{"id":95432,"date":"2020-09-29T07:42:38","date_gmt":"2020-09-29T05:42:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/razbor-samogo-demokratichnogo-iz-sd-wan-arhitektura-nastrojka-administrirovanie-i-podvodnye-kamni"},"modified":"2020-09-29T07:42:38","modified_gmt":"2020-09-29T05:42:38","slug":"razbor-samogo-demokratichnogo-iz-sd-wan-arhitektura-nastrojka-administrirovanie-i-podvodnye-kamni","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/razbor-samogo-demokratichnogo-iz-sd-wan-arhitektura-nastrojka-administrirovanie-i-podvodnye-kamni","title":{"rendered":"Analiza e SD-WAN m\u00eb demokratike: arkitektura, konfigurimi, administrimi dhe pengesat","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Duke numrit t\u00eb pyetjeve q\u00eb kemi filluar t\u00eb marrim n\u00eb lidhje me SD-WAN, teknologjia ka filluar t\u00eb fitoj\u00eb nj\u00eb vend t\u00eb fort\u00eb n\u00eb Rusi. Sigurisht, ofruesit e sh\u00ebrbimeve nuk po q\u00ebndrojn\u00eb pas dhe po ofrojn\u00eb konceptet e tyre, nd\u00ebrsa disa guximtar\u00eb pionier\u00eb tashm\u00eb i kan\u00eb implementuar ato n\u00eb rrjetet e tyre. <\/p>\n<p>Ne punojm\u00eb me pothuajse t\u00eb gjith\u00eb ofruesit dhe, brenda pak viteve n\u00eb laboratorin ton\u00eb, kam pasur mund\u00ebsin\u00eb t\u00eb shqyrtoj arkitektur\u00ebn e \u00e7do zhvilluesi t\u00eb madh t\u00eb zgjidhjeve me baz\u00eb programore. SD-WAN nga Fortinet \u00ebsht\u00eb disi i ve\u00e7ant\u00eb, pasi thjesht ka integruar funksionalitetin e balancimit t\u00eb trafikut midis kanaleve t\u00eb komunikimit n\u00eb softin e firewalleve. Ky zgjidhje \u00ebsht\u00eb m\u00eb demokratike, prandaj zakonisht shqyrtohet nga kompanit\u00eb q\u00eb ende nuk jan\u00eb t\u00eb gatshme p\u00ebr ndryshime t\u00eb m\u00ebdha, por q\u00eb duan t\u00eb p\u00ebrdorin m\u00eb efikasisht kanalet e komunikimit. <\/p>\n<p>N\u00eb k\u00ebt\u00eb artikull, dua t\u00eb flas p\u00ebr si t\u00eb konfiguroj dhe t\u00eb punoj me SD-WAN nga Fortinet, p\u00ebr k\u00eb \u00ebsht\u00eb e p\u00ebrshtatshme kjo zgjidhje dhe me cilat pengesa potenciale mund t\u00eb p\u00ebrballeni k\u00ebtu. <noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Lojtar\u00ebt m\u00eb t\u00eb duksh\u00ebm n\u00eb tregun e SD-WAN mund t\u00eb ndahen n\u00eb nj\u00eb nga dy lloje: <\/p>\n<p>1. Startupet q\u00eb krijuan zgjidhje SD-WAN nga zero. Ato m\u00eb t\u00eb suksesshmet p\u00ebrfitojn\u00eb nj\u00eb shtys\u00eb t\u00eb madhe zhvillimi pas blerjes nga kompani t\u00eb m\u00ebdha \u2013 kjo \u00ebsht\u00eb historia e Cisco\/Viptela, VMWare\/VeloCloud, Nuage\/Nokia.<\/p>\n<p>2. Pontet e m\u00ebdha t\u00eb rrjetit q\u00eb krijuan zgjidhje SD-WAN, duke zhvilluar programueshm\u00ebrin\u00eb dhe menaxhueshm\u00ebrin\u00eb e router\u00ebve t\u00eb tyre tradicional\u00eb \u2013 kjo \u00ebsht\u00eb historia e Juniper, Huawei.<\/p>\n<p>Fortinet arriti t\u00eb gjej\u00eb rrug\u00ebn e saj. N\u00eb softin e firewalleve \u00ebsht\u00eb inkorporuar nj\u00eb funksionalitet q\u00eb lejon bashkimin e interfazave t\u00eb tyre n\u00eb kanale virtuale dhe balancimin mes tyre t\u00eb ngarkes\u00ebs me an\u00eb t\u00eb algoritmeve t\u00eb nd\u00ebrlikuara, krahasuar me ruterat e zakonsh\u00ebm. Ky funksionalitet u quajt SD-WAN. A mund t\u00eb quhet ajo q\u00eb b\u00ebri Fortinet SD-WAN? N\u00eb treg po formohet gradualisht nj\u00eb kuptim q\u00eb Software-Defined n\u00ebnkupton ndarjen e Control Plane nga Data Plane, controller t\u00eb dedikuar, orkestrues. Fortinet nuk ka asgj\u00eb t\u00eb till\u00eb. Menaxhimi qendror \u00ebsht\u00eb opsional dhe ofrohet me an\u00eb t\u00eb mjeteve tradicionale si Fortimanager. Por, sipas mendimit tim, nuk duhet t\u00eb k\u00ebrkohet nj\u00eb t\u00eb v\u00ebrtet\u00eb abstrakte dhe t\u00eb humbasim koh\u00eb n\u00eb polemika mbi terma. N\u00eb bot\u00ebn reale, \u00e7do qasje ka avantazhet dhe disavantazhet e saj. Zgjedhja m\u00eb e mir\u00eb \u00ebsht\u00eb t\u00eb kuptojm\u00eb ato dhe t\u00eb dim\u00eb t\u00eb zgjedhim zgjidhjet q\u00eb i p\u00ebrgjigjen detyrave. <\/p>\n<p>Do t\u00eb provoj t\u00eb tregoj se si duket dhe \u00e7far\u00eb di t\u00eb b\u00ebj\u00eb SD-WAN nga Fortinet me screenshot n\u00eb duar.<\/p>\n<h3>Si funksionon gjith\u00e7ka <\/h3>\n<p>\nSupozoni se keni dy deg\u00eb, t\u00eb lidhura mes tyre me dy kanale transmetimi t\u00eb t\u00eb dh\u00ebnave. K\u00ebto kanale t\u00eb t\u00eb dh\u00ebnave bashkohen n\u00eb nj\u00eb grup, ashtu si\u00e7 bashkohen interfeset Ethernet t\u00eb zakonshme n\u00eb LACP-Port-Channel. Ata q\u00eb kan\u00eb qen\u00eb k\u00ebtu p\u00ebr nj\u00eb koh\u00eb t\u00eb gjat\u00eb do t\u00eb kujtojn\u00eb PPP Multilink - nj\u00eb analogji gjithashtu e p\u00ebrshtatshme. Kanale mund t\u00eb jen\u00eb porte fizike, VLAN SVI gjithashtu <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sq\/vpn\/\"   title=\"VPN\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"134\">VPN<\/a> ose tunel\u00eb GRE. <\/p>\n<p>VPN ose GRE, zakonisht p\u00ebrdoren kur lidhen rrjetet lokale t\u00eb deg\u00ebve p\u00ebrmes internetit. N\u00eb an\u00ebn tjet\u00ebr, portet fizike p\u00ebrdoren kur ka lidhje L2 nd\u00ebrmjet vendeve, ose kur lidhen p\u00ebrmes nj\u00eb MPLS\/VPN t\u00eb dedikuar, n\u00ebse jemi t\u00eb k\u00ebnaqur me lidhjen pa Overlay dhe enkriptim. Nj\u00eb skenar tjet\u00ebr, ku p\u00ebrdoren porte fizike n\u00eb grupin SD-WAN, \u00ebsht\u00eb balancimi i daljeve lokale t\u00eb p\u00ebrdoruesve n\u00eb internet.