Eli nqaku lelesine kungcelele oluthi “Uluthatha Njani Ulawulo Lweziseko Zokusebenza Zothungelwano Lwakho.” Imixholo yawo onke amanqaku kuthotho kunye namakhonkco anokufunyanwa apha.

В Inxalenye yokuqala Kwesi sahluko, sijonge ezinye iinkalo zokhuseleko lwenethiwekhi kwicandelo leZiko leDatha. Le nxalenye iya kunikezelwa kwicandelo "loFikelelo kwi-Intanethi".

Ukufikelela kwi-Intanethi

Isihloko sokhuseleko ngokungathandabuzekiyo sesinye sezona zihloko zintsonkothileyo kwihlabathi lothungelwano lwedatha. Njengakwiimeko zangaphambili, ngaphandle kokubanga ubunzulu kunye nokugqibelela, ndiza kuqwalasela apha ngokulula, kodwa, ngokombono wam, imibuzo ebalulekileyo, iimpendulo apho, ndiyathemba, ziya kunceda ukuphakamisa umgangatho wokhuseleko lwenethiwekhi yakho.

Xa uphicotha eli candelo, qwalasela le miba ilandelayo:

uyilo
izicwangciso zeBGP
Ukhuseleko lweDOS/DDOS
ukuhluzwa kwetrafikhi kwifirewall

Uyilo

Njengomzekelo woyilo lweli candelo lothungelwano lweshishini, ndingacebisa ulawulo ukusuka eCisco ngaphakathi Iimodeli ezikhuselekileyo.

Ewe kunjalo, mhlawumbi isisombululo sabanye abathengisi siya kubonakala sinomtsalane kuwe (bona. Gartner Quadrant 2018), kodwa ngaphandle kokukhuthaza ukuba ulandele olu yilo ngokweenkcukacha, ndisakufumanisa kuluncedo ukuqonda imigaqo kunye neengcamango emva kwayo.

Qaphela
Kwi-SAFE, icandelo "lokuFikelela kude" yinxalenye yecandelo "loFikelelo lwe-Intanethi". Kodwa kolu ngcelele lwamanqaku siza kuyiqwalasela ngokwahlukileyo.

Isethi eqhelekileyo yezixhobo kweli candelo kuthungelwano lweshishini

iirotha zomda
firewalls

Qaphela 1
Kolu ngcelele lwamanqaku, xa ndithetha ngama-firewall, ndiyathetha NGFW.

Qaphela 2
Ndishiya uqwalaselo lweentlobo ezahlukeneyo ze-L2/L1 okanye ndiyaleka i-L2 ngaphezulu kwe-L3 izisombululo eziyimfuneko ukuze ndiqinisekise uqhagamshelo lwe-L1/L2 kwaye ndinqande kuphela kwimiba ekwinqanaba le-L3 nangaphezulu. Ngokuyinxenye, imiba ye-L1/L2 yaxoxwa kwisahluko “Ukucoca kunye nokuBhalwa«.

Ukuba awufumananga i-firewall kweli candelo, ngoko akufanele ukhawuleze ukuya kwizigqibo.

Masenze okufanayo nangaphakathi inxalenye yangaphambiliMasiqale ngombuzo: ngaba kuyimfuneko ukusebenzisa i-firewall kweli candelo kwimeko yakho?

Ndingatsho ukuba le yeyona ndawo ifanelekileyo yokusebenzisa iindonga zomlilo kunye nokufaka ii-algorithms zokucoca izithuthi ezintsonkothileyo. IN icandelo 1 Sikhankanye izinto ezi-4 ezinokuthi ziphazamise ukusetyenziswa kwee-firewall kwicandelo ledatha yedatha. Kodwa apha azisabalulekanga kangako.

Umzekelo 1. Ukucothisa
Ngokubhekiselele kwi-Intanethi, akukho sizathu sokuthetha malunga nokulibaziseka nokuba malunga ne-1 millisecond. Ke ngoko, ukulibaziseka kweli candelo akunakuba ngumba othintela ukusetyenziswa kwefirewall.

