Lumelang bohle. Sengoliloeng sena se etselitsoe ba nang le lisebelisoa tse ngata tsa Mikrotik ka har'a likepe tsa bona, 'me ba batlang ho etsa bonngoe bo bongata e le hore ba se ke ba hokela sesebelisoa ka seng ka thoko. Sehloohong sena ke tla hlalosa morero oo, ka bomalimabe, o sa kang oa fihlela maemo a ntoa ka lebaka la lintlha tsa batho. Ka bokhutšoanyane: li-routers tse fetang 200, ho seta ka potlako le koetliso ea basebetsi, ho kopanngoa ka libaka, marang-rang a ho sefa le mabotho a khethehileng, bokhoni ba ho kenya melao habonolo lisebelisoa tsohle, ho rema lifate le ho laola ho fihlella.
Se hlalositsoeng ka tlase ha se etse eka ke nyeoe e lokiselitsoeng, empa ke tšepa hore e tla ba molemo ho uena ha u rera marang-rang a hau le ho fokotsa liphoso. Mohlomong lintlha tse ling le litharollo li kanna tsa bonahala li sa nepahala ho uena - haeba ho joalo, ngola litlhalosong. Ho nyatsuoa tabeng ena e tla ba phihlelo bakeng sa letlotlo le tloaelehileng. Ka hona, 'mali, sheba litlhaloso, mohlomong mongoli o entse phoso e kholo - sechaba se tla thusa.
Palo ea li-routers ke 200-300, e hasaneng litoropong tse fapaneng tse nang le boleng bo fapaneng ba likhokahano tsa Marang-rang. Hoa hlokahala ho etsa ntho e 'ngoe le e' ngoe ka bokhabane le ka mokhoa o hlakileng ho hlalosetsa batsamaisi ba lehae hore na tsohle li tla sebetsa joang.
Joale, morero ofe kapa ofe o qala hokae? Ehlile, le TK.
- Ho hlophisoa ha moralo oa marang-rang bakeng sa makala ohle ho latela litlhoko tsa bareki, karohano ea marang-rang (ho tloha ho marang-rang a 3 ho isa ho a 20 makaleng ho latela palo ea lisebelisoa).
- Ho theha lisebelisoa lekaleng ka leng. Ho hlahloba lebelo la sebele la phallo ea mofani tlas'a maemo a fapaneng a ts'ebetso.
- Tlhophiso ea ts'ireletso ea lisebelisoa, taolo ea lethathamo la batho ba sa lumeleng, ho lemoha litlhaselo ka mokhoa o ikemetseng ka nako e itseng, ho fokotsa tšebeliso ea mekhoa e fapaneng ea tekheniki e sebelisoang ho thibela phihlello ea taolo le ho hana litšebeletso.
- Tlhophiso ea likhokahano tse sireletsehileng tsa VPN tse nang le sefa marang-rang ho latela litlhoko tsa bareki. Bonyane ba likhokahano tsa VPN tse 3 ho tloha lekaleng ka leng ho ea bohareng.
- E ipapisitse le lintlha tsa 1, 2. Khetha mekhoa e nepahetseng ea ho haha li-VPN tse mamellang liphoso. Haeba e nepahetse, theknoloji e matla ea ho tsamaisa e ka khethoa ke rakonteraka.
- Tlhophiso ea ho etelletsa pele sephethephethe ka liprothokholo, likou, baamoheli le lits'ebeletso tse ling tse ikhethileng tse sebelisoang ke moreki. (VOIP, mabotho a nang le litšebeletso tsa bohlokoa)
- Mokhatlo oa ho beha leihlo le ho rengoa ha liketsahalo tsa router bakeng sa karabelo ea basebetsi ba ts'ehetso ea tekheniki.
Joalo ka ha re utloisisa, maemong a mangata, litlhaloso tsa tekheniki li etsoa ho latela litlhoko. Ke ile ka iketsetsa litlhoko tsena ka bonna, ka mor'a ho mamela mathata a maholo. O ile a lumela monyetla oa hore motho e mong a ka hlokomela lintlha tsena.
Ke lisebelisoa life tse tla sebelisoa ho phethahatsa litlhoko tsena:
- ELK stack (ka mor'a nako e itseng, ho ile ha hlaka hore ho tla sebelisoa ka mokhoa o phollatsi sebakeng sa logstash).