<\/p>\n<p>N\u00eb stend\u00ebn ton\u00eb ka kat\u00ebr firewall-e dhe dy tunel\u00eb VPN, duke punuar p\u00ebrmes dy \"operatave t\u00eb komunikimit\". Skema duket k\u00ebshtu:<\/p>\n<p><img decoding=\"async\" alt=\"Analiza e SD-WAN m\u00eb demokratike: arkitektura, konfigurimi, administrimi dhe pengesat\" src=\"\/wp-content\/uploads\/2020\/09\/db404c731bec1fbda86fbbfc98802762.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nVPN tunellet jan\u00eb konfiguruar n\u00eb m\u00ebnyr\u00eb interfaci, n\u00eb m\u00ebnyr\u00eb q\u00eb t\u00eb duken si lidhje Point-to-Point midis pajisjeve me adresa IP n\u00eb interface P2P, t\u00eb cilat mund t\u00eb pingohen dhe t\u00eb verifikohet q\u00eb komunikimi p\u00ebrmes nj\u00eb tuneli t\u00eb caktuar funksionon. P\u00ebr t\u00eb siguruar q\u00eb trafiku t\u00eb kriptohet dhe t\u00eb kaloj\u00eb n\u00eb an\u00ebn tjet\u00ebr, \u00ebsht\u00eb e mjaftueshme ta rrug\u00ebzojm\u00eb at\u00eb n\u00eb tunel. Alternativa \u2013 p\u00ebrzgjedhja e trafikut p\u00ebr kriptim p\u00ebrmes listave t\u00eb n\u00ebnrrjeteve, nd\u00ebrlikon administrat\u00ebn me rritjen e kompleksitetit t\u00eb konfigurimit. N\u00eb nj\u00eb rrjet t\u00eb madh, p\u00ebr nd\u00ebrtimin e VPN-s\u00eb mund t\u00eb p\u00ebrdoret teknologjia ADVPN, e ngjashme me DMVPN nga Cisco ose DVPN nga Huawei, q\u00eb lejon thjeshtimin e konfigurimit.<\/p>\n<p>                        <b class=\"spoiler_title\">Konfigurimi i Site-to-Site VPN p\u00ebr dy pajisje me rrug\u00ebzimin BGP nga t\u00eb dy an\u00ebt<\/b><br \/>\n                        <code><\/p>\n<p>\u00abQend\u00ebr t\u00eb t\u00eb Dh\u00ebnave\u00bb (DC)<br \/>\n\u00abDeg\u00eb\u00bb (BRN)<\/p>\n<p>konfiguro sistemin e nd\u00ebrfaqes<br \/>\n\u0440\u0435\u0434akto \"WAN1\"<br \/>\n\u043d\u0430 set vdom \"Internet\"<br \/>\n\u2003\u2003vendos ip 1.1.1.1 255.255.255.252<br \/>\n\u2003\u2003vendos lejoqasje ping<br \/>\n\u2003\u2003vendos rol wan<br \/>\n\u043d\u0430 set interface \"DC-BRD\"<br \/>\n\u2003\u2003vendos vlanid 111<br \/>\n\u2003n\u00eb vijim <br \/>\n\u0440\u0435\u0434akto \"WAN2\"<br \/>\n\u043d\u0430 set vdom \"Internet\"<br \/>\n\u2003\u2003vendos ip 3.3.3.1 255.255.255.252<br \/>\n\u2003\u2003vendos lejoqasje ping<br \/>\n\u2003\u2003vendos rol lan<br \/>\n\u043d\u0430 set interface \"DC-BRD\"<br \/>\n\u2003\u2003vendos vlanid 112<br \/>\n\u2003n\u00eb vijim<br \/>\n\u0440\u0435\u0434akto \"BRN-Ph1-1\"<br \/>\n\u043d\u0430 set vdom \"Internet\"<br \/>\n\u2003\u2003vendos ip 192.168.254.1 255.255.255.255<br \/>\n\u2003\u2003vendos lejoqasje ping<br \/>\n\u2003\u2003vendos llojin tunel<br \/>\n\u2003\u2003vendos ip-t\u00eb larg\u00eb 192.168.254.2 255.255.255.255<br \/>\n\u043d\u0430 set interface \"WAN1\"<br \/>\n\u2003n\u00eb vijim<br \/>\n\u0440\u0435\u0434akto \"BRN-Ph1-2\"<br \/>\n\u043d\u0430 set vdom \"Internet\"<br \/>\n\u2003\u2003vendos ip 192.168.254.3 255.255.255.255<br \/>\n\u2003\u2003vendos lejoqasje ping<br \/>\n\u2003\u2003vendos llojin tunel<br \/>\n\u2003\u2003vendos ip-t\u00eb larg\u00eb 192.168.254.4 255.255.255.255<br \/>\n\u043d\u0430 set interface \"WAN2\"<br \/>\n\u2003n\u00eb vijim<br \/>\nend<\/p>\n<p>konfiguro vpn ipsec faza1-interfejs<br \/>\n\u0440\u0435\u0434akto \"BRN-Ph1-1\"<br \/>\n\u043d\u0430 set interface \"WAN1\"<br \/>\n\u2003\u2003vendos lokal-gw 1.1.1.1<br \/>\n\u2003\u2003vendos peertype \u00e7do<br \/>\n\u2003\u2003vendos pajisjen e rrjetit n\u00eb ndalim<br \/>\n\u2003\u2003vendos propozimin aes128-sha1<br \/>\n\u2003\u2003vendos dhgrp 2<br \/>\n\u2003\u2003vendos ip-n\u00eb e larg\u00ebt 2.2.2.1<br \/>\n\u2003\u2003vendos psksecret ***<br \/>\n\u2003n\u00eb vijim<br \/>\n\u0440\u0435\u0434akto \"BRN-Ph1-2\"<br \/>\n\u043d\u0430 set interface \"WAN2\"<br \/>\n\u2003\u2003vendos ip-n\u00eb lokale 3.3.3.1<br \/>\n\u2003\u2003vendos peertype \u00e7do<br \/>\n\u2003\u2003vendos pajisjen e rrjetit n\u00eb ndalim<br \/>\n\u2003\u2003vendos propozimin aes128-sha1<br \/>\n\u2003\u2003vendos dhgrp 2<br \/>\n\u2003\u2003vendos ip-n\u00eb e larg\u00ebt 4.4.4.1<br \/>\n\u2003\u2003vendos psksecret ***<br \/>\n\u2003n\u00eb vijim<br \/>\nend<\/p>\n<p>konfiguro vpn ipsec faza2-interfaci<br \/>\n\u0440\u0435\u0434akto \"BRN-Ph2-1\"<br \/>\n\u043d\u0430 set phase1name \"BRN-Ph1-1\"<br \/>\n\u2003\u2003vendos propozimin aes256-sha256<br \/>\n\u2003\u2003vendos dhgrp 2<br \/>\n\u2003n\u00eb vijim<br \/>\n\u0440\u0435\u0434akto \"BRN-Ph2-2\"<br \/>\n\u043d\u0430 set phase1name \"BRN-Ph1-2\"<br \/>\n\u2003\u2003vendos propozimin aes256-sha256<br \/>\n\u2003\u2003vendos dhgrp 2<br \/>\n\u2003n\u00eb vijim<br \/>\nend<\/p>\n<p>konfiguro router-in statik<br \/>\n\u2003redakto 1<br \/>\n\u2003\u2003vendos gateway 1.1.1.2<br \/>\n\u043d\u0430 set device \"WAN1\"<br \/>\n\u2003n\u00eb vijim<br \/>\n\u2003redakto 3<br \/>\n\u2003\u2003vendos gateway 3.3.3.2<br \/>\n\u043d\u0430 set device \"WAN2\"<br \/>\n\u2003n\u00eb vijim<br \/>\nend<\/p>\n<p>konfiguro router-in bgp<br \/>\n\u2003vendos as 65002<br \/>\n\u2003vendos router-id 10.1.7.1<br \/>\n\u2003vendos