Umzekelo 2. Imveliso
Kwezinye iimeko lo mba usenokuba usabalulekile. Ngoko ke, kungafuneka uvumele itrafikhi ethile (umzekelo, i-traffic esuka kwizilinganisi zomthwalo) ukuba idlule i-firewall.

Umzekelo 3. Ukuthembeka
Lo mbandela usafuna ukuqwalaselwa, kodwa kunjalo, ngenxa yokungathembeki kwe-Intanethi ngokwayo, ukubaluleka kwayo kweli candelo akubalulekanga njengeziko ledatha.
Ke, masicinge ukuba inkonzo yakho ihlala phezulu kwe-http/https (kunye neeseshini ezimfutshane). Kule meko, ungasebenzisa iibhokisi ezimbini ezizimeleyo (ngaphandle kwe-HA) kwaye ukuba kukho ingxaki yomzila kunye nomnye wabo, dlulisela yonke i-traffic kwisibini.
Okanye ungasebenzisa i-firewall kwimowudi ecacileyo kwaye, ukuba ayiphumelelanga, vumela i-traffic ukuba igqithe kwi-firewall ngelixa usombulula ingxaki.

Ngoko ke, kunokwenzeka nje ixabiso inokuba yinto eya kukunyanzela ukuba uyeke ukusetyenziswa kweefirewall kweli candelo.

Kubalulekile!
Kukho isilingo sokudibanisa le firewall kunye ne-firewall yeziko ledatha (sebenzisa i-firewall enye kula macandelo). Isisombululo, ngokomgaqo, kunokwenzeka, kodwa kufuneka uqonde ukuba ngenxa yokuba I-firewall ye-Intanethi ngokwenene iphambili ekukhuseleni kwakho kwaye "ithatha" ubuncinci i-traffic enobungozi, ngoko ke, kufuneka uthathele ingqalelo umngcipheko okhulayo wokuba le firewall iya kukhutshazwa. Oko kukuthi, ngokusebenzisa izixhobo ezifanayo kula macandelo mabini, uya kunciphisa kakhulu ukufumaneka kwecandelo ledatha yakho.

Njengamaxesha onke, kufuneka uqonde ukuba kuxhomekeke kwinkonzo enikezelwa yinkampani, uyilo lweli candelo lunokwahluka kakhulu. Njengesiqhelo, unokukhetha iindlela ezahlukeneyo ngokuxhomekeke kwiimfuno zakho.

Umzekelo:
Ukuba ungumnikezeli womxholo, kunye nenethiwekhi ye-CDN (bona, umzekelo, uthotho lwamanqaku), emva koko awufuni ukwenza isiseko kuninzi okanye amakhulu amanqaku obukho usebenzisa izixhobo ezahlukeneyo zokujonga kunye nokucoca itrafikhi. Kuya kudura, kwaye kusenokungabi yimfuneko.
Kwi-BGP akuyomfuneko ukuba ube neerotha ezizinikeleyo, ungasebenzisa izixhobo ezivulelekileyo ezifana Iquagga. Ngoko mhlawumbi konke okudingayo ngumncedisi okanye abancedisi abaninzi, iswitshi kunye ne BGP.
Kule meko, iseva yakho okanye iiseva ezininzi zinokudlala indima ye-CDN kuphela, kodwa kunye ne-router. Ewe, kusekho iinkcukacha ezininzi (ezifana nendlela yokuqinisekisa ukulinganisa), kodwa iyenzeka, kwaye yindlela esiye sayisebenzisa ngempumelelo kwelinye lamaqabane ethu.
Unokuba namaziko eenkcukacha amaninzi anokhuseleko olupheleleyo (i-firewall, iinkonzo zokhuseleko zeDDOS ezibonelelwa ngababoneleli bakho be-Intanethi) kunye neninzi okanye amakhulu amanqaku obukho "enziwe lula" kunye nokutshintsha kwe-L2 kunye neeseva kuphela.
Kodwa kuthekani ngokhuseleko kule meko?
Makhe sijonge, umzekelo, ethandwa kutshanje Uhlaselo lwe-DNS Ukwandiswa kweDDOS. Ingozi yayo ilele kwinto yokuba inani elikhulu lezithuthi ziveliswa, elivele "livale" i-100% yazo zonke ii-uplinks zakho.
Yintoni esinayo kwimeko yoyilo lwethu.