- Ansible. Bakeng sa boiketlo ba tsamaiso le ho arolelana phihlelo, re tla sebelisa AWX.
- GITLAB. Ha ho hlokahale ho hlalosa mona. Re ka be re le kae ntle le taolo ea mofuta oa li-configs tsa rona?
- PowerShell. Ho tla ba le script e bonolo bakeng sa moloko oa pele oa config.
- Doku wiki, bakeng sa ho ngola litokomane le litataiso. Tabeng ena, re sebelisa habr.com.
- Tlhokomelo e tla etsoa ka zabbix. Setšoantšo sa khokahano se tla boela se toroe moo bakeng sa kutloisiso e akaretsang.
Lintlha tsa ho seta tsa EFK
Mabapi le ntlha ea pele, ke tla hlalosa feela mohopolo oo li-indices li tla hahoa ka oona. Ho na le tse ngata
lingoloa tse ntle haholo mabapi le ho theha le ho amohela li-log ho tsoa ho lisebelisoa tse tsamaisang mikrotik.
Ke tla bua ka lintlha tse ling:
1. Ho ea ka setšoantšo, ho bohlokoa ho nahana ka ho amohela li-logs tse tsoang libakeng tse fapaneng le likoung tse fapaneng. Bakeng sa sena re tla sebelisa aggregator ea log. Re boetse re batla ho etsa li-graph tsa bokahohleng bakeng sa li-routers tsohle tse nang le bokhoni ba ho arolelana phihlello. Ebe re etsa li-index ka tsela e latelang:
mona ke karolo ea config e nang le mokhoa o phollatsi mofuta oa elasticsearch
logstash_format ke 'nete
index_name mikrotiklogs.north
logstash_prefix mikrotiklogs.north
flush_interval 10s
mabotho : 9200
port 9200
Ka tsela ena re ka kopanya li-routers le karolo ho latela moralo - mikrotiklogs.west, mikrotiklogs.south, mikrotiklogs.east. Ke hobane'ng ha e etsa hore e be thata hakaale? Re utloisisa hore re tla ba le lisebelisoa tse 200 kapa ho feta. Ha o khone ho boloka tlaleho ea tsohle. Ka mofuta oa 6.8 oa elasticsearch, litlhophiso tsa ts'ireletso li fumaneha ho rona (ntle le ho reka laesense), ka hona re ka aba litokelo tsa ho shebella lipakeng tsa basebetsi ba ts'ehetso ea tekheniki kapa batsamaisi ba sistimi ea lehae.
Litafole, li-graph - mona u hloka feela ho lumellana - ebang u sebelise tse tšoanang, kapa motho e mong le e mong o etsa se mo loketseng.
2. Ka ho rema lifate. Haeba re nolofalletsa ho kena ho melao ea firewall, joale re etsa mabitso ntle le libaka. Ho ka bonoa hore ka ho sebelisa config e bonolo ka mokhoa o phollatsi, re ka sefa data le ho etsa liphanele tse loketseng. Setšoantšo se ka tlase ke router ea ka ea lapeng.
3. Ka sebaka se hapiloeng le lifate. Ka karolelano, ka melaetsa ea 1000 ka hora, li-logs li nka 2-3 MB ka letsatsi, tseo, u bonang, ha li ngata hakaalo. Mofuta oa Elasticsearch 7.5.
KHABANE.AWX
Ka lehlohonolo ho rona, re na le module e lokiselitsoeng bakeng sa li-router
Ke boletse ka AWX, empa litaelo tse ka tlase li bua feela ka ansible ka mokhoa o hloekileng - ke nahana hore ho ba sebelitseng ka ansible, ho ke ke ha e-ba le mathata a ho sebelisa awx ka gui.
Ho bua 'nete, pele ho sena ke ile ka sheba batataisi ba bang moo ba neng ba sebelisa ssh,' me kaofela ba ne ba e-na le mathata a fapaneng ka nako ea karabo le mathata a mang a mangata. Ke pheta, ha ea ka ea loana , nka tlhahisoleseding ena e le teko e sa kang ea feta ho ema ho li-routers tse 20.