ebgp-multipath \u00e7aktivizuar<br \/>\nkonfiguro fq<br \/>\n\u0440\u0435\u0434akto \"192.168.254.2\"<br \/>\n\u2003\u2003\u2003vendos as-n\u00eb e larg\u00ebt 65003<br \/>\n\u2003\u2003next<br \/>\n\u0440\u0435\u0434akto \"192.168.254.4\"<br \/>\n\u2003\u2003\u2003vendos as-n\u00eb e larg\u00ebt 65003<br \/>\n\u2003\u2003next<br \/>\n\u2003end<\/p>\n<p>konfiguro rrjetin<br \/>\n\u2003\u2003redakto 1<br \/>\n\u2003\u2003\u2003vendos prefixin 10.1.0.0 255.255.0.0<br \/>\n\u2003\u2003next<br \/>\nend <\/p>\n<p>konfiguro sistemin e nd\u00ebrfaqes<br \/>\n\u0440\u0435\u0434akto \"WAN1\"<br \/>\n\u043d\u0430 set vdom \"Internet\"<br \/>\n\u2003\u2003vendos ip 2.2.2.1 255.255.255.252<br \/>\n\u2003\u2003vendos lejoqasje ping<br \/>\n\u2003\u2003vendos rol wan<br \/>\n\u043d\u0430 set interface \"BRN-BRD\"<br \/>\n\u2003\u2003vendos vlanid 111<br \/>\n\u2003n\u00eb vijim<br \/>\n\u0440\u0435\u0434akto \"WAN2\"<br \/>\n\u043d\u0430 set vdom \"Internet\"<br \/>\n\u2003\u2003vendos ip 4.4.4.1 255.255.255.252<br \/>\n\u2003\u2003vendos lejoqasje ping<br \/>\n\u2003\u2003vendos rol wan<br \/>\n\u043d\u0430 set interface \"BRN-BRD\"<br \/>\n\u2003\u2003vendos vlanid 114<br \/>\n\u2003n\u00eb vijim<br \/>\n\u0440\u0435\u0434akto \"DC-Ph1-1\"<br \/>\n\u043d\u0430 set vdom \"Internet\"<br \/>\n\u2003\u2003vendos ip 192.168.254.2 255.255.255.255<br \/>\n\u2003\u2003vendos lejoqasje ping<br \/>\n\u2003\u2003vendos llojin tunel<br \/>\n\u2003\u2003vendos ip-n\u00eb e larg\u00ebt 192.168.254.1 255.255.255.255<br \/>\n\u043d\u0430 set interface \"WAN1\"<br \/>\n\u2003n\u00eb vijim<br \/>\n\u0440\u0435\u0434akto \"DC-Ph1-2\"<br \/>\n\u043d\u0430 set vdom \"Internet\"<br \/>\n\u2003\u2003vendos ip 192.168.254.4 255.255.255.255<br \/>\n\u2003\u2003vendos lejoqasje ping<br \/>\n\u2003\u2003vendos llojin tunel<br \/>\n\u2003\u2003vendos ip-n\u00eb e larg\u00ebt 192.168.254.3 255.255.255.255<br \/>\n\u043d\u0430 set interface \"WAN2\"<br \/>\n\u2003n\u00eb vijim<br \/>\nend<\/p>\n<p>konfiguro vpn ipsec faza1-interfejs<br \/>\n\u0440\u0435\u0434akto \"DC-Ph1-1\"<br \/>\n\u043d\u0430 set interface \"WAN1\"<br \/>\n\u2003\u2003 vendos ip-n\u00eb lokale 2.2.2.1<br \/>\n\u2003\u2003 vendos peertype \u00e7do<br \/>\n\u2003\u2003 vendos pajisjen e rrjetit n\u00eb ndalim<br \/>\n\u2003\u2003 vendos propozimin aes128-sha1<br \/>\n\u2003\u2003 vendos dhgrp 2<br \/>\n\u2003\u2003 vendos ip-n\u00eb e larg\u00ebt 1.1.1.1<br \/>\n\u2003\u2003 vendos psksecret ***<br \/>\n\u2003 next<br \/>\n\u0440\u0435\u0434akto \"DC-Ph1-2\"<br \/>\n\u043d\u0430 set interface \"WAN2\"<br \/>\n\u2003\u2003 vendos ip-n\u00eb lokale 4.4.4.1<br \/>\n\u2003\u2003 vendos peertype \u00e7do<br \/>\n\u2003\u2003 vendos pajisjen e rrjetit n\u00eb ndalim<br \/>\n\u2003\u2003 vendos propozimin aes128-sha1<br \/>\n\u2003\u2003 vendos dhgrp 2<br \/>\n\u2003\u2003 vendos ip-n\u00eb e larg\u00ebt 3.3.3.1<br \/>\n\u2003\u2003 vendos psksecret ***<br \/>\n\u2003 next<br \/>\nend<\/p>\n<p>konfiguro vpn ipsec faza2-interfaci<br \/>\n\u0440\u0435\u0434akto \"DC-Ph2-1\"<br \/>\n\u043d\u0430 set phase1name \"DC-Ph1-1\"<br \/>\n\u2003\u2003 vendos propozimin aes128-sha1<br \/>\n\u2003\u2003 vendos dhgrp 2<br \/>\n\u2003 next<br \/>\n\u0440\u0435\u0434akto \"DC2-Ph2-2\"<br \/>\n\u043d\u0430 set phase1name \"DC-Ph1-2\"<br \/>\n\u2003\u2003 vendos propozimin aes128-sha1<br \/>\n\u2003\u2003 vendos dhgrp 2<br \/>\n\u2003 next<br \/>\nend<\/p>\n<p>konfiguro router-in statik<br \/>\n\u2003redakto 1<br \/>\n\u2003\u2003vendos gateway 2.2.2.2<br \/>\n\u043d\u0430 set device \"WAN1\"<br \/>\n\u2003n\u00eb vijim<br \/>\n\u2003redakto 3<br \/>\n\u2003\u2003vendos gateway 4.4.4.2<br \/>\n\u043d\u0430 set device \"WAN2\"<br \/>\n\u2003n\u00eb vijim<br \/>\nend<\/p>\n<p>konfiguro router-in bgp<br \/>\n\u2003 vendos as 65003<br \/>\n\u2003 vendos router-id 10.200.7.1<br \/>\n\u2003 vendos ebgp-multipath \u00e7aktivizuar<br \/>\n\u2003 konfiguro fq<br \/>\n\u0440\u0435\u0434akto \"192.168.254.1\"<br \/>\n\u2003\u2003\u2003 vendos as-n\u00eb e larg\u00ebt 65002<br \/>\n\u2003\u2003 next<br \/>\n\u0440\u0435\u0434akto \"192.168.254.3\"<br \/>\n\u2003\u2003\u2003vendos as-n\u00eb e larg\u00ebt 65002<br \/>\n\u2003\u2003 next<br \/>\n\u2003 end<\/p>\n<p>\u2003 konfiguro rrjetin<br \/>\n\u2003\u2003 redakto 1<br \/>\n\u2003\u2003\u2003 vendos prefixin 10.200.0.0 255.255.0.0<br \/>\n\u2003 \u2003n\u00eb<br \/>\n end <\/p>\n<p><\/code><\/p>\n<p>T\u00eb dh\u00ebnat i jap n\u00eb form\u00ebn tekstuale, sepse, sipas mendimit tim, k\u00ebshtu \u00ebsht\u00eb m\u00eb e leht\u00eb t\u00eb konfigurosh VPN. Pothuajse t\u00eb gjitha konfigurimet jan\u00eb t\u00eb nj\u00ebjta nga t\u00eb dyja an\u00ebt, dhe n\u00eb form\u00ebn tekstuale mund t\u00eb realizohen me kopjim-ngjitje. N\u00ebse e b\u00ebni t\u00eb nj\u00ebjt\u00ebn gj\u00eb n\u00eb nd\u00ebrfaqen e uebit, \u00ebsht\u00eb e leht\u00eb t\u00eb gaboni - t\u00eb harroni ndonj\u00eb kutin\u00eb, t\u00eb vendosni nj\u00eb vler\u00eb t\u00eb gabuar. <\/p>\n<p>Pas shtimit t\u00eb interfaz\u00ebve n\u00eb paket\u00eb<\/p>\n<p><img decoding=\"async\" alt=\"Analiza e SD-WAN m\u00eb demokratike: arkitektura, konfigurimi, administrimi dhe pengesat\" src=\"\/wp-content\/uploads\/2020\/09\/caab2c83dc97ebeae20ce24cee69dfe6.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nt\u00eb gjitha rrug\u00ebt dhe politikat e siguris\u00eb mund t\u00eb referohen tek ajo, e jo tek nj\u00ebsi t\u00eb ve\u00e7anta. T\u00eb pakt\u00ebn, duhet t\u00eb lejohet trafiku nga rrjetet e brendshme n\u00eb SD-WAN. Kur krijoni rregulla p\u00ebr to, mund t\u00eb aplikoni masa mbrojt\u00ebse, si IPS, antivirus dhe zbulimin e HTTPS.<\/p>\n<p><img decoding=\"async\" alt=\"Analiza e SD-WAN m\u00eb demokratike: arkitektura, konfigurimi, administrimi dhe pengesat\" src=\"\/wp-content\/uploads\/2020\/09\/ef4b4f24e5b7644ad754632082da2b59.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u00ebr paket\u00ebn konfigurohen Rregullat SD-WAN. K\u00ebto jan\u00eb rregulla q\u00eb p\u00ebrcaktojn\u00eb algoritmin e balancimit p\u00ebr trafik specifik. Ato jan\u00eb t\u00eb ngjashme me politikat e routing n\u00eb Routing i Bazuar n\u00eb Politika, vet\u00ebm n\u00eb vend t\u00eb rezultateve t\u00eb p\u00ebrkufizimit t\u00eb trafikut, nuk vendoset next-hop ose nj\u00ebsi e zakonshme dal\u00ebse, por nd\u00ebrfaqet e shtyra n\u00eb paket\u00ebn SD-WAN plus algoritmi i balancimit t\u00eb trafikut mes k\u00ebtyre nd\u00ebrfaqeve. <\/p>\n<p>Traficin mund t\u00eb ndahet nga fluksi i p\u00ebrgjithsh\u00ebm sipas informacionit L3-L4, aplikacioneve t\u00eb njohura, sh\u00ebrbimeve t\u00eb internetit (URL dhe IP), si dhe sipas p\u00ebrdoruesve t\u00eb njohur t\u00eb stacioneve t\u00eb pun\u00ebs dhe laptop\u00ebve. Pas k\u00ebsaj, p\u00ebr trafik t\u00eb ndar\u00eb mund t\u00eb caktohet nj\u00eb nga algoritmet e m\u00ebposhtme t\u00eb balansimit:<\/p>\n<p><img decoding=\"async\" alt=\"Analiza e SD-WAN m\u00eb demokratike: arkitektura, konfigurimi, administrimi dhe pengesat\" src=\"\/wp-content\/uploads\/2020\/09\/3744630184aea0b9ffaa471910885736.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00eb list\u00ebn e Preferenc\u00ebs nga Interface zgjidhen ato interfaces nga ata q\u00eb jan\u00eb shtuar n\u00eb paket\u00eb, t\u00eb cilat do t\u00eb sh\u00ebrbejn\u00eb p\u00ebr k\u00ebt\u00eb lloj trafiku. Duke shtuar jo t\u00eb gjitha interfaces, mund t\u00eb kufizoni p\u00ebr kanalet p\u00ebrmes t\u00eb cilave kalon, p\u00ebr shembull, emaili, n\u00ebse nuk d\u00ebshiron ta ngarkosh at\u00eb me kanale t\u00eb shtrenjta me SLA t\u00eb lart\u00eb. N\u00eb FortiOS 6.4.1 \u00ebsht\u00eb shtuar mund\u00ebsia p\u00ebr t\u00eb grupuar interfaces, t\u00eb shtuar n\u00eb paket\u00ebn SD-WAN n\u00eb zona, duke krijuar, p\u00ebr shembull, nj\u00eb zon\u00eb p\u00ebr lidhjet me vendet e larg\u00ebta dhe nj\u00eb tjet\u00ebr \u2013 p\u00ebr aksesin lokal n\u00eb internet duke p\u00ebrdorur NAT. Po, edhe trafiku q\u00eb shkon n\u00eb internet t\u00eb zakonsh\u00ebm mund t\u00eb balancohet.<\/p>\n<h3>Rreth algoritmeve t\u00eb balansimit<br \/>\n<\/h3>\n<p>\nSa i p\u00ebrket m\u00ebnyr\u00ebs se si Fortigate (firewall nga Fortinet) mund t\u00eb ndaj\u00eb trafik mes kanaleve, ka dy mund\u00ebsi interesante, t\u00eb cilat nuk jan\u00eb shum\u00eb t\u00eb zakonshme n\u00eb treg:<\/p>\n<p><b>Kostoja m\u00eb e ul\u00ebt (SLA)<\/b> \u2013 nga t\u00eb gjitha nd\u00ebrfaqet q\u00eb p\u00ebrmbushin SLA n\u00eb k\u00ebt\u00eb moment, zgjidhet ajo me kostot (cost) m\u00eb t\u00eb ul\u00ebt, e cila \u00ebsht\u00eb caktuar manualisht nga administrator. Ky mod i p\u00ebrshtatet trafikut \"m\u00eb voluminoz\", si\u00e7 \u00ebsht\u00eb back-up dhe transferi i skedar\u00ebve. <\/p>\n<p><b>Cil\u00ebsia m\u00eb e Mir\u00eb (SLA)<\/b> \u2013 ky algoritem, p\u00ebrve\u00e7 vonesave, jitter-it dhe humbjeve t\u00eb paketave, Fortigate mund t\u00eb p\u00ebrdor\u00eb edhe ngarkes\u00ebn aktuale t\u00eb kanaleve p\u00ebr t\u00eb vler\u00ebsuar cil\u00ebsin\u00eb e tyre; ky mod \u00ebsht\u00eb i p\u00ebrshtatsh\u00ebm p\u00ebr trafikun \"delikat\", si telefonia IP (VoIP) dhe videokonferenca.<\/p>\n<p>P\u00ebr k\u00ebto algoritmo, k\u00ebrkohet konfigurimi i mat\u00ebsit t\u00eb performanc\u00ebs s\u00eb kanaleve t\u00eb komunikimit \u2013 Performance SLA. Ky mat\u00ebs kontrollon periodikisht (check interval) informacionin mbi p\u00ebrmbushjen e SLA: humbjet (packet loss), vones\u00ebn (latency) dhe jitter-in (jitter) n\u00eb kanal, \u2014 dhe mund t\u00eb \"refuzoj\u00eb\" ato kanale q\u00eb aktualisht nuk p\u00ebrmbushin vlerat minimale t\u00eb cil\u00ebsis\u00eb \u2013 humbin shum\u00eb pakete ose japin vonesa t\u00eb m\u00ebdha. P\u00ebrve\u00e7 k\u00ebsaj, mat\u00ebsi monitoron statusin e kanalit dhe mund ta p\u00ebrjashtoj\u00eb p\u00ebrkoh\u00ebsisht nga bundle n\u00eb rast t\u00eb humbjeve t\u00eb p\u00ebrs\u00ebritura t\u00eb p\u00ebrgjigjeve (failures before inactive). Pas rikthimit, pas disa p\u00ebrgjigjeve radhazi (restore link after), mat\u00ebsi automatikisht do ta ri-integroj\u00eb kanalin n\u00eb bundle, dhe t\u00eb dh\u00ebnat do t\u00eb fillojn\u00eb p\u00ebrs\u00ebri t\u00eb transmetohen p\u00ebrmes tij.<\/p>\n<p>K\u00ebtu \u00ebsht\u00eb si duket konfigurimi i \"mat\u00ebsit\": <\/p>\n<p><img decoding=\"async\" alt=\"Analiza e SD-WAN m\u00eb demokratike: arkitektura, konfigurimi, administrimi dhe pengesat\" src=\"\/wp-content\/uploads\/2020\/09\/455be7a8df6ffab47c6fd5b3a763e5cd.