{"id":95432,"date":"2020-09-29T07:42:38","date_gmt":"2020-09-29T05:42:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/razbor-samogo-demokratichnogo-iz-sd-wan-arhitektura-nastrojka-administrirovanie-i-podvodnye-kamni"},"modified":"2020-09-29T07:42:38","modified_gmt":"2020-09-29T05:42:38","slug":"razbor-samogo-demokratichnogo-iz-sd-wan-arhitektura-nastrojka-administrirovanie-i-podvodnye-kamni","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/razbor-samogo-demokratichnogo-iz-sd-wan-arhitektura-nastrojka-administrirovanie-i-podvodnye-kamni","title":{"rendered":"Analiz\u00eb e SD-WAN m\u00eb demokratik: arkitektura, konfigurimi, administrimi dhe problemet e fshehura","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Nga numri i pyetjeve q\u00eb kemi filluar t\u00eb marrim p\u00ebr SD-WAN, duket se kjo teknologji po z\u00eb vend seriozisht n\u00eb Rusi. Natyrisht, vendor\u00ebt nuk po rrin\u00eb duarkryq dhe po ofrojn\u00eb konceptet e tyre, nd\u00ebrsa disa pionier\u00eb t\u00eb guximsh\u00ebm tashm\u00eb po i zbatojn\u00eb ato n\u00eb rrjetet e tyre. <\/p>\n

Ne punojm\u00eb pothuajse me t\u00eb gjith\u00eb vendor\u00ebt dhe, gjat\u00eb disa viteve, n\u00eb laboratorin ton\u00eb kam pasur mund\u00ebsi t\u00eb shqyrtoj arkitektur\u00ebn e \u00e7do zhvilluesi t\u00eb madh t\u00eb zgjidhjeve software-defined. Disi m\u00eb vete q\u00ebndron SD-WAN nga Fortinet, i cili thjesht ka integruar funksionalitetin e balancimit t\u00eb trafikut midis kanaleve t\u00eb komunikimit n\u00eb softuerin e firewalleve. Kjo \u00ebsht\u00eb m\u00eb tep\u00ebr nj\u00eb zgjidhje demokratike, ndaj zakonisht t\u00ebrheq v\u00ebmendjen e kompanive q\u00eb ende nuk jan\u00eb gati p\u00ebr ndryshime globale, por duan t\u2019i p\u00ebrdorin m\u00eb me efikasitet kanalet e tyre t\u00eb komunikimit. <\/p>\n

N\u00eb k\u00ebt\u00eb artikull dua t\u00eb tregoj si t\u00eb konfigurohet dhe t\u00eb p\u00ebrdoret SD-WAN nga Fortinet, p\u00ebr k\u00eb \u00ebsht\u00eb i p\u00ebrshtatsh\u00ebm ky zgjidhje dhe me \u00e7far\u00eb v\u00ebshtir\u00ebsish t\u00eb fshehura mund t\u00eb p\u00ebrballeni k\u00ebtu. <\/a><\/noindex><\/p>\n

Lojtar\u00ebt m\u00eb t\u00eb duksh\u00ebm t\u00eb tregut SD-WAN mund t\u00eb ndahen n\u00eb nj\u00eb nga dy kategorit\u00eb: <\/p>\n

1. Startup-et q\u00eb krijuan zgjidhje SD-WAN nga e para. M\u00eb t\u00eb suksesshmit prej tyre marrin nj\u00eb shtys\u00eb t\u00eb jasht\u00ebzakonshme p\u00ebr zhvillim pasi blihen nga kompani t\u00eb m\u00ebdha \u2013 kjo \u00ebsht\u00eb historia e Cisco\/Viptela, VMWare\/VeloCloud, Nuage\/Nokia<\/p>\n

2. Vendor\u00ebt e m\u00ebdhenj t\u00eb rrjeteve q\u00eb krijuan zgjidhje SD-WAN duke zhvilluar programueshm\u00ebrin\u00eb dhe menaxhueshm\u00ebrin\u00eb e router\u00ebve t\u00eb tyre tradicional\u00eb \u2013 kjo \u00ebsht\u00eb historia e Juniper, Huawei<\/p>\n

Fortinet arriti t\u00eb gjej\u00eb qasjen e vet. N\u00eb softuerin e firewall-eve u integrua funksionaliteti q\u00eb lejon bashkimin e nd\u00ebrfaqeve t\u00eb tyre n\u00eb kanale virtuale dhe balancimin e ngarkes\u00ebs mes tyre me algoritme m\u00eb t\u00eb avancuara krahasuar me rutimin e zakonsh\u00ebm. Pik\u00ebrisht ky funksionalitet u quajt SD-WAN. A mund t\u00eb quhet SD-WAN ajo q\u00eb ka b\u00ebr\u00eb Fortinet? N\u00eb treg po formohet gradualisht kuptimi se Software-Defined n\u00ebnkupton ndarjen e Control Plane nga Data Plane, si edhe p\u00ebrdorimin e kontrollor\u00ebve dhe orkestrator\u00ebve t\u00eb dedikuar. Te Fortinet nuk ka asgj\u00eb t\u00eb till\u00eb. Menaxhimi i centralizuar \u00ebsht\u00eb opsional dhe ofrohet p\u00ebrmes mjetit tradicional Fortimanager. Por, sipas mendimit tim, nuk ia vlen t\u00eb k\u00ebrkohet nj\u00eb e v\u00ebrtet\u00eb abstrakte dhe t\u00eb humbet koh\u00eb me debate mbi termat. N\u00eb bot\u00ebn reale, \u00e7do qasje ka avantazhet dhe mang\u00ebsit\u00eb e veta. Zgjidhja m\u00eb e mir\u00eb \u00ebsht\u00eb t\u2019i kuptoni ato dhe t\u00eb dini t\u00eb zgjidhni zgjidhje q\u00eb p\u00ebrputhen me detyrat tuaja. <\/p>\n

Do t\u00eb p\u00ebrpiqem t\u00eb tregoj me ndihm\u00ebn e screenshot-eve se si duket dhe \u00e7far\u00eb mund t\u00eb b\u00ebj\u00eb SD-WAN nga Fortinet.<\/p>\n