ukuba usebenzisa i-AnyCast, ke itrafikhi isasazwa phakathi kwamanqaku akho obukho. Ukuba i-bandwidth yakho iyonke yi-terabits, ke oku ngokwayo ngenene (nangona kunjalo, kutsha nje kuye kwakho uhlaselo oluninzi nge-traffic enonya ngokomyalelo we-terabits) kukukhusela kwi-uplinks "ephuphumayo".

Ukuba, nangona kunjalo, ezinye iindawo eziphakamileyo ziyavaleka, ngoko ususa ngokulula esi siza kwinkonzo (yeka ukuthengisa isimaphambili)

ungasonyusa isabelo setrafikhi esithunyelwe kumaziko akho edatha "egcweleyo" (kwaye, ngokufanelekileyo, ekhuselweyo), ngaloo ndlela ususa inxalenye ebalulekileyo yendlela ekhohlakeleyo kwiindawo ezingakhuselekanga zobukho.
Kwaye elinye inqaku elincinci kulo mzekelo. Ukuba uthumela itrafikhi eyaneleyo ngee-IXs, ke oku kunciphisa ukuba sesichengeni sakho kuhlaselo olunjalo

Ukumisela i-BGP

Kukho izihloko ezibini apha.

Uqhagamshelwano
Ukumisela i-BGP

Sele sithethile kancinci malunga noqhagamshelo kwi icandelo 1. Inqaku kukuqinisekisa ukuba i-traffic kubathengi bakho ilandela indlela efanelekileyo. Nangona ukulunga akusoloko kumalunga ne-latency, i-latency ephantsi idla ngokuba sesona salathisi sokulunga. Kwezinye iinkampani oku kubaluleke kakhulu, kwezinye kuncinci. Konke kuxhomekeke kwinkonzo oyinikezelayo.

Umzekelo 1
Ukuba utshintshiselwano, kwaye amaxesha angaphantsi kwee-millisecond abalulekile kubaxhasi bakho, ngoko ke, ngokuqinisekileyo, akunakuthetha naluphi na uhlobo lwe-Intanethi.

Umzekelo 2
Ukuba uyinkampani yokudlala kwaye amashumi e-millisecond abalulekile kuwe, ke, ngokuqinisekileyo, unxibelelwano lubaluleke kakhulu kuwe.

Umzekelo 3
Kwakhona kufuneka uqonde ukuba, ngenxa yeepropati zeprotocol ye-TCP, izinga lokudluliselwa kwedatha ngaphakathi kweseshoni enye ye-TCP ixhomekeke kwi-RTT (iXesha lokuTyelwa okuNgqongileyo). Iinethiwekhi ze-CDN nazo zakhiwe ukusombulula le ngxaki ngokuhambisa iiseva zokuhambisa umxholo kufutshane nomthengi walo mxholo.

Isifundo soqhagamshelo sisihloko esinomdla ngokwaso, esifanele inqaku laso okanye uthotho lwamanqaku, kwaye sifuna ukuqonda kakuhle indlela “esebenza ngayo” i-Intanethi.