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00eb nd\u00ebrfaqen web, si protokoll p\u00ebr testet jan\u00eb t\u00eb disponueshme ICMP-Echo-request, HTTP-GET dhe DNS request. N\u00eb komand\u00ebn e linj\u00ebs, opsionet jan\u00eb pak m\u00eb shum\u00eb: jan\u00eb t\u00eb disponueshme opsionet TCP-echo dhe UDP-echo, si dhe protokolli i specializuar p\u00ebr matjen e cil\u00ebsis\u00eb \u2013 TWAMP.<\/p>\n<p><img decoding=\"async\" alt=\"Analiza e SD-WAN m\u00eb demokratike: arkitektura, konfigurimi, administrimi dhe pengesat\" src=\"\/wp-content\/uploads\/2020\/09\/218d9805451cd7eb846d97fc7d95dab5.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nRezultatet e matjeve mund t\u00eb shihen edhe n\u00eb nd\u00ebrfaqen web: <\/p>\n<p><img decoding=\"async\" alt=\"Analiza e SD-WAN m\u00eb demokratike: arkitektura, konfigurimi, administrimi dhe pengesat\" src=\"\/wp-content\/uploads\/2020\/09\/f02ef988ba41f8068656f83996b50085.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDhe n\u00eb komand\u00ebn e linj\u00ebs: <\/p>\n<p><img decoding=\"async\" alt=\"Analiza e SD-WAN m\u00eb demokratike: arkitektura, konfigurimi, administrimi dhe pengesat\" src=\"\/wp-content\/uploads\/2020\/09\/8b07ce808da2ee70d675a0fd009c4e10.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Troubleshooting<\/h3>\n<p>\nN\u00ebse keni krijuar nj\u00eb rregull, por gjith\u00e7ka nuk funksionon si\u00e7 pritej, \u00ebsht\u00eb mir\u00eb t\u00eb shikoni vler\u00ebn e Hit Count n\u00eb list\u00ebn e Rregullave SD-WAN. Kjo do t\u00eb tregoj\u00eb n\u00ebse trafiku hyn n\u00eb k\u00ebt\u00eb rregull apo jo:<\/p>\n<p><img decoding=\"async\" alt=\"Analiza e SD-WAN m\u00eb demokratike: arkitektura, konfigurimi, administrimi dhe pengesat\" src=\"\/wp-content\/uploads\/2020\/09\/a1fceb96cecd09a292e0949b9719335e.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00eb faqen e cil\u00ebsimeve t\u00eb mat\u00ebsit vet\u00eb, mund t\u00eb shihni ndryshimin e parametrave t\u00eb kanalit n\u00eb koh\u00eb. Vlera prag \u00ebsht\u00eb treguar me vij\u00eb t\u00eb ndjeshme.<\/p>\n<p><img decoding=\"async\" alt=\"Analiza e SD-WAN m\u00eb demokratike: arkitektura, konfigurimi, administrimi dhe pengesat\" src=\"\/wp-content\/uploads\/2020\/09\/70f738769673d0a80f7382a3b0dd6b47.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00eb nd\u00ebrfaqen web mund t\u00eb shihni si shp\u00ebrndahet trafiku sipas volumit t\u00eb t\u00eb dh\u00ebnave t\u00eb d\u00ebrguara\/pranuara dhe numrit t\u00eb seancave:<\/p>\n<p><img decoding=\"async\" alt=\"Analiza e SD-WAN m\u00eb demokratike: arkitektura, konfigurimi, administrimi dhe pengesat\" src=\"\/wp-content\/uploads\/2020\/09\/1824160280f684a734d553f152f2153d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u00ebr m\u00eb tep\u00ebr, ka nj\u00eb mund\u00ebsi t\u00eb shk\u00eblqyer p\u00ebr t\u00eb ndjekur kalimin e paketave me detaje maksimale. Kur punoni n\u00eb nj\u00eb rrjet real, konfigurimi i pajisjes akumulon shum\u00eb politika t\u00eb ruterit, firewall-it dhe shp\u00ebrndarjes s\u00eb trafikut p\u00ebr portat SD-WAN. T\u00eb gjitha k\u00ebto nd\u00ebrveprojn\u00eb n\u00eb m\u00ebnyra komplekse, dhe, megjith\u00ebse furnizuesi ofron skema t\u00eb detajuara t\u00eb algoritmeve t\u00eb p\u00ebrpunimit t\u00eb paketave, \u00ebsht\u00eb shum\u00eb e r\u00ebnd\u00ebsishme t\u00eb keni mund\u00ebsin\u00eb t\u00eb mos nd\u00ebrtosh dhe kontrollosh teorit\u00eb, por t\u00eb shikosh se ku shkon realisht trafiku.<\/p>\n<p>P\u00ebr shembull, grupi i ardhsh\u00ebm i komandave<\/p>\n<p><code>diagnostic\u00eb filt\u00ebr fluksi saddr 10.200.64.15<br \/>\ndiagnostic\u00eb filt\u00ebr fluksi daddr 10.1.7.2<br \/>\ndiagnostic\u00eb trego fluksin e funksionit<br \/>\ndiagnostic\u00eb aktivizo debugimin<br \/>\ndiagnostic\u00eb gjurm\u00eb 2<\/code><\/p>\n<p>do t\u00eb ndihmoj\u00eb n\u00eb ndjekjen e dy paketave me adres\u00ebn e burimit 10.200.64.15 dhe adres\u00ebn e marr\u00ebsit 10.1.7.2.<br \/>\nNe pingojm\u00eb 10.7.1.2 nga 10.200.64.15 dy her\u00eb dhe shikojm\u00eb daljen n\u00eb konsol\u00eb.<\/p>\n<p>Paketa e par\u00eb:<\/p>\n<p><img decoding=\"async\" alt=\"Analiza e SD-WAN m\u00eb demokratike: arkitektura, konfigurimi, administrimi dhe pengesat\" src=\"\/wp-content\/uploads\/2020\/09\/eb0f907f41b573df1b4044e13edac140.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPaketa e dyt\u00eb:<\/p>\n<p><img decoding=\"async\" alt=\"Analiza e SD-WAN m\u00eb demokratike: arkitektura, konfigurimi, administrimi dhe pengesat\" src=\"\/wp-content\/uploads\/2020\/09\/509f4ac1cf2db597cfe201812a942288.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJa paketa e par\u00eb e marr\u00eb nga muri i zjarrit:<br \/>\n<code>id=20085 trace_id=475 func=print_pkt_detail line=5605 msg=\"vd-Internet:0 received a packet(proto=1, 10.200.64.15:42-&gt;10.1.7.2:2048) from DMZ-Office. type=8, code=0, id=42, seq=0.\"<br \/>\nVDOM \u2013 Internet, Proto=1 (ICMP), <b>DMZ-Office \u2013 emri i nd\u00ebrfaqes L3. <\/b>Lloji=8 \u2013 Echo.<\/code><\/p>\n<p>P\u00ebr t\u00eb, \u00ebsht\u00eb krijuar nj\u00eb seanc\u00eb e re:<br \/>\n<code>msg=\"aloconi nj\u00eb sesion t\u00eb ri-0006a627\"<\/code><\/p>\n<p>Doli q\u00eb kishte nj\u00eb p\u00ebrputhje n\u00eb cil\u00ebsimet e politikave t\u00eb rrug\u00ebs<br \/>\n<code>msg=\"Politika e ndeshjes s\u00eb identifikimit t\u00eb routing-it=2136539137: te 10.1.7.2 p\u00ebrmes ifindex-110\"<\/code><\/p>\n<p>Kuptohet se paketa duhet t\u00eb d\u00ebrgohet n\u00eb nj\u00eb nga tunel\u00ebt VPN:<br \/>\n<code>\"gjej nj\u00eb rrug\u00eb: flamur=04000000 gw-192.168.254.1 p\u00ebrmes DC-Ph1-1\"<\/code><\/p>\n<p>N\u00eb politikat e murit t\u00eb zjarrit zbulohet nj\u00eb rregull miratues:<br \/>\n<code>msg=\"Lejuar nga Politika-3:\"<\/code><\/p>\n<p>Paketa enkriptohet dhe d\u00ebrgohet n\u00eb tunelin VPN:<br \/>\n<code>func=ipsecdev_hard_start_xmit line=789 msg=\"hyj\u00eb n\u00eb nd\u00ebrfaqen IPsec-DC-Ph1-1\"<br \/>\nfunc=_ipsecdev_hard_start_xmit line=666 msg=\"tuneli IPsec-DC-Ph1-1\"<br \/>\nfunc=esp_output4 line=905 msg=\"IPsec enkriptim\/autorizim\"<\/code><\/p>\n<p>Paketa e enkriptuar d\u00ebrgohet n\u00eb adres\u00ebn e portit p\u00ebr k\u00ebt\u00eb nd\u00ebrfaqe WAN:<br \/>\n<code>msg=\"d\u00ebrgo te 2.2.2.2 p\u00ebrmes intf-WAN1\"<\/code><\/p>\n<p>P\u00ebr paketa e dyt\u00eb, gjith\u00e7ka ndodh n\u00eb m\u00ebnyr\u00eb t\u00eb ngjashme, por ajo d\u00ebrgohet n\u00eb nj\u00eb tunel VPN tjet\u00ebr dhe largohet p\u00ebrmes nj\u00eb porte tjet\u00ebr t\u00eb murit t\u00eb zjarrit:<br \/>\n<code>func=ipsecdev_hard_start_xmit line=789 msg=\"hyr IPsec interface-DC-Ph1-2\"<br \/>\nfunc=_ipsecdev_hard_start_xmit line=666 msg=\"tuneli IPsec-DC-Ph1-2\"<br \/>\nfunc=esp_output4 line=905 msg=\"IPsec enkriptim\/autorizim\"<br \/>\nfunc=ipsec_output_finish line=622 msg=\"d\u00ebrgo n\u00eb 4.4.4.2 p\u00ebrmes intf-WAN2\"<\/code><\/p>\n<h3>Avantazhet e zgjidhjes<br \/>\n<\/h3>\n<p>\n<b>Funksionaliteti t\u00eb besuesh\u00ebm dhe nd\u00ebrfaqe e leht\u00eb p\u00ebr t'u p\u00ebrdorur. <\/b>Grupi i funksioneve q\u00eb ishte n\u00eb FortiOS para shfaqjes s\u00eb SD-WAN \u00ebsht\u00eb ruajtur plot\u00ebsisht. Kjo do t\u00eb thot\u00eb q\u00eb ne kemi nj\u00eb soft t\u00eb zhvilluar m\u00eb par\u00eb, nj\u00eb sistem t\u00eb pjekur nga nj\u00eb ofrues i besuesh\u00ebm t\u00eb firewall-eve. Me nj\u00eb grup t\u00eb zakonsh\u00ebm funksionesh rrjeti dhe nj\u00eb nd\u00ebrfaqe web t\u00eb leht\u00eb dhe t\u00eb thjesht\u00eb p\u00ebr t'u m\u00ebsuar. A kan\u00eb shum\u00eb ofrues SD-WAN funksionalitetin Remote-Access VPN n\u00eb pajisjet e tyre p\u00ebrfundimtare?<\/p>\n<p><b>Siguria e nivelit 80. <\/b>FortiGate \u00ebsht\u00eb midis zgjidhjeve m\u00eb t\u00eb mira p\u00ebr firewall. N\u00eb internet ka shum\u00eb materiale p\u00ebr konfigurimin dhe administrimin e firewalleve, dhe n\u00eb tregun e pun\u00ebs ka mjaft specialist\u00eb t\u00eb siguris\u00eb q\u00eb kan\u00eb m\u00ebsuar zgjidhjet e ofruesit.<\/p>\n<p><b>\u00c7mimi zero p\u00ebr funksionalitetin SD-WAN. <\/b>T\u00eb nd\u00ebrtosh nj\u00eb rrjet SD-WAN mbi FortiGate kushton po aq sa t\u00eb nd\u00ebrtosh nj\u00eb rrjet t\u00eb zakonsh\u00ebm WAN mbi t\u00eb, pasi nuk nevojiten licenca shtes\u00eb p\u00ebr t\u00eb realizuar funksionalitetin SD-WAN. <\/p>\n<p><b>T\u00eb hysh me koston e ul\u00ebt. <\/b>Fortigate ofron nj\u00eb klasifikim t\u00eb mir\u00eb t\u00eb pajisjeve p\u00ebr performanc\u00eb t\u00eb ndryshme. Modelet m\u00eb t\u00eb vogla dhe m\u00eb t\u00eb lira jan\u00eb t\u00eb p\u00ebrshtatshme p\u00ebr t\u00eb vendosur nj\u00eb zyr\u00eb ose nj\u00eb pik\u00eb shitjeje, p\u00ebr shembull, p\u00ebr 3-5 punonj\u00ebs. Shum\u00eb ofrues nuk kan\u00eb model t\u00eb till\u00eb me performanc\u00eb t\u00eb ul\u00ebt dhe \u00e7mime t\u00eb arsyeshme. <\/p>\n<p><b>Performanc\u00eb e lart\u00eb. <\/b>P\u00ebrmbledhja e funksionalitetit SD-WAN n\u00eb balancimin e trafikut i ka lejuar kompanis\u00eb t\u00eb l\u00ebshoj\u00eb nj\u00eb SD-WAN ASIC t\u00eb specializuar, i cili siguron q\u00eb funksionimi i SD-WAN nuk e ul performanc\u00ebn e p\u00ebrgjithshme t\u00eb firewall-it. <\/p>\n<p><b>Mund\u00ebsia p\u00ebr t\u00eb realizuar nj\u00eb zyr\u00eb plot\u00ebsisht me pajisje nga Fortinet. <\/b>Kjo p\u00ebrfshin \u00e7iftin e firewalleve, switch-at dhe aksesoret Wi-Fi. T\u00eb menaxhosh nj\u00eb zyr\u00eb t\u00eb till\u00eb \u00ebsht\u00eb e leht\u00eb dhe e p\u00ebrshtatshme \u2013 switch-at dhe aksesoret regjistrohen tek firewalle dhe menaxhohen prej andej. K\u00ebshtu, p\u00ebr shembull, mund t\u00eb duket porta e switch-it nga nd\u00ebrfaqja e firewalle-it, me t\u00eb cil\u00ebn ky switch menaxhohet:<\/p>\n<p><img decoding=\"async\" alt=\"Analiza e SD-WAN m\u00eb demokratike: arkitektura, konfigurimi, administrimi dhe pengesat\" src=\"\/wp-content\/uploads\/2020\/09\/edd23e0aa9a77d3acb7eee22203a423d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Mungesa e kontrolleve si nj\u00eb pik\u00eb e vetme d\u00ebshtimi. <\/b>Kjo theksohet nga vet\u00eb ofruesi, por kjo mund t\u00eb quhet p\u00ebrfitim vet\u00ebm pjes\u00ebrisht, sepse p\u00ebr ofruesit q\u00eb kan\u00eb kontrollet, sigurimi i q\u00ebndrueshm\u00ebris\u00eb s\u00eb tyre \u00ebsht\u00eb i p\u00ebrballuesh\u00ebm, shumic\u00ebn e her\u00ebve n\u00eb \u00e7mimin e nj\u00eb sasi t\u00eb vog\u00ebl burimesh llogarit\u00ebse n\u00eb nj\u00eb ambient virtualizimi.<\/p>\n<h3>\u00c7far\u00eb t\u00eb keni parasysh<br \/>\n<\/h3>\n<p>\n<b>Mungesa e ndarjes s\u00eb Control Plane dhe Data Plane<\/b>. Kjo do t\u00eb thot\u00eb se rrjeti duhet t\u00eb konfigurohet ose manualisht, ose duke p\u00ebrdorur mjete tradicionale menaxhimi q\u00eb tashm\u00eb ekzistojn\u00eb \u2014 FortiManager. Te ofruesit q\u00eb kan\u00eb t\u00eb implementuar nj\u00eb ndarje t\u00eb till\u00eb, rrjeti krijohet automatikisht. Administratori mund t\u00eb ket\u00eb nevoj\u00eb vet\u00ebm t\u00eb rregulloj\u00eb topologjin\u00eb e tij, t\u00eb ndaloj\u00eb di\u00e7ka diku, dhe jo m\u00eb shum\u00eb. Megjithat\u00eb, avantazhi i FortiManager \u00ebsht\u00eb se ai di t\u00eb menaxhoj\u00eb jo vet\u00ebm firewall-et, por edhe switch-at dhe piketat e Wi-Fi, pra thuajse gjith\u00eb rrjetin. <\/p>\n<p><b>Rritja e supozuar e menaxhueshm\u00ebris\u00eb. <\/b>Pasi p\u00ebr shkak se mjetet tradicionale p\u00ebrdoren p\u00ebr automatizimin e konfigurimit t\u00eb rrjetit, menaxhueshm\u00ebria e rrjetit me zbatimin e SD-WAN rritet pak. Nga ana tjet\u00ebr, funksionaliteti i ri b\u00ebhet i disponuesh\u00ebm m\u00eb shpejt, pasi ofruesi e l\u00ebshon at\u00eb fillimisht vet\u00ebm p\u00ebr sistemin operativ t\u00eb firewall-it (duke dh\u00ebn\u00eb menj\u00ebher\u00eb mund\u00ebsin\u00eb p\u00ebr p\u00ebrdorim), dhe m\u00eb pas e plot\u00ebson me nd\u00ebrfaqet e nevojshme p\u00ebr sistemin e menaxhimit.<\/p>\n<p><b>Disa funksionalitete mund t\u00eb jen\u00eb t\u00eb disponueshme nga linja e komand\u00ebs, por jo nga nd\u00ebrfaqja web. <\/b>Nuk \u00ebsht\u00eb aq e frikshme t\u00eb hysh ndonj\u00ebher\u00eb n\u00eb linj\u00ebn e komand\u00ebs p\u00ebr t\u00eb b\u00ebr\u00eb nj\u00eb konfigurim, sa \u00ebsht\u00eb e frikshme t\u00eb mos shoh\u00ebsh n\u00eb nd\u00ebrfaqen web se di\u00e7ka \u00ebsht\u00eb konfiguruar tashm\u00eb nga linja e komand\u00ebs. Por kjo zakonisht i p\u00ebrket ve\u00e7an\u00ebrisht karakteristikave m\u00eb t\u00eb reja dhe gradualisht, me p\u00ebrdit\u00ebsimet e FortiOS, mund\u00ebsit\u00eb e nd\u00ebrfaqes web p\u00ebrmir\u00ebsohen.<\/p>\n<h3>Kush i p\u00ebrshtatet<\/h3>\n<p>\n<b>Atij, q\u00eb nuk ka shum\u00eb deg\u00eb.<\/b> Implementimi i zgjidhjes SD-WAN me komponent\u00eb kompleks\u00eb qendror\u00eb p\u00ebr nj\u00eb rrjet n\u00eb 8-10 deg\u00eb mund t\u00eb mos ia vlej\u00eb \u2013 do t\u00eb duhet t\u00eb shpenzoni para p\u00ebr licencat e pajisjeve SD-WAN dhe burimet e sistemit t\u00eb virtualizimit p\u00ebr vendosjen e komponent\u00ebve qendror\u00eb. Burimet e lira kompjuterike p\u00ebr nj\u00eb kompani t\u00eb vog\u00ebl zakonisht jan\u00eb t\u00eb kufizuara. N\u00eb rastin e Fortinet, mjafton t\u00eb blini firewall-e. <\/p>\n<p><b>P\u00ebr ata q\u00eb kan\u00eb shum\u00eb deg\u00eb t\u00eb vogla. <\/b>Te shum\u00eb ofrues, \u00e7mimi minimal i zgjidhjes p\u00ebr deg\u00eb \u00ebsht\u00eb mjaft i lart\u00eb dhe mund t\u00eb jet\u00eb i pap\u00eblqyer p\u00ebr biznesin e porosit\u00ebsit p\u00ebrfundimtar. Fortinet ofron pajisje t\u00eb vogla me nj\u00eb \u00e7mim shum\u00eb t\u00ebrheq\u00ebs. <\/p>\n<p><b>P\u00ebr ata q\u00eb nuk jan\u00eb ende t\u00eb gatsh\u00ebm t\u00eb hedhin nj\u00eb hap t\u00eb madh. <\/b>Implementimi i SD-WAN me kontrollor\u00ebt, rrug\u00ebzimin e pronarit, qasjen e re n\u00eb planifikim dhe menaxhimin e rrjetit mund t\u00eb jet\u00eb nj\u00eb hap shum\u00eb serioz p\u00ebr disa klient\u00eb. Po, ky implementim p\u00ebrfundimisht do t\u00eb ndihmoj\u00eb n\u00eb optimizimin e p\u00ebrdorimit t\u00eb kanaleve t\u00eb komunikimit dhe n\u00eb pun\u00ebn e administrator\u00ebve, por fillimisht do t\u00eb duhet t\u00eb m\u00ebsojn\u00eb shum\u00eb t\u00eb reja. Ata q\u00eb nuk jan\u00eb ende gati p\u00ebr nj\u00eb ndryshim paradigme, por duan t\u00eb nxjerrin m\u00eb shum\u00eb nga kanalet e tyre t\u00eb komunikimit, do ta gjejn\u00eb zgjidhjen nga Fortinet t\u00eb p\u00ebrshtatshme.<br \/>\n<br \/>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/croc\/blog\/520620\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0421\u0443\u0434\u044f \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u0432\u043e\u043f\u0440\u043e\u0441\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0430\u043c \u0441\u0442\u0430\u043b\u0438 \u043f\u0440\u0438\u043b\u0435\u0442\u0430\u0442\u044c \u043f\u043e SD-WAN, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f \u043d\u0430\u0447\u0430\u043b\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u0440\u0438\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0432 \u0420\u043e\u0441\u0441\u0438\u0438. \u0412\u0435\u043d\u0434\u043e\u0440\u044b, \u0435\u0441\u0442\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e, \u043d\u0435 \u0434\u0440\u0435\u043c\u043b\u044e\u0442 \u0438 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0442 \u0441\u0432\u043e\u0438 \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438, \u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u043c\u0435\u043b\u044c\u0447\u0430\u043a\u0438 \u043f\u0435\u0440\u0432\u043e\u043f\u0440\u043e\u0445\u043e\u0434\u0446\u044b \u0443\u0436\u0435 \u0432\u043d\u0435\u0434\u0440\u044f\u044e\u0442 \u0438\u0445 \u0443 \u0441\u0435\u0431\u044f \u043d\u0430 \u0441\u0435\u0442\u0438. \u041c\u044b \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u043c \u043f\u043e\u0447\u0442\u0438 \u0441\u043e \u0432\u0441\u0435\u043c\u0438 \u0432\u0435\u043d\u0434\u043e\u0440\u0430\u043c\u0438, \u0438 \u0437\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043b\u0435\u0442 \u0432 \u043d\u0430\u0448\u0435\u0439 \u043b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u044f \u0443\u0441\u043f\u0435\u043b \u043f\u043e\u043a\u043e\u043f\u0430\u0442\u044c\u0441\u044f \u0432 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0435 \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u043a\u0440\u0443\u043f\u043d\u043e\u0433\u043e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":95433,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-95432","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0421\u0443\u0434\u044f \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u0432\u043e\u043f\u0440\u043e\u0441\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0430\u043c \u0441\u0442\u0430\u043b\u0438 \u043f\u0440\u0438\u043b\u0435\u0442\u0430\u0442\u044c \u043f\u043e SD-WAN, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f \u043d\u0430\u0447\u0430\u043b\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u0440\u0438\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0432 \u0420\u043e\u0441\u0441\u0438\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/razbor-samogo-demokratichnogo-iz-sd-wan-arhitektura-nastrojka-administrirovanie-i-podvodnye-kamni\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0430\u0437\u0431\u043e\u0440 \u0441\u0430\u043c\u043e\u0433\u043e \u0434\u0435\u043c\u043e\u043a\u0440\u0430\u0442\u0438\u0447\u043d\u043e\u0433\u043e \u0438\u0437 SD-WAN: \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0430, \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430, \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0438 \u043f\u043e\u0434\u0432\u043e\u0434\u043d\u044b\u0435 \u043a\u0430\u043c\u043d\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0421\u0443\u0434\u044f \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u0432\u043e\u043f\u0440\u043e\u0441\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0430\u043c \u0441\u0442\u0430\u043b\u0438 \u043f\u0440\u0438\u043b\u0435\u0442\u0430\u0442\u044c \u043f\u043e SD-WAN, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f \u043d\u0430\u0447\u0430\u043b\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u0440\u0438\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0432 \u0420\u043e\u0441\u0441\u0438\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/razbor-samogo-demokratichnogo-iz-sd-wan-arhitektura-nastrojka-administrirovanie-i-podvodnye-kamni\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-09-29T05:42:38+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-09-29T05:42:38+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Analiza e SD-WAN m\u00eb demokratik: arkitektura, konfigurimi, administrimi dhe pengesat | ProHoster","description":"Duke numrit t\u00eb pyetjeve q\u00eb po na vijn\u00eb p\u00ebr SD-WAN, tecnologia duket se ka filluar t\u00eb sigurohet mir\u00eb n\u00eb Rusi.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/razbor-samogo-demokratichnogo-iz-sd-wan-arhitektura-nastrojka-administrirovanie-i-podvodnye-kamni","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0430\u0437\u0431\u043e\u0440 \u0441\u0430\u043c\u043e\u0433\u043e \u0434\u0435\u043c\u043e\u043a\u0440\u0430\u0442\u0438\u0447\u043d\u043e\u0433\u043e \u0438\u0437 SD-WAN: \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0430, \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430, \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0438 \u043f\u043e\u0434\u0432\u043e\u0434\u043d\u044b\u0435 \u043a\u0430\u043c\u043d\u0438 | ProHoster","og:description":"\u0421\u0443\u0434\u044f \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u0432\u043e\u043f\u0440\u043e\u0441\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0430\u043c \u0441\u0442\u0430\u043b\u0438 \u043f\u0440\u0438\u043b\u0435\u0442\u0430\u0442\u044c \u043f\u043e SD-WAN, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f \u043d\u0430\u0447\u0430\u043b\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u0440\u0438\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0432 \u0420\u043e\u0441\u0441\u0438\u0438.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/razbor-samogo-demokratichnogo-iz-sd-wan-arhitektura-nastrojka-administrirovanie-i-podvodnye-kamni","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-29T05:42:38+00:00","article:modified_time":"2020-09-29T05:42:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"95432","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:05:30","updated":"2026-02-04 14:42:07","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/95432","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=95432"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/95432\/revisions"}],"predecessor-version":[{"id":156763,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/95432\/revisions\/156763"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/95433"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=95432"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=95432"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=95432"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}