Re hloka ho sebelisa setifikeiti kapa akhaonto. Ho ho uena ho etsa qeto, ke ea mangolo a mangolo. Lintlha tse ling tse poteletseng mabapi le litokelo. Ke fana ka litokelo tsa ho ngola - bonyane "reset config" e ke ke ea sebetsa.
Ha hoa lokela ho ba le mathata a ho hlahisa, ho kopitsa le ho tlisa setifikeiti:
Lenane la litaelo tse khutšoaneHo PC ea hau
ssh-keygen -t RSA, araba lipotso, boloka senotlolo.
Kopitsa ho mikrotik:
user ssh-keys import public-key-file=id_mtx.pub user=acible
Pele o hloka ho theha ak'haonte mme o fane ka litokelo ho eona.
Ho hlahloba khokahano ka ho sebelisa setifikeiti
ssh -p 49475 -i /keys/mtx [imeile e sirelelitsoe]
Ngolisa vi /etc/ansible/hosts
MT01 ansible_network_os=routos ansible_ssh_port=49475 ansible_ssh_user= ansible
MT02 ansible_network_os=routos ansible_ssh_port=49475 ansible_ssh_user= ansible
MT03 ansible_network_os=routos ansible_ssh_port=49475 ansible_ssh_user= ansible
MT04 ansible_network_os=routos ansible_ssh_port=49475 ansible_ssh_user= ansible
Mohlala, buka ea ho bapala: - lebitso: add_work_sites
mabotho: testmt
serial: 1
khokahano: network_cli
remote_user: mikrotik.west
bokella_linnete: ho joalo
mesebetsi:
- lebitso: eketsa Work_sites
routeros_command:
litaelo:
— /ip firewall address-list add address=gov.ru list=work_sites comment=Ticket665436_Ochen_nado
- / lenane la aterese ea ip ea firewall eketsa aterese=habr.com list=work_sites comment=for_habr
Joalokaha u bona ho tsoa ho tlhophiso e kaholimo, ha ho thata ho iketsetsa libuka tsa hau tsa ho bapala. Ho lekane ho tseba cli mikrotik hantle. A re nahaneng ka boemo boo u hlokang ho tlosa lenane la liaterese ka lintlha tse itseng ho li-routers tsohle, joale:
Fumana mme o tlose/ ip firewal address-list tlosa [fumana moo list = "gov.ru"]
Ka boomo ha kea kenyelletsa lethathamo lohle la li-firewall mona hobane... e tla ba motho ka mong bakeng sa morero ka mong. Empa ntho e le 'ngoe eo nka e buang ka bonnete, sebelisa lethathamo la liaterese feela.
Ho ea ka GITLAB ntho e 'ngoe le e' ngoe e hlakile. Ha ke na ho lula ntlheng ena. Ntho e 'ngoe le e' ngoe e ntle bakeng sa mesebetsi ea motho ka mong, litempele, li-handers.
PowerShell
Ho tla ba le lifaele tse 3 mona. Ke hobane'ng ha powershell? U ka khetha sesebelisoa leha e le sefe sa ho hlahisa li-configs, eng kapa eng e u loketseng haholoanyane. Tabeng ena, motho e mong le e mong o na le Windows ho PC ea bona, joale ke hobane'ng ha u e etsa ka bash ha powershell e le bonolo haholoanyane. Ke efe e loketseng haholoanyane?
Script ka boeona (e bonolo ebile e utloahala):[cmdletBinding()] Param(
[Paramethara(E tlamang=$nete)] [thapo]$EXTERNALIPADDDRESS,
[Paramethara(E tlamehang=$nete)] [thapo]$EXTERNALIPROUTE,
[Paramethara(E tlamehang=$nete)] [thapo]$BWorknets,
[Paramethara(E tlamehang=$nete)] [khoele]$CWorknets,
[Paramethara(E tlamang=$nete)] [khoele]$BVoipNets,
[Paramethara(E tlamehang=$nete)] [khoele]$CVoipNets,
[Paramethara(E tlamehang=$nete)] [khoele]$CClients,
[Paramethara(E tlamehang=$nete)] [thapo]$BVPNWORKs,
[Paramethara(E tlamehang=$nete)] [khoele]$CPWORKs,
[Paramethara(E tlamehang=$nnete)] [thapo]$BVPNCLIENTSs,
[Paramethara(E tlamehang=$nnete)] [thapo]$cVPNCLIENTSs,
[Paramethara(E tlamang=$nete)] [kgwele]$NAMEROUTER,
[Paramethara(E tlamehang=$nete)] [khoele]$ServerCertificates,
[Paramethara(E tlamehang=$nete)] [khoele]$infile,
[Paramethara(E tlamehang=$nete)] [khoele]$outfile
)
Fumana-Likahare $infile | Ntho-pele {$_.Emela sebakeng("EXTERNIP", $EXTERNALIPADDRESS)} |
Ntho-pele {$_.Fetola("EXTROUTE", $EXTERNALIPROUTE)} |
Foreach-Object {$_.Replace("BWorknet", $BWorknets)} |
Foreach-Object {$_.Replace("CWorknet", $CWorknets)} |
Foreach-Object {$_.Replace("BVoipNet", $BVoipNets)} |
Foreach-Object {$_.Replace("CVoipNet", $CVoipNets)} |
Foreach-Object {$_.Replace("CClients", $CClients)} |
Foreach-Object {$_.Replace("BVPNWORK", $BVPNWORKs)} |
Foreach-Object {$_.Replace("CPWORK", $CPWORKs)} |
Foreach-Object {$_.Replace("BVPNCLIENTS", $BVPNCLIENTSs)} |
Foreach-Object {$_.Replace("CVPNCLIENTS", $cVPNCLIENTSs)} |
Ntho e ka pele {$_.Fetola("MYNAMERROUTER", $NAMEROUTER)} |
Foreach-Object {$_.Replace("ServerCertificate", $ServerCertificates)} | Set-Content $outfile
Ke kopa o ntšoarele, ha ke khone ho beha melao eohle hobane ... e ka se be ntle haholo. U ka iketsetsa melao ka bouena, u tataisoa ke mekhoa e metle.
Mohlala, mona ke lethathamo la lihokelo tseo ke li latileng::Sireletsa_Router_ya_Ya hao
: IP/Firewall/Filter
:OSPF-mehlala
:Winbox
:Upgrading_RouterOS
:IP/Fasttrack - mona o hloka ho tseba hore ha fasttrack e nolofalitsoe, melao ea pele ea sephethephethe le melao ea sebopeho e ke ke ea sebetsa - e na le thuso bakeng sa lisebelisoa tse fokolang.
Matšoao a mefuta-futa:Li-network tse latelang li nkuoa e le mohlala:
192.168.0.0/24 marangrang a sebetsang
172.22.4.0/24 marang-rang a VOIP
10.0.0.0/24 marang-rang bakeng sa bareki ntle le ho fihlella marang-rang a lehae
192.168.255.0/24 VPN marang-rang bakeng sa makala a maholo
172.19.255.0/24 VPN marang-rang bakeng sa tse nyane
Aterese ea marang-rang e na le linomoro tse 4 tsa decimal, ka ho latellana ABCD, phetoho e sebetsa ka molao-motheo o tšoanang, haeba qalong e botsa B, ho bolela hore o hloka ho kenya nomoro ea 192.168.0.0 bakeng sa marang-rang 24/0, le bakeng sa C. = 0.
$EXTERNALIPADDDRESS - aterese e khethehileng ho tsoa ho mofani oa litšebeletso.
$EXTERNALIPROUTE - tsela ea kamehla ea marang-rang 0.0.0.0/0
$BWorknets - Marang-rang a sebetsang, mohlaleng oa rona ho tla ba le 168
$CWorknets - Marang-rang a sebetsang, mohlaleng oa rona sena e tla ba 0
$BVoipNets - Marang-rang a VOIP mohlaleng oa rona mona 22
$CVoipNets - Marang-rang a VOIP mohlaleng oa rona mona 4
$CClients - Marang-rang bakeng sa bareki - phihlello ea Marang-rang feela, molemong oa rona mona 0
$BVPNWORKs - Marang-rang a VPN bakeng sa makala a maholo, mohlaleng oa rona oa 20
$CPWORKs - Marang-rang a VPN bakeng sa makala a maholo, mohlala oa rona 255
$BVPNCLIENTS - Marang-rang a VPN bakeng sa makala a manyane, e bolelang 19
$ CVPNCLIENTS - Marang-rang a VPN bakeng sa makala a manyane, e bolelang 255
$NAMEROUTER - lebitso la router
$ServerCertificate - lebitso la setifikeiti seo o neng o se rekile kantle ho naha
$ infile - Hlalosa tsela ea faele eo re tla bala config, mohlala D: config.txt (ka ho khetheha tsela ea Senyesemane ntle le litemana le libaka)
$outfile — hlakisa tsela eo e ka e bolokang teng, mohlala D:MT-test.txt
Ke fetotse ka boomo liaterese mehlaleng ka mabaka a hlakileng.