Izixhobo eziluncedo:

ripe.net
bgp.he.net

Umzekelo:
Ndiza kunika nje umzekelo omncinci.
Makhe sicinge ukuba isikhungo sakho sedatha siseMoscow, kwaye une-uplink eyodwa - Rostelecom (AS12389). Kule meko (ikhaya elinye) awufuni i-BGP, kwaye kunokwenzeka ukuba usebenzise idili yedilesi evela kwi-Rostelecom njengeedilesi zoluntu.
Makhe sicinge ukuba unikezela ngenkonzo ethile, kwaye unenani elaneleyo labathengi abavela e-Ukraine, kwaye bakhalaza malunga nokulibaziseka okude. Ngexesha lophando lwakho, ufumanise ukuba iidilesi ze-IP zabanye babo zikwigridi ye-37.52.0.0/21.
Ngokuqhuba i-traceroute, wabona ukuba i-traffic yayihamba nge-AS1299 (Telia), kwaye ngokuqhuba i-ping, ufumene i-RTT ephakathi kwe-70 - 80 millisecond. Ungayibona kwakhona oku ukujonga iglasi Rostelecom.
Ukusebenzisa i-whois utility (kwi ripe.net okanye into eluncedo lendawo), ungakwazi ngokulula ukumisela ukuba ibhloko 37.52.0.0/21 yeye AS6849 (Ukrtelecom).
Okulandelayo, ngokuya ku bgp.he.net Uyabona ukuba i-AS6849 ayinabudlelwane kunye ne-AS12389 (ayingabo abathengi okanye ayingomdibaniso omnye komnye, kwaye ayinayo intanga). Kodwa ukuba ujonge uluhlu lwabalingane kuba AS6849, uya kubona, umzekelo, AS29226 (Mastertel) kunye AS31133 (Megafon).
Emva kokuba ufumene iglasi ekhangelekileyo yaba baboneleli, unokuthelekisa indlela kunye ne-RTT. Umzekelo, kwi-Mastertel RTT iya kuba malunga ne-30 millisecond.
Ngoko ke, ukuba umahluko phakathi kwe-80 kunye ne-30 ye-millisecond ubalulekile kwinkonzo yakho, ngoko mhlawumbi kufuneka ucinge malunga noqhagamshelo, fumana inombolo yakho ye-AS, idili yakho yedilesi esuka kwi-RIPE kwaye uqhagamshele ii-uplinks ezongezelelweyo kunye / okanye udale amanqaku obukho kwi-IXs.

Xa usebenzisa i-BGP, awunalo ithuba lokuphucula uqhagamshelo kuphela, kodwa ugcina uqhagamshelo lwakho lwe-Intanethi ngokugqithisileyo.

Olu xwebhu iqulethe iingcebiso zokuqwalasela iBGP. Ngaphandle kwento yokuba ezi ngcebiso zaphuhliswa ngokusekwe “kwindlela yokusebenza egqwesileyo” yababoneleli, nangona kunjalo (ukuba useto lwakho lwe-BGP alunasiseko kwaphela) luluncedo ngokungathandabuzekiyo kwaye lufanele ukuba yinxalenye yobulukhuni esixoxe ngayo. Inxalenye yokuqala.

Ukhuseleko lweDOS/DDOS

Ngoku ukuhlaselwa kwe-DOS/DDOS kuye kwaba yinyani yemihla ngemihla kwiinkampani ezininzi. Enyanisweni, uhlaselwa rhoqo ngendlela enye okanye enye. Inyaniso yokuba awukayiqapheli le nto ithetha kuphela ukuba uhlaselo olujoliswe kuyo aluzange lulungelelaniswe ngokuchasene nawe, kwaye amanyathelo okukhusela owasebenzisayo, mhlawumbi ngaphandle kokwazi (iendlela ezahlukeneyo zokukhuselwa kweenkqubo zokusebenza), ngokwaneleyo ukuba qinisekisa ukuba ukuthotywa kwenkonzo enikiweyo kuyacuthwa kuwe nakubathengi bakho.

Kukho izixhobo ze-Intanethi ezithi, ngokusekwe kwizigodo zezixhobo, zizoba iimephu zohlaselo ezintle ngexesha lokwenyani.

kuyinto ungafumana amakhonkco kubo.

Okuhle kwam khadi ukusuka kwi-CheckPoint.

