr\u00ebsve sistemor\u00eb (CPU, RAM, HDD), n\u00eb var\u00ebsi t\u00eb modelit, ekziston mb\u00ebshtetje p\u00ebr kartat SD, q\u00eb lejon zgjerimin e kapacitetit t\u00eb disqeve, por jo n\u00eb m\u00ebnyr\u00eb t\u00eb konsiderueshme.<\/p>\n<\/li>\n

    2. \n

      Funksionimi i nd\u00ebrfaqeve rrjet k\u00ebrkon kontroll. N\u00eb Gaia 80.20 Embedded, nuk ka shum\u00eb mjete p\u00ebr monitorimin, por gjithmon\u00eb mund t\u00eb p\u00ebrdorni komand\u00ebn e njohur n\u00eb CLI n\u00eb modalitetin Expert <\/p>\n

      # ifconfig<\/em><\/p>\n

      \"7.<\/p>\n

      Kujdesuni p\u00ebr rreshtat e theksuar, ato do t'ju ndihmojn\u00eb t\u00eb vler\u00ebsoni numrin e gabimeve n\u00eb nd\u00ebrfaqe. Rekomandohet t\u00eb kontrolloni k\u00ebto parametrat gjat\u00eb implementimit fillestar t\u00eb NGFW tuaj, si dhe rregullisht gjat\u00eb funksionimit.<\/p>\n<\/li>\n

    3. \n

      P\u00ebr nj\u00eb Gaia t\u00eb plot\u00eb, ekziston komanda: <\/p>\n

      > show diag <\/p>\n

      Me ndihm\u00ebn e saj \u00ebsht\u00eb e mundur t\u00eb merrni informacion mbi temperatur\u00ebn e harduerit. Fatkeq\u00ebsisht, n\u00eb 80.20 Embedded nuk \u00ebsht\u00eb e disponueshme kjo opsion, do t\u00eb p\u00ebrmendim SNMP-traps m\u00eb t\u00eb njohura:<\/p>\n

      Emri <\/strong><\/p>\n

      P\u00ebrshkrimi<\/strong><\/p>\n

      Interface disconnected<\/em><\/p>\n

      Shk\u00ebputje e nd\u00ebrfaqes<\/p>\n

      VLAN removed<\/em><\/p>\n

      Heqja e Vlan<\/p>\n

      High memory utilization<\/em><\/p>\n

      P\u00ebrdorim i lart\u00eb i RAM<\/p>\n

      Low disk space<\/em><\/p>\n

      Hapur shum\u00eb pak hap\u00ebsir\u00eb n\u00eb HDD<\/p>\n

      High CPU utilization<\/em><\/p>\n

      P\u00ebrdorim i lart\u00eb i CPU<\/p>\n

      High CPU interrupts rate<\/em><\/p>\n

      Shkalla e lart\u00eb e nd\u00ebrprerjeve<\/p>\n

      High connection rate<\/em><\/p>\n

      Shkalla e lart\u00eb e lidhjeve t\u00eb reja<\/p>\n

      High concurrent connections<\/em><\/p>\n

      Shkalla e lart\u00eb e sesioneve konkurrente<\/p>\n

      High Firewall throughput<\/em><\/p>\n

      Shkalla e lart\u00eb e kapacitetit t\u00eb Firewall<\/p>\n

      High accepted packet rate<\/em><\/p>\n

      Shkalla e lart\u00eb e pranimeve t\u00eb paketave<\/p>\n

      Cluster member state changed<\/em><\/p>\n

      Ndryshimi i gjendjes s\u00eb klasterit<\/p>\n

      Connection with log server error<\/em><\/p>\n

      Humbja e lidhjes me Log-Server<\/p>\n<\/li>\n

    4. \n

      Funksionimi i port\u00ebs suaj k\u00ebrkon kontrollin e RAM. P\u00ebr pun\u00ebn e Gaia (sistem operativ i ngjash\u00ebm me Linux) kjo \u00ebsht\u00eb nj\u00eb situat\u00eb normale<\/u><\/a><\/noindex>, kur shpenzimi i RAM arrin deri n\u00eb 70-80% t\u00eb p\u00ebrdorimit. <\/p>\n

      N\u00eb arkitektur\u00ebn e zgjidhjeve SMB nuk parashikohet p\u00ebrdorimi i SWAP-memoris\u00eb, ndryshe nga modelet m\u00eb t\u00eb vjetra t\u00eb Check Point. Megjithat\u00eb, n\u00eb skedar\u00ebt sistemor\u00eb t\u00eb Linux \u00ebsht\u00eb v\u00ebrejtur , q\u00eb tregon nj\u00eb mund\u00ebsi teorike p\u00ebr t\u00eb ndryshuar parametrin SWAP.<\/p>\n<\/li>\n<\/ol>\n

      Pjesa e softuerit<\/h2>\n

      N\u00eb momentin e publikimit t\u00eb artikullit versioni aktual<\/u><\/a><\/noindex> versionet e Gaia \u2014 80.20.10. Duhet t\u00eb dini se ka kufizime gjat\u00eb pun\u00ebs n\u00eb CLI: n\u00eb modin Expert mb\u00ebshteten disa komanda t\u00eb Linux. P\u00ebr t\u00eb vler\u00ebsuar funksionimin e NGFW, k\u00ebrkohet vler\u00ebsimi i pun\u00ebs s\u00eb demon\u00ebve dhe sh\u00ebrbimeve, p\u00ebr m\u00eb shum\u00eb informacion mund t\u00eb m\u00ebsoni n\u00eb artikullin<\/u><\/a><\/noindex> kolegu im. Ne do t\u00eb shqyrtojm\u00eb komandat e mundshme p\u00ebr SMB.<\/p>\n

      Puna me Gaia OS<\/p>\n

        \n
      1. \n

        Shikimi i shablloneve SecureXL<\/p>\n

        # fwaccel stat<\/strong><\/p>\n

        \"7.<\/li>\n

      2. \n

        Shikimi i ngarkes\u00ebs sipas b\u00ebrthamave<\/p>\n

        # fw ctl multik stat<\/strong><\/p>\n

        \"7.<\/li>\n

      3. \n

        Shikimi i numrit t\u00eb sesioneve (lidhen).<\/p>\n

        # fw ctl pstat<\/strong><\/p>\n

        \"7.<\/li>\n

      4. \n

        *Shikimi i gjendjes s\u00eb klasterit<\/p>\n

        # cphaprob stat<\/strong><\/p>\n

        \"7.<\/li>\n

      5. \n

        Komanda klasike Linux TOP<\/p>\n<\/li>\n<\/ol>\n

        Logimi<\/h3>\n

        Si\u00e7 e dini tani, ka tri m\u00ebnyra p\u00ebr t\u00eb punuar me log-\u00ebt e NGFW (ruajtja, p\u00ebrpunimi): lokal, centralizuar dhe n\u00eb cloud. Dy opsionet e fundit n\u00ebnkuptojn\u00eb pranin\u00eb e nj\u00eb entiteti \u2014 Server Menaxhimi. <\/p>\n

        Skemat e mundshme t\u00eb menaxhimit t\u00eb NGFW\"7.<\/p>\n

        Skedar\u00ebt m\u00eb t\u00eb \u00e7muar t\u00eb logeve<\/p>\n

          \n
        1. \n

          Mesazhet sistemore (p\u00ebrmbajn\u00eb m\u00eb pak informacione se n\u00eb nj\u00eb Gaia t\u00eb plot\u00eb)<\/p>\n

          # tail -f \/var\/log\/messages2<\/strong><\/p>\n

          \"7.<\/li>\n

        2. \n

          Mesazhet e gabimeve n\u00eb funksionimin e blade-ve (nj\u00eb sked\u00eb mjaft e dobishme gjat\u00eb k\u00ebrkimit t\u00eb problemeve)<\/p>\n

          # tail -f \/var\/log\/log\/sfwd.elg<\/strong><\/p>\n

          \"7.<\/li>\n

        3. \n

          Shikimi i mesazheve nga buferi n\u00eb nivelin e b\u00ebrtham\u00ebs s\u00eb sistemit.<\/p>\n

          # dmesg<\/strong><\/p>\n

          \"7.<\/li>\n<\/ol>\n

          Konfigurimi i blade-ve<\/h2>\n

          Ky seksion nuk do t\u00eb p\u00ebrmbaj\u00eb udh\u00ebzime t\u00eb plota p\u00ebr konfigurimin e NGFW Check Point tuaj, ai p\u00ebrmban vet\u00ebm rekomandimet tona, t\u00eb p\u00ebrzgjedhura n\u00eb m\u00ebnyr\u00eb t\u00eb provuar. <\/p>\n

          Kontrolli i Aplikacionit \/ Filtrimi i URL-ve<\/p>\n