Ke ile ka hloloheloa ntlha ea ho lemoha litlhaselo le boitšoaro bo sa tloaelehang - sena se lokeloa ke sengoloa se arohaneng. Empa ho bohlokoa ho supa hore sehlopheng sena u ka sebelisa litekanyetso tsa tlhaiso-leseling ho tsoa ho Zabbix + data e sebetsitsoeng ea curl ho tsoa ho elasticsearch.
Ke lintlha life tseo u lokelang ho li ela hloko:
- Moralo oa marang-rang. Ho molemo ho e qapa hang-hang ka mokhoa o balang. Excel e tla lekana. Ka bomalimabe, hangata ke bona hore marang-rang a hahiloe ho latela molao-motheo "Lekala le lecha le hlahile, mona ke / 24 bakeng sa hau." Ha ho motho ea nahanang hore na ho lebeletsoe lisebelisoa tse kae sebakeng se itseng kapa hore na ho tla ba le khōlo e eketsehileng. Ka mohlala, lebenkele le lenyenyane le ile la buloa moo qalong ho neng ho hlakile hore sesebelisoa se ke ke sa feta 10, ke hobane'ng ha ho fana ka /24? Bakeng sa makala a maholo, ho fapana le hoo, ba abela / 24, mme ho na le lisebelisoa tse 500 - o ka eketsa marang-rang, empa o batla ho nahana ka ntho e 'ngoe le e' ngoe hang-hang.
- Melao ea ho sefa. Haeba morero o nka hore ho tla ba le karohano ea marang-rang le karohano e kholo. Mekhoa e metle e fetoha ha nako e ntse e ea. Pejana, marang-rang a PC le marang-rang a khatiso a ne a arotsoe, empa joale ho tloaelehile hore u se ke ua arola marang-rang ana. Ho bohlokoa ho sebelisa kelello le ho se thehe li-subnet tse ngata moo li sa hlokeheng le ho se kopanye lisebelisoa tsohle ho netweke e le 'ngoe.
- Litlhophiso tsa "Khauta" ho li-routers tsohle. Tseo. haeba u entse qeto ka morero. Ke habohlokoa ho bona ntho e 'ngoe le e' ngoe hang-hang 'me u leke ho etsa bonnete ba hore litlhophiso tsohle lia tšoana - ke lethathamo la liaterese feela le liaterese tsa IP tse fapaneng. Haeba mathata a hlaha, nako ea ho lokisa liphoso e tla fokotseha.
- Litaba tsa mokhatlo ha li bohlokoa ho feta tsa tekheniki. Hangata basebetsi ba botsoa ba etsa likhothaletso tsena "ka letsoho", ntle le ho sebelisa litlhophiso le lingoloa tse lokiselitsoeng, tse qetellang li baka mathata ntle le moo.
Ka ho tsamaisa ka matla. Ho ile ha sebelisoa OSPF e nang le karohano ea libaka. Empa ena ke benche ea liteko; ho monate le ho feta ho theha lintho tse joalo maemong a ntoa.
Ke tšepa hore ha ho motho ea khopisitsoeng ke hore ha kea beha litlhophiso tsa router. Ke nahana hore li-link li tla lekana, ebe ntho e 'ngoe le e' ngoe e itšetlehile ka litlhoko. 'Me ehlile liteko, ho hlokahala liteko tse ngata.
Ke lakatsa hore bohle ba hlokomele merero ea bona selemong se secha. E se eka phihlello e fanoeng e ka ba le uena !!!
Source: www.habr.com