Ukukhuselwa kwi-DDOS/DOS kudla ngokufakwa umaleko. Ukuqonda ukuba kutheni, kufuneka uqonde ukuba zeziphi iintlobo zohlaselo lwe-DOS/DDOS ezikhoyo (bona, umzekelo, apha okanye apha)

Oko kukuthi, sineentlobo ezintathu zohlaselo:

ukuhlaselwa kwevolumetric
uhlaselo lweprotocol
uhlaselo lwesicelo

Ukuba unokuzikhusela kwiintlobo ezimbini zokugqibela zohlaselo usebenzisa, umzekelo, i-firewall, ngoko awukwazi ukuzikhusela ekuhlaselweni okujoliswe "kwi-uplinks" yakho (ngokuqinisekileyo, ukuba amandla akho onke eziteshi ze-Intanethi azibalwa kwii-terabits, okanye ngcono noko, kumashumi terabit).

Ngoko ke, umgca wokuqala wokukhusela ukhusela ekuhlaselweni kwe "volumetric", kwaye umboneleli wakho okanye ababoneleli bakho kufuneka banikeze olu khuseleko kuwe. Ukuba awukayiqondi le nto okwangoku, usenethamsanqa okwangoku.

Umzekelo:
Masithi unee-uplinks ezininzi, kodwa mnye kuphela wababoneleli onokukubonelela ngolu khuseleko. Kodwa ukuba zonke iitrafikhi zidlula kumnikezeli omnye, kuthekani ngoqhagamshelo esiluxubushe ngokufutshane ngaphambili?
Kule meko, kuya kufuneka uncame ngokuyinxenye unxibelelwano ngexesha lohlaselo. Kodwa

oku kuphela ngexesha lohlaselo. Kwimeko yokuhlaselwa, unokwenza ngesandla okanye ngokuzenzekelayo uphinde ulungelelanise i-BGP ukwenzela ukuba i-traffic ihambe kuphela kumnikezeli obonelela "ngesambrela". Emva kokuba uhlaselo luphelile, ungabuyisela indlela kwisimo sayo sangaphambili

Akuyimfuneko ukudlulisa yonke i-traffic. Ukuba, umzekelo, ubona ukuba akukho zihlaselo ngokusebenzisa ezinye uplinks okanye peerings (okanye itrafikhi ayibalulekanga), ungaqhubeka upapashe izimaphambili kunye neempawu zokhuphiswano ngabamelwane BGP.

Unokuphinda unikezele ukhuseleko "kuhlaselo lweprotocol" kunye "nohlaselo lwesicelo" kumaqabane akho.
Apha apha unokufunda isifundo esihle (uguqulelo). Enyanisweni, eli nqaku lineminyaka emibini ubudala, kodwa liya kukunika umbono weendlela onokuzikhusela ngayo kuhlaselo lweDDOS.

Ngokomgaqo, unokuzikhawulela koku, ukhuphe ngokupheleleyo ukhuseleko lwakho. Kukho iingenelo kwesi sigqibo, kodwa kukho ukungonakali okucacileyo. Inyani kukuba singathetha (kwakhona, kuxhomekeke kwinto eyenziwa yinkampani yakho) malunga nokusinda kweshishini. Kwaye uthembe izinto ezinjalo kubantu besithathu...

Ngoko ke, makhe sijonge indlela yokulungelelanisa imigca yesibini neyesithathu yokukhusela (njengokongezwa kukhuseleko kumnikezeli).

Ke, umgca wesibini wokhuselo kukucoca kunye nemida yendlela (amapolisa) ekungeneni kwinethiwekhi yakho.