Si \u00ebsht\u00eb nd\u00ebrtuar gjith\u00e7ka <\/h3>\n

\nSupozojm\u00eb se keni dy deg\u00eb, t\u00eb lidhura mes tyre me dy kanale t\u00eb transmetimit t\u00eb t\u00eb dh\u00ebnave. K\u00ebto kanale bashkohen n\u00eb nj\u00eb grup, nj\u00ebsoj si\u00e7 bashkohen nd\u00ebrfaqet e zakonshme Ethernet n\u00eb LACP-Port-Channel. Ata q\u00eb e mbajn\u00eb mend prej koh\u00ebsh PPP Multilink do ta njohin k\u00ebt\u00eb si nj\u00eb analogji t\u00eb p\u00ebrshtatshme. Kanalet mund t\u00eb jen\u00eb porte fizike, VLAN SVI, si edhe VPN<\/a> ose tunele GRE. <\/p>\n

VPN ose GRE, si rregull, p\u00ebrdoren p\u00ebr lidhjen e rrjeteve lokale t\u00eb deg\u00ebve p\u00ebrmes internetit. Nd\u00ebrsa portet fizike p\u00ebrdoren kur ka lidhje L2 mes site-ve, ose kur lidhja realizohet p\u00ebrmes MPLS\/VPN t\u00eb dedikuar, n\u00ebse na mjafton komunikimi pa Overlay dhe pa enkriptim. Nj\u00eb tjet\u00ebr skenar ku n\u00eb grupin SD-WAN p\u00ebrdoren porte fizike \u00ebsht\u00eb balancimi i daljes lokale t\u00eb p\u00ebrdoruesve n\u00eb internet.<\/p>\n

N\u00eb mjedisin ton\u00eb testues ka kat\u00ebr firewall-e dhe dy tunele VPN, q\u00eb punojn\u00eb p\u00ebrmes dy \u00aboperator\u00ebve t\u00eb komunikimeve\u00bb. Skema duket k\u00ebshtu:<\/p>\n

\"Analiz\u00eb
\n
\nTunelet VPN jan\u00eb konfiguruar n\u00eb modalitetin e nd\u00ebrfaqes, n\u00eb m\u00ebnyr\u00eb q\u00eb t\u00eb duken si lidhje Point-to-Point midis pajisjeve me adresa IP n\u00eb nd\u00ebrfaqet P2P, t\u00eb cilat mund t\u00eb pingohen p\u00ebr t\u00eb verifikuar q\u00eb lidhja p\u00ebrmes nj\u00eb tuneli t\u00eb caktuar funksionon. Q\u00eb trafiku t\u00eb enkriptohet dhe t\u00eb d\u00ebrgohet n\u00eb an\u00ebn tjet\u00ebr, mjafton ta rutoni n\u00eb tunel. Alternativa, pra p\u00ebrzgjedhja e trafikut p\u00ebr enkriptim me ndihm\u00ebn e listave t\u00eb n\u00ebnrrjeteve, e nd\u00ebrlikon shum\u00eb pun\u00ebn e administratorit sa m\u00eb kompleks t\u00eb b\u00ebhet konfigurimi. N\u00eb nj\u00eb rrjet t\u00eb madh, p\u00ebr nd\u00ebrtimin e VPN mund t\u00eb p\u00ebrdoret teknologjia ADVPN, nj\u00eb analog i DMVPN nga Cisco ose DVPN nga Huawei, q\u00eb lejon thjeshtimin e konfigurimit.<\/p>\n

Konfigurimi Site-to-Site VPN p\u00ebr dy pajisje me rutim BGP n\u00eb t\u00eb dy an\u00ebt<\/b>
\n <\/p>\n

\u00abQendra e t\u00eb dh\u00ebnave\u00bb (DC)
\n\u00abDega\u00bb (BRN)<\/p>\n

config system interface
\n\u2003redakto "WAN1"
\n\u2003\u2003cakto vdom "Internet"
\n\u2003\u2003set ip 1.1.1.1 255.255.255.252
\n\u2003\u2003set allowaccess ping
\n\u2003\u2003set role wan
\n\u2003\u2003cakto interfacin\u00eb "DC-BRD"
\n\u2003\u2003set vlanid 111
\n\u2003next
\n\u2003redakto "WAN2"
\n\u2003\u2003cakto vdom "Internet"
\n\u2003\u2003set ip 3.3.3.1 255.255.255.252
\n\u2003\u2003set allowaccess ping
\n\u2003\u2003set role lan
\n\u2003\u2003cakto interfacin\u00eb "DC-BRD"
\n\u2003\u2003set vlanid 112
\n\u2003next
\n\u2003redakto "BRN-Ph1-1"
\n\u2003\u2003cakto vdom "Internet"
\n\u2003\u2003set ip 192.168.254.1 255.255.255.255
\n\u2003\u2003set allowaccess ping
\n\u2003\u2003set type tunnel
\n\u2003\u2003set remote-ip 192.168.254.2 255.255.255.255
\n\u2003\u2003cakto interfacin\u00eb "WAN1"
\n\u2003next
\n\u2003redakto "BRN-Ph1-2"
\n\u2003\u2003cakto vdom "Internet"
\n\u2003\u2003set ip 192.168.254.3 255.255.255.255
\n\u2003\u2003set allowaccess ping
\n\u2003\u2003set type tunnel
\n\u2003\u2003set remote-ip 192.168.254.4 255.255.255.255
\n\u2003\u2003cakto interfacin\u00eb "WAN2"
\n\u2003next
\nend<\/p>\n

config vpn ipsec phase1-interface
\n\u2003redakto "BRN-Ph1-1"
\n\u2003\u2003cakto interfacin\u00eb "WAN1"
\n\u2003\u2003set local-gw 1.1.1.1
\n\u2003\u2003set peertype any
\n\u2003\u2003set net-device disable
\n\u2003\u2003set proposal aes128-sha1
\n\u2003\u2003set dhgrp 2
\n\u2003\u2003set remote-gw 2.2.2.1
\n\u2003\u2003set psksecret ***
\n\u2003next
\n\u2003redakto "BRN-Ph1-2"
\n\u2003\u2003cakto interfacin\u00eb "WAN2"
\n\u2003\u2003set local-gw 3.3.3.1
\n\u2003\u2003set peertype any
\n\u2003\u2003set net-device disable
\n\u2003\u2003set proposal aes128-sha1
\n\u2003\u2003set dhgrp 2
\n\u2003\u2003set remote-gw 4.4.4.1
\n\u2003\u2003set psksecret ***
\n\u2003next
\nend<\/p>\n

config vpn ipsec phase2-interface
\n\u2003redakto "BRN-Ph2-1"
\n\u2003\u2003cakto emrin faza1 "BRN-Ph1-1"
\n\u2003\u2003set proposal aes256-sha256
\n\u2003\u2003set dhgrp 2
\n\u2003next
\n\u2003redakto "BRN-Ph2-2"
\n\u2003\u2003cakto emrin faza1 "BRN-Ph1-2"
\n\u2003\u2003set proposal aes256-sha256
\n\u2003\u2003set dhgrp 2
\n\u2003next
\nend<\/p>\n

config router static
\n\u2003edit 1
\n\u2003\u2003set gateway 1.1.1.2
\n\u2003\u2003cakto pajisjen "WAN1"
\n\u2003next
\n\u2003edit 3
\n\u2003\u2003set gateway 3.3.3.2
\n\u2003\u2003cakto pajisjen "WAN2"
\n\u2003next
\nend<\/p>\n

config router bgp
\n\u2003set as 65002
\n\u2003set router-id 10.1.7.1
\n\u2003set ebgp-multipath enable
\n\u2003config neighbor
\n\u2003\u2003redakto "192.168.254.2"
\n\u2003\u2003\u2003set remote-as 65003
\n\u2003\u2003next
\n\u2003\u2003redakto "192.168.254.4"
\n\u2003\u2003\u2003set remote-as 65003
\n\u2003\u2003next
\n\u2003end<\/p>\n

\u2003config network
\n\u2003\u2003edit 1
\n\u2003\u2003\u2003set prefix 10.1.0.0 255.255.0.0
\n\u2003\u2003next
\nend <\/p>\n

config system interface
\n\u2003redakto "WAN1"
\n\u2003\u2003cakto vdom "Internet"
\n\u2003\u2003set ip 2.2.2.1 255.255.255.252
\n\u2003\u2003set allowaccess ping
\n\u2003\u2003set role wan
\n\u2003\u2003cakto interfacin\u00eb "BRN-BRD"
\n\u2003\u2003set vlanid 111
\n\u2003next
\n\u2003redakto "WAN2"
\n\u2003\u2003cakto vdom "Internet"
\n\u2003\u2003set ip 4.4.4.1 255.255.255.252
\n\u2003\u2003set allowaccess ping
\n\u2003\u2003set role wan
\n\u2003\u2003cakto interfacin\u00eb "BRN-BRD"
\n\u2003\u2003set vlanid 114
\n\u2003next
\n\u2003redakto "DC-Ph1-1"
\n\u2003\u2003cakto vdom "Internet"
\n\u2003\u2003set ip 192.168.254.2 255.255.255.255
\n\u2003\u2003set allowaccess ping
\n\u2003\u2003set type tunnel
\n\u2003\u2003set remote-ip 192.168.254.1 255.255.255.255
\n\u2003\u2003cakto interfacin\u00eb "WAN1"
\n\u2003next
\n\u2003redakto "DC-Ph1-2"
\n\u2003\u2003cakto vdom "Internet"
\n\u2003\u2003set ip 192.168.254.4 255.255.255.255
\n\u2003\u2003set allowaccess ping
\n\u2003\u2003set type tunnel
\n\u2003\u2003set remote-ip 192.168.254.3 255.255.255.255
\n\u2003\u2003cakto interfacin\u00eb "WAN2"
\n\u2003next
\nend<\/p>\n

config vpn ipsec phase1-interface
\n\u2003 redakto "DC-Ph1-1"
\n\u2003\u2003 cakto interfacin\u00eb "WAN1"
\n\u2003\u2003 set local-gw 2.2.2.1
\n\u2003\u2003 set peertype any
\n\u2003\u2003 set net-device disable
\n\u2003\u2003 set proposal aes128-sha1
\n\u2003\u2003 set dhgrp 2
\n\u2003\u2003 set remote-gw 1.1.1.1
\n\u2003\u2003 set psksecret ***
\n\u2003 next
\n\u2003 redakto "DC-Ph1-2"
\n\u2003\u2003 cakto interfacin\u00eb "WAN2"
\n\u2003\u2003 set local-gw 4.4.4.1
\n\u2003\u2003 set peertype any
\n\u2003\u2003 set net-device disable
\n\u2003\u2003 set proposal aes128-sha1
\n\u2003\u2003 set dhgrp 2
\n\u2003\u2003 set remote-gw 3.3.3.1
\n\u2003\u2003 set psksecret ***
\n\u2003 next
\nend<\/p>\n

config vpn ipsec phase2-interface
\n\u2003 redakto "DC-Ph2-1"
\n\u2003\u2003 cakto emrin faza1 "DC-Ph1-1"
\n\u2003\u2003 set proposal aes128-sha1
\n\u2003\u2003 set dhgrp 2
\n\u2003 next
\n\u2003 redakto "DC2-Ph2-2"
\n\u2003\u2003 cakto emrin faza1 "DC-Ph1-2"
\n\u2003\u2003 set proposal aes128-sha1
\n\u2003\u2003 set dhgrp 2
\n\u2003 next
\nend<\/p>\n

config router static
\n\u2003edit 1
\n\u2003\u2003set gateway 2.2.2.2
\n\u2003\u2003cakto pajisjen "WAN1"
\n\u2003next
\n\u2003edit 3
\n\u2003\u2003set gateway 4.4.4.2
\n\u2003\u2003cakto pajisjen "WAN2"
\n\u2003next
\nend<\/p>\n

config router bgp
\n\u2003 set as 65003
\n\u2003 set router-id 10.200.7.1
\n\u2003 set ebgp-multipath enable
\n\u2003 config neighbor
\n\u2003\u2003 redakto "192.168.254.1"
\n\u2003\u2003\u2003 set remote-as 65002
\n\u2003\u2003 next
\n\u2003\u2003redakto "192.168.254.3"
\n\u2003\u2003\u2003set remote-as 65002
\n\u2003\u2003 next
\n\u2003 end<\/p>\n

\u2003 config network
\n\u2003\u2003 edit 1
\n\u2003\u2003\u2003 set prefix 10.200.0.0 255.255.0.0
\n\u2003 \u2003pasues
\n end <\/p>\n

<\/code><\/p>\n

Po e jap konfigurimin n\u00eb form\u00eb teksti, sepse sipas mendimit tim k\u00ebshtu \u00ebsht\u00eb m\u00eb e p\u00ebrshtatshme t\u00eb konfigurohet VPN. Pothuajse t\u00eb gjitha cil\u00ebsimet n\u00eb t\u00eb dy an\u00ebt jan\u00eb t\u00eb nj\u00ebjta, dhe n\u00eb format tekstual mund t\u00eb b\u00ebhen thjesht me copy-paste. N\u00ebse b\u00ebni t\u00eb nj\u00ebjt\u00ebn gj\u00eb n\u00eb nd\u00ebrfaqen web, \u00ebsht\u00eb e leht\u00eb t\u00eb gaboni \u2014 t\u00eb harroni ndonj\u00eb checkbox diku ose t\u00eb vendosni nj\u00eb vler\u00eb t\u00eb gabuar. <\/p>\n

Pasi kemi shtuar nd\u00ebrfaqet n\u00eb bundle<\/p>\n

\"Analiz\u00eb
\n
\nt\u00eb gjitha rrug\u00ebt dhe politikat e siguris\u00eb mund t'i referohen atij, dhe jo nd\u00ebrfaqeve q\u00eb p\u00ebrfshihen n\u00eb t\u00eb. T\u00eb pakt\u00ebn, duhet t\u00eb lejohet trafiku nga rrjetet e brendshme drejt SD-WAN. Gjat\u00eb krijimit t\u00eb rregullave p\u00ebr to, mund t\u00eb aplikohen masa mbrojt\u00ebse si IPS, antivirus dhe inspektimi i HTTPS.<\/p>\n

\"Analiz\u00eb
\n
\nP\u00ebr bundle konfigurohen rregullat SD-WAN Rules. K\u00ebto jan\u00eb rregulla q\u00eb p\u00ebrcaktojn\u00eb algoritmin e balancimit p\u00ebr trafik specifik. Ato jan\u00eb t\u00eb ngjashme me politikat e rutimit n\u00eb Policy-Based Routing, vet\u00ebm se si rezultat i p\u00ebrputhjes s\u00eb trafikut me politik\u00ebn nuk caktohet next-hop ose nj\u00eb nd\u00ebrfaqe e zakonshme dal\u00ebse, por nd\u00ebrfaqet e shtuara n\u00eb SD-WAN bundle plus algoritmi i balancimit t\u00eb trafikut midis k\u00ebtyre nd\u00ebrfaqeve. <\/p>\n

Trafiku mund t\u00eb ve\u00e7ohet nga rrjedha e p\u00ebrgjithshme sipas informacionit L3-L4, sipas aplikacioneve t\u00eb identifikuara, sh\u00ebrbimeve t\u00eb internetit (URL dhe IP), si edhe sipas p\u00ebrdoruesve t\u00eb identifikuar t\u00eb stacioneve t\u00eb pun\u00ebs dhe laptop\u00ebve. Pas k\u00ebsaj, p\u00ebr trafikun e ve\u00e7uar mund t\u00eb caktohet nj\u00eb nga algoritmet e m\u00ebposhtme t\u00eb balancimit:<\/p>\n

\"Analiz\u00eb
\n
\nN\u00eb list\u00ebn Interface Preference zgjidhen ato nd\u00ebrfaqe, nga ato q\u00eb jan\u00eb shtuar tashm\u00eb n\u00eb bundle, t\u00eb cilat do t\u00eb sh\u00ebrbejn\u00eb p\u00ebr k\u00ebt\u00eb lloj trafiku. Duke mos shtuar t\u00eb gjitha nd\u00ebrfaqet, mund t\u00eb kufizoni sakt\u00ebsisht se n\u00ebp\u00ebr cilat kanale kalon, fjala vjen, posta elektronike, n\u00ebse nuk doni t\u00eb ngarkoni me t\u00eb kanalet e shtrenjta me SLA t\u00eb lart\u00eb. N\u00eb FortiOS 6.4.1 u shtua mund\u00ebsia p\u00ebr t\u00eb grupuar nd\u00ebrfaqet e shtuara n\u00eb SD-WAN bundle n\u00eb zona, duke krijuar, p\u00ebr shembull, nj\u00eb zon\u00eb p\u00ebr lidhje me lokacionet e larg\u00ebta dhe nj\u00eb tjet\u00ebr p\u00ebr akses lokal n\u00eb internet duke p\u00ebrdorur NAT. Po, po, edhe trafiku q\u00eb shkon n\u00eb internetin e zakonsh\u00ebm mund t\u00eb balancohet.<\/p>\n

Rreth algoritmeve t\u00eb balancimit
\n<\/h3>\n

\nSa i p\u00ebrket m\u00ebnyr\u00ebs se si Fortigate (firewall nga Fortinet) mund ta ndaj\u00eb trafikun nd\u00ebrmjet kanaleve, ka dy opsione interesante q\u00eb nuk jan\u00eb shum\u00eb t\u00eb p\u00ebrhapura n\u00eb treg:<\/p>\n

Lowest Cost (SLA)<\/b> \u2013 nga t\u00eb gjitha nd\u00ebrfaqet q\u00eb aktualisht p\u00ebrmbushin SLA, zgjidhet ajo me pesh\u00ebn (cost) m\u00eb t\u00eb ul\u00ebt, t\u00eb caktuar manualisht nga administratori; ky regjim \u00ebsht\u00eb i p\u00ebrshtatsh\u00ebm p\u00ebr trafik me volum t\u00eb lart\u00eb, si kopjet rezerv\u00eb dhe transferimi i skedar\u00ebve. <\/p>\n

Cil\u00ebsia m\u00eb e mir\u00eb (SLA)<\/b> \u2013 p\u00ebrve\u00e7 vones\u00ebs, jitter-it dhe humbjes s\u00eb paketave, ky algorit\u00ebm lejon q\u00eb Fortigate t\u00eb p\u00ebrdor\u00eb edhe ngarkes\u00ebn aktuale t\u00eb kanalit p\u00ebr t\u00eb vler\u00ebsuar cil\u00ebsin\u00eb e lidhjeve; ky regjim \u00ebsht\u00eb i p\u00ebrshtatsh\u00ebm p\u00ebr trafik t\u00eb ndjesh\u00ebm, si IP-telefonia (VoIP) dhe videokonferencat.<\/p>\n

P\u00ebr k\u00ebto algoritme k\u00ebrkohet konfigurimi i mat\u00ebsit t\u00eb performanc\u00ebs s\u00eb kanalit t\u00eb komunikimit \u2013 Performance SLA. Ky mat\u00ebs kontrollon periodikisht (check interval) informacionin mbi p\u00ebrmbushjen e SLA: humbjen e paketave (packet loss), vones\u00ebn (latency) dhe jitter-in (jitter) n\u00eb kanalin e komunikimit, \u2014 dhe mund t\u00eb \u201crefuzoj\u00eb\u201d ato kanale q\u00eb n\u00eb at\u00eb moment nuk p\u00ebrmbushin vlerat prag t\u00eb cil\u00ebsis\u00eb, pra humbasin shum\u00eb paketa ose kan\u00eb vones\u00eb tep\u00ebr t\u00eb lart\u00eb. P\u00ebrve\u00e7 k\u00ebsaj, mat\u00ebsi monitoron edhe statusin e kanalit dhe mund ta heq\u00eb p\u00ebrkoh\u00ebsisht at\u00eb nga bundle n\u00eb rast t\u00eb humbjes s\u00eb p\u00ebrs\u00ebritur t\u00eb p\u00ebrgjigjeve (failures before inactive). Pas rikthimit, pas disa p\u00ebrgjigjeve t\u00eb marra radhazi (restore link after), mat\u00ebsi do ta kthej\u00eb automatikisht kanalin n\u00eb bundle dhe t\u00eb dh\u00ebnat do t\u00eb fillojn\u00eb s\u00ebrish t\u00eb transmetohen p\u00ebrmes tij.<\/p>\n

K\u00ebshtu duket konfigurimi i \u201cmat\u00ebsit\u201d: <\/p>\n

\"Analiz\u00eb
\n
\nN\u00eb nd\u00ebrfaqen web, si protokolle p\u00ebr testim jan\u00eb t\u00eb disponueshme ICMP-Echo-request, HTTP-GET dhe DNS request. N\u00eb rreshtin e komand\u00ebs ka pak m\u00eb shum\u00eb opsione: ofrohen TCP-echo dhe UDP-echo, si edhe protokolli i specializuar p\u00ebr matjen e cil\u00ebsis\u00eb \u2014 TWAMP.<\/p>\n

\"Analiz\u00eb
\n
\nRezultatet e matjeve mund t\u00eb shihen edhe n\u00eb nd\u00ebrfaqen web: <\/p>\n

\"Analiz\u00eb
\n
\nEdhe n\u00eb rreshtin e komand\u00ebs: <\/p>\n

\"Analiz\u00eb
\n<\/p>\n

Diagnostikim<\/h3>\n

\nN\u00ebse keni krijuar nj\u00eb rregull, por gjith\u00e7ka nuk funksionon si\u00e7 pritej, ia vlen t\u00eb kontrolloni vler\u00ebn Hit Count n\u00eb list\u00ebn e SD-WAN Rules. Ajo do t\u00eb tregoj\u00eb n\u00ebse trafiku hyn fare n\u00eb k\u00ebt\u00eb rregull:<\/p>\n

\"Analiz\u00eb
\n
\nN\u00eb faqen e konfigurimit t\u00eb vet\u00eb mat\u00ebsit mund t\u00eb shihni ndryshimin e parametrave t\u00eb kanalit me kalimin e koh\u00ebs. Vija me nd\u00ebrprerje tregon vler\u00ebn prag t\u00eb parametrit<\/p>\n

\"Analiz\u00eb
\n
\nN\u00eb nd\u00ebrfaqen web mund t\u00eb shihni se si shp\u00ebrndahet trafiku sipas v\u00ebllimit t\u00eb t\u00eb dh\u00ebnave t\u00eb d\u00ebrguara\/marra dhe sipas numrit t\u00eb sesioneve:<\/p>\n

\"Analiz\u00eb
\n
\nP\u00ebrve\u00e7 t\u00eb gjitha k\u00ebtyre, ekziston nj\u00eb mund\u00ebsi e shk\u00eblqyer p\u00ebr t\u00eb gjurmuar kalimin e paketave me nivel maksimal detajimi. Gjat\u00eb pun\u00ebs n\u00eb nj\u00eb rrjet real, n\u00eb konfigurimin e pajisjes grumbullohen shum\u00eb politika t\u00eb rutimit, t\u00eb firewall-it dhe t\u00eb shp\u00ebrndarjes s\u00eb trafikut n\u00eb portet SD-WAN. T\u00eb gjitha k\u00ebto nd\u00ebrveprojn\u00eb n\u00eb m\u00ebnyr\u00eb komplekse me nj\u00ebra-tjetr\u00ebn dhe, megjith\u00ebse prodhuesi ofron diagrame t\u00eb detajuara t\u00eb algoritmeve t\u00eb p\u00ebrpunimit t\u00eb paketave, \u00ebsht\u00eb shum\u00eb e r\u00ebnd\u00ebsishme t\u00eb mos nd\u00ebrtohen dhe verifikohen vet\u00ebm teori, por t\u00eb shihet se ku p\u00ebrfundon realisht trafiku.<\/p>\n

P\u00ebr shembull, grupi i m\u00ebposht\u00ebm i komandave<\/p>\n

diagnose debug flow filtro saddr 10.200.64.15
\ndiagnose debug flow filtro daddr 10.1.7.2
\ndiagnose debug flow shfaq emrin e funksionit
\ndiagnose debug aktivizo
\ndiagnose debug trace 2<\/code><\/p>\n

Do t\u00eb mund\u00ebsoj\u00eb gjurmimin e dy paketave me adres\u00eb burimi 10.200.64.15 dhe adres\u00eb destinacioni 10.1.7.2.
\nB\u00ebjm\u00eb ping te 10.7.1.2 nga 10.200.64.15 dy her\u00eb dhe shohim daljen n\u00eb konsol\u00eb.<\/p>\n

Paketa e par\u00eb:<\/p>\n

\"Analiz\u00eb
\n
\nPaketa e dyt\u00eb:<\/p>\n

\"Analiz\u00eb
\n
\nJa ku paketa e par\u00eb u mor nga firewall-i:
\nid=20085 trace_id=475 func=print_pkt_detail line=5605 msg=\"vd-Internet:0 mori nj\u00eb paket\u00eb(proto=1, 10.200.64.15:42->10.1.7.2:2048) nga DMZ-Office. lloji=8, kodi=0, id=42, seq=0.\"
\nVDOM \u2013 Internet, Proto=1 (ICMP), DMZ-Office \u2013 emri i nd\u00ebrfaqes L3. <\/b>Type=8 \u2013 Echo.<\/code><\/p>\n

P\u00ebr t\u00eb u krijua nj\u00eb sesion i ri:
\nmsg=\"aloko nj\u00eb seanc\u00eb t\u00eb re-0006a627\"<\/code><\/p>\n

Dhe u zbulua p\u00ebrputhje me cil\u00ebsimet e politikave t\u00eb rutimit
\nmsg=\"P\u00ebrputhni id e politik\u00ebs s\u00eb routing-it=2136539137: me 10.1.7.2 p\u00ebrmes ifindex-110\"<\/code><\/p>\n

Rezulton se paketa duhet t\u00eb d\u00ebrgohet n\u00eb nj\u00eb nga tunelet VPN:
\n\"gjeni nj\u00eb rrug\u00eb: flag=04000000 gw-192.168.254.1 p\u00ebrmes DC-Ph1-1\"<\/code><\/p>\n

N\u00eb politikat e firewall-it u gjet nj\u00eb rregull lejues:
\nmsg=\"Lejohet nga Politika-3:\"<\/code><\/p>\n

Paketa kriptohet dhe d\u00ebrgohet n\u00eb tunelin VPN:
\nfunc=ipsecdev_hard_start_xmit line=789 msg=\"ndalo n\u00eb nd\u00ebrfaqen IPsec-DC-Ph1-1\"
\nfunc=_ipsecdev_hard_start_xmit line=666 msg=\"tuneli IPsec-DC-Ph1-1\"
\nfunc=esp_output4 line=905 msg=\"IPsec enkripto\/auth\"<\/code><\/p>\n

Paketa e kriptuar d\u00ebrgohet n\u00eb adres\u00ebn e gateway-t p\u00ebr k\u00ebt\u00eb nd\u00ebrfaqe WAN:
\nmsg=\"d\u00ebrgo n\u00eb 2.2.2.2 p\u00ebrmes intf-WAN1\"<\/code><\/p>\n

P\u00ebr paket\u00ebn e dyt\u00eb gjith\u00e7ka ndodh n\u00eb m\u00ebnyr\u00eb t\u00eb ngjashme, por ajo d\u00ebrgohet n\u00eb nj\u00eb tunel tjet\u00ebr VPN dhe kalon p\u00ebrmes nj\u00eb porti tjet\u00ebr t\u00eb firewall-it:
\nfunc=ipsecdev_hard_start_xmit line=789 msg=\"hyjm n\u00eb nd\u00ebrfaqen IPsec-DC-Ph1-2\"
\nfunc=_ipsecdev_hard_start_xmit line=666 msg=\"tuneli IPsec-DC-Ph1-2\"
\nfunc=esp_output4 line=905 msg=\"IPsec enkripto\/auth\"
\nfunc=ipsec_output_finish line=622 msg=\"d\u00ebrgo n\u00eb 4.4.4.2 p\u00ebrmes intf-WAN2\"<\/code><\/p>\n

P\u00ebrpar\u00ebsit\u00eb e zgjidhjes
\n<\/h3>\n

\nFunksionalitet i besuesh\u00ebm dhe nd\u00ebrfaqe e p\u00ebrshtatshme. <\/b>Grupi i funksioneve q\u00eb ekzistonte n\u00eb FortiOS para shfaqjes s\u00eb SD-WAN \u00ebsht\u00eb ruajtur plot\u00ebsisht. Kjo do t\u00eb thot\u00eb se nuk kemi t\u00eb b\u00ebjm\u00eb me nj\u00eb softuer t\u00eb zhvilluar nga e para, por me nj\u00eb sistem t\u00eb pjekur nga nj\u00eb prodhues i provuar i firewall-eve. Me nj\u00eb paket\u00eb tradicionale funksionesh t\u00eb rrjetit dhe nj\u00eb nd\u00ebrfaqe web t\u00eb p\u00ebrshtatshme e t\u00eb leht\u00eb p\u00ebr t\u2019u m\u00ebsuar. Sa prodhues SD-WAN ofrojn\u00eb n\u00eb pajisjet fundore, p\u00ebr shembull, funksionalitetin Remote-Access VPN?<\/p>\n

Siguri e nivelit 80. <\/b>FortiGate renditet nd\u00ebr zgjidhjet kryesore p\u00ebr firewall. N\u00eb internet ka shum\u00eb materiale p\u00ebr konfigurimin dhe administrimin e firewall-eve, nd\u00ebrsa n\u00eb tregun e pun\u00ebs ka mjaft specialist\u00eb t\u00eb siguris\u00eb q\u00eb tashm\u00eb i kan\u00eb p\u00ebrvet\u00ebsuar zgjidhjet e k\u00ebtij prodhuesi.<\/p>\n

Kosto zero p\u00ebr funksionalitetin SD-WAN. <\/b>Nd\u00ebrtimi i nj\u00eb rrjeti SD-WAN mbi FortiGate kushton po aq sa nd\u00ebrtimi i nj\u00eb rrjeti t\u00eb zakonsh\u00ebm WAN mbi t\u00eb, pasi nuk nevojiten licenca shtes\u00eb p\u00ebr t\u00eb p\u00ebrdorur funksionalitetin SD-WAN. <\/p>\n

Prag i ul\u00ebt hyrjeje p\u00ebr sa i p\u00ebrket kostos. <\/b>FortiGate ofron nj\u00eb gam\u00eb t\u00eb mir\u00eb pajisjesh p\u00ebr nivele t\u00eb ndryshme performance. Modelet m\u00eb baz\u00eb dhe m\u00eb t\u00eb p\u00ebrballueshme jan\u00eb plot\u00ebsisht t\u00eb p\u00ebrshtatshme p\u00ebr t\u00eb ngritur nj\u00eb zyr\u00eb ose nj\u00eb pik\u00eb shitjeje, p\u00ebr shembull, p\u00ebr 3-5 punonj\u00ebs. Te shum\u00eb vendor\u00eb, modele kaq t\u00eb thjeshta, me performanc\u00eb t\u00eb ul\u00ebt dhe me \u00e7mim t\u00eb arritsh\u00ebm, thjesht mungojn\u00eb. <\/p>\n

Performanc\u00eb e lart\u00eb. <\/b>Reduktimi i funksionalitetit SD-WAN n\u00eb balancimin e trafikut i ka lejuar kompanis\u00eb t\u00eb nxjerr\u00eb nj\u00eb ASIC t\u00eb specializuar SD-WAN, fal\u00eb t\u00eb cilit funksionimi i SD-WAN nuk e ul performanc\u00ebn e firewall-it n\u00eb t\u00ebr\u00ebsi. <\/p>\n

Mund\u00ebsia p\u00ebr t\u00eb nd\u00ebrtuar t\u00eb gjith\u00eb zyr\u00ebn mbi pajisjet Fortinet. <\/b>B\u00ebhet fjal\u00eb p\u00ebr nj\u00eb pal\u00eb firewall-e, switch-e dhe pika aksesi Wi\u2011Fi. Nj\u00eb zyr\u00eb e till\u00eb administrohet leht\u00eb dhe me komoditet: switch-et dhe pikat e aksesit regjistrohen n\u00eb firewall-e dhe menaxhohen prej tyre. Ja si, p\u00ebr shembull, mund t\u00eb duket nj\u00eb port switch-i nga nd\u00ebrfaqja e firewall-it p\u00ebrmes s\u00eb cil\u00ebs menaxhohet ky switch:<\/p>\n

\"Analiz\u00eb
\n
\nMungesa e kontrollor\u00ebve si pik\u00eb e vetme d\u00ebshtimi. <\/b>K\u00ebt\u00eb e thekson vet\u00eb vendori, por kjo mund t\u00eb quhet avantazh vet\u00ebm pjes\u00ebrisht, sepse te ata vendor\u00eb q\u00eb kan\u00eb kontrollor\u00eb, sigurimi i toleranc\u00ebs ndaj d\u00ebshtimit p\u00ebr to kushton pak dhe, n\u00eb shumic\u00ebn e rasteve, kufizohet te \u00e7mimi i nj\u00eb sasie t\u00eb vog\u00ebl burimesh kompjuterike n\u00eb mjedisin e virtualizimit.<\/p>\n

\u00c7far\u00eb duhet t\u00eb keni parasysh
\n<\/h3>\n

\nMungesa e ndarjes mes Control Plane dhe Data Plane<\/b>. Kjo do t\u00eb thot\u00eb se rrjeti duhet t\u00eb konfigurohet ose manualisht, ose duke p\u00ebrdorur mjetet tradicionale t\u00eb menaxhimit q\u00eb ekzistonin tashm\u00eb \u2014 FortiManager. Te vendor\u00ebt ku kjo ndarje \u00ebsht\u00eb zbatuar, rrjeti nd\u00ebrtohet vet\u00eb. Administratorit mund t\u2019i duhet vet\u00ebm t\u00eb korrigjoj\u00eb topologjin\u00eb e tij, t\u00eb ndaloj\u00eb di\u00e7ka diku, dhe asgj\u00eb m\u00eb shum\u00eb. Megjithat\u00eb, pika e fort\u00eb e FortiManager \u00ebsht\u00eb se ai mund t\u00eb menaxhoj\u00eb jo vet\u00ebm firewall-et, por edhe switch-et dhe pikat e aksesit Wi\u2011Fi, pra praktikisht t\u00eb gjith\u00eb rrjetin. <\/p>\n

Rritje relative e menaxhueshm\u00ebris\u00eb. <\/b>Meqen\u00ebse p\u00ebr automatizimin e konfigurimit t\u00eb rrjetit p\u00ebrdoren mjete tradicionale, menaxhueshm\u00ebria e rrjetit me implementimin e SD-WAN rritet vet\u00ebm pak. Nga ana tjet\u00ebr, funksionaliteti i ri b\u00ebhet i disponuesh\u00ebm m\u00eb shpejt, pasi prodhuesi fillimisht e l\u00ebshon vet\u00ebm p\u00ebr sistemin operativ t\u00eb firewall-eve (gj\u00eb q\u00eb lejon p\u00ebrdorimin e tij menj\u00ebher\u00eb), dhe vet\u00ebm m\u00eb pas e plot\u00ebson sistemin e menaxhimit me nd\u00ebrfaqet e nevojshme.<\/p>\n

Nj\u00eb pjes\u00eb e funksionalitetit mund t\u00eb jet\u00eb e disponueshme nga rreshti i komand\u00ebs, por jo nga nd\u00ebrfaqja web. <\/b>Nuk \u00ebsht\u00eb edhe aq problem t\u00eb hysh her\u00eb pas here n\u00eb rreshtin e komand\u00ebs p\u00ebr t\u00eb konfiguruar di\u00e7ka; m\u00eb problematike \u00ebsht\u00eb t\u00eb mos shoh\u00ebsh n\u00eb nd\u00ebrfaqen web se dikush ka konfiguruar tashm\u00eb di\u00e7ka nga rreshti i komand\u00ebs. Megjithat\u00eb, kjo zakonisht ka t\u00eb b\u00ebj\u00eb me funksionet m\u00eb t\u00eb reja dhe, me p\u00ebrdit\u00ebsimet e FortiOS, mund\u00ebsit\u00eb e nd\u00ebrfaqes web plot\u00ebsohen gradualisht.<\/p>\n

P\u00ebr k\u00eb \u00ebsht\u00eb i p\u00ebrshtatsh\u00ebm<\/h3>\n

\nP\u00ebr ata q\u00eb nuk kan\u00eb shum\u00eb deg\u00eb.<\/b> Implementimi i nj\u00eb zgjidhjeje SD-WAN me komponent\u00eb qendror\u00eb kompleks\u00eb n\u00eb nj\u00eb rrjet me 8\u201310 deg\u00eb mund t\u00eb mos ia vlej\u00eb \u2013 do t\u00eb duhet t\u00eb shpenzohen para p\u00ebr licencat e pajisjeve SD-WAN dhe burime t\u00eb sistemit t\u00eb virtualizimit p\u00ebr vendosjen e komponent\u00ebve qendror\u00eb. Burimet e lira llogarit\u00ebse n\u00eb nj\u00eb kompani t\u00eb vog\u00ebl zakonisht jan\u00eb t\u00eb kufizuara. N\u00eb rastin e Fortinet, mjafton thjesht t\u00eb blihen firewall-et. <\/p>\n

P\u00ebr ata q\u00eb kan\u00eb shum\u00eb deg\u00eb t\u00eb vogla. <\/b>Te shum\u00eb prodhues, \u00e7mimi minimal i zgjidhjes p\u00ebr nj\u00eb deg\u00eb \u00ebsht\u00eb mjaft i lart\u00eb dhe mund t\u00eb mos jet\u00eb t\u00ebrheq\u00ebs nga pik\u00ebpamja e biznesit t\u00eb klientit p\u00ebrfundimtar. Fortinet ofron pajisje t\u00eb vogla me nj\u00eb \u00e7mim shum\u00eb t\u00ebrheq\u00ebs. <\/p>\n

P\u00ebr ata q\u00eb ende nuk jan\u00eb gati t\u00eb hedhin nj\u00eb hap shum\u00eb t\u00eb madh. <\/b>Implementimi i SD-WAN me kontrollor\u00eb, rutim proprietar dhe nj\u00eb qasje t\u00eb re ndaj planifikimit dhe menaxhimit t\u00eb rrjetit mund t\u00eb jet\u00eb nj\u00eb hap tep\u00ebr i madh p\u00ebr disa klient\u00eb. Po, nj\u00eb implementim i till\u00eb n\u00eb fund do t\u00eb ndihmoj\u00eb n\u00eb optimizimin e p\u00ebrdorimit t\u00eb kanaleve t\u00eb komunikimit dhe t\u00eb pun\u00ebs s\u00eb administrator\u00ebve, por n\u00eb fillim do t\u00eb duhet t\u00eb m\u00ebsohen shum\u00eb gj\u00ebra t\u00eb reja. P\u00ebr ata q\u00eb ende nuk jan\u00eb gati p\u00ebr ndryshimin e paradigm\u00ebs, por duan t\u00eb nxjerrin m\u00eb shum\u00eb nga kanalet e tyre t\u00eb komunikimit, zgjidhja e Fortinet \u00ebsht\u00eb pik\u00ebrisht ajo q\u00eb duhet.
\n
Burimi: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0421\u0443\u0434\u044f \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u0432\u043e\u043f\u0440\u043e\u0441\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0430\u043c \u0441\u0442\u0430\u043b\u0438 \u043f\u0440\u0438\u043b\u0435\u0442\u0430\u0442\u044c \u043f\u043e SD-WAN, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f \u043d\u0430\u0447\u0430\u043b\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u0440\u0438\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0432 \u0420\u043e\u0441\u0441\u0438\u0438. \u0412\u0435\u043d\u0434\u043e\u0440\u044b, \u0435\u0441\u0442\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e, \u043d\u0435 \u0434\u0440\u0435\u043c\u043b\u044e\u0442 \u0438 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0442 \u0441\u0432\u043e\u0438 \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438, \u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u043c\u0435\u043b\u044c\u0447\u0430\u043a\u0438 \u043f\u0435\u0440\u0432\u043e\u043f\u0440\u043e\u0445\u043e\u0434\u0446\u044b \u0443\u0436\u0435 \u0432\u043d\u0435\u0434\u0440\u044f\u044e\u0442 \u0438\u0445 \u0443 \u0441\u0435\u0431\u044f \u043d\u0430 \u0441\u0435\u0442\u0438. \u041c\u044b \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u043c \u043f\u043e\u0447\u0442\u0438 \u0441\u043e \u0432\u0441\u0435\u043c\u0438 \u0432\u0435\u043d\u0434\u043e\u0440\u0430\u043c\u0438, \u0438 \u0437\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043b\u0435\u0442 \u0432 \u043d\u0430\u0448\u0435\u0439 \u043b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u044f \u0443\u0441\u043f\u0435\u043b \u043f\u043e\u043a\u043e\u043f\u0430\u0442\u044c\u0441\u044f \u0432 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0435 \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u043a\u0440\u0443\u043f\u043d\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":95433,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-95432","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Analiz\u00eb e SD-WAN m\u00eb t\u00eb p\u00ebrballuesh\u00ebm: arkitektura, konfigurimi, administrimi dhe problemet e fshehura | ProHoster","description":"Nga numri i pyetjeve q\u00eb kemi filluar t\u00eb marrim p\u00ebr SD-WAN, duket se kjo teknologji ka nisur t\u00eb z\u00ebr\u00eb vend seriozisht n\u00eb Rusi.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/razbor-samogo-demokratichnogo-iz-sd-wan-arhitektura-nastrojka-administrirovanie-i-podvodnye-kamni","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0430\u0437\u0431\u043e\u0440 \u0441\u0430\u043c\u043e\u0433\u043e \u0434\u0435\u043c\u043e\u043a\u0440\u0430\u0442\u0438\u0447\u043d\u043e\u0433\u043e \u0438\u0437 SD-WAN: \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0430, \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430, \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0438 \u043f\u043e\u0434\u0432\u043e\u0434\u043d\u044b\u0435 \u043a\u0430\u043c\u043d\u0438 | ProHoster","og:description":"\u0421\u0443\u0434\u044f \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u0432\u043e\u043f\u0440\u043e\u0441\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0430\u043c \u0441\u0442\u0430\u043b\u0438 \u043f\u0440\u0438\u043b\u0435\u0442\u0430\u0442\u044c \u043f\u043e SD-WAN, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f \u043d\u0430\u0447\u0430\u043b\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u0440\u0438\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0432 \u0420\u043e\u0441\u0441\u0438\u0438.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/razbor-samogo-demokratichnogo-iz-sd-wan-arhitektura-nastrojka-administrirovanie-i-podvodnye-kamni","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-29T05:42:38+00:00","article:modified_time":"2020-09-29T05:42:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"95432","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:05:30","updated":"2026-02-04 14:42:07","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/95432","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=95432"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/95432\/revisions"}],"predecessor-version":[{"id":156763,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/95432\/revisions\/156763"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/95433"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=95432"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=95432"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=95432"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}