Umzekelo 1
Makhe sicinge ukuba uzigqume ngesambrela ngokuchasene neDDOS ngoncedo lomnye wababoneleli. Makhe sicinge ukuba lo mboneleli usebenzisa iArbor ukucoca itrafikhi kunye nezihluzo kumda womnatha wayo.
I-bandwidth enokuthi i-Arbor "iqhube" ilinganiselwe, kwaye umboneleli, ngokuqinisekileyo, akakwazi ukudlula rhoqo i-traffic yabo bonke amaqabane abo abayalela le nkonzo ngezixhobo zokucoca. Ngoko ke, phantsi kweemeko eziqhelekileyo, i-traffic ayihluzwanga.
Makhe sicinge ukuba kukho uhlaselo lwesikhukula seSYN. Nokuba uyalele inkonzo etshintsha ngokuzenzekelayo itrafikhi ekuhluzweni xa kuhlaselwe, oku akwenzeki ngoko nangoko. Umzuzu okanye ngaphezulu uhlala uhlaselwa. Kwaye oku kunokukhokelela ekungaphumeleli kwezixhobo zakho okanye ukuthotywa kwenkonzo. Kule meko, ukunciphisa i-traffic kwi-edge routing, nangona kuya kukhokelela ekubeni ezinye iiseshoni ze-TCP aziyi kusekwa ngeli xesha, ziya kusindisa iziseko zakho kwiingxaki ezinkulu.

Umzekelo 2
Inani elikhulu ngokungaqhelekanga lepakethe zeSYN ayinakuba sisiphumo sohlaselo lwezikhukhula lweSYN kuphela. Makhe sicinge ukuba unikezela ngenkonzo apho unokuthi ngaxeshanye ube malunga ne-100 lamawaka onxibelelwano lwe-TCP (kwiziko ledatha enye).
Masithi ngenxa yengxaki yexesha elifutshane nomnye wababoneleli bakho abaphambili, isiqingatha seeseshini zakho ziyakhatywa. Ukuba isicelo sakho siyilwe ngendlela yokuba, ngaphandle kokucinga kabini, ngoko nangoko (okanye emva kwekhefu lexesha elifanayo kuzo zonke iiseshini) izame ukuphinda imise uxhulumaniso, ngoko ke uya kufumana ubuncinane 50 amawaka eepakethe zeSYN malunga . ngaxeshanye.
Ukuba, umzekelo, kufuneka uqhube i-ssl / tls handshake phezu kwezi seshoni, ezibandakanya ukutshintshiselana ngezatifikethi, ngoko ke ukusuka kwindawo yokujonga izibonelelo zokunciphisa i-balancer yakho yomthwalo, oku kuya kuba namandla kakhulu "DDOS" kunokuba lula. Isikhukula seSYN. Kubonakala ngathi abalinganisi kufuneka baphathe iziganeko ezinjalo, kodwa ... ngelishwa, sijongene nengxaki enjalo.
Kwaye, ewe, ipolisa elikumda womzila liya kusindisa izixhobo zakho kule meko.

Inqanaba lesithathu lokhuseleko kwiDDOS/DOS luseto lwakho lwefirewall.

Apha unokuyeka zombini ukuhlaselwa kweentlobo zesibini kunye nesithathu. Ngokubanzi, yonke into efikelela kwi-firewall ingahluzwa apha.

Icebiso
Zama ukunika i-firewall njengomsebenzi omncinci ngokusemandleni, ukucoca kangangoko kunokwenzeka kwimigca emibini yokuqala yokukhusela. Yiyo loo nto.
Ngaba kuye kwenzeka kuwe ukuba ngethuba, ngelixa uvelisa i-traffic ukujonga, umzekelo, indlela yokumelana nenkqubo yokusebenza yeeseva zakho ekuhlaselweni kweDDOS, "ubulele" i-firewall yakho, uyilayisha kwi-100 ekhulwini, kunye ne-traffic kumandla aqhelekileyo. ? Ukuba akunjalo, mhlawumbi kungenxa yokuba khange uzame?
Ngokubanzi, i-firewall, njengoko benditshilo, yinto entsonkothileyo, kwaye isebenza kakuhle kunye nobuthathaka obaziwayo kunye nezisombululo ezivavanyiweyo, kodwa ukuba uthumela into engaqhelekanga, inkunkuma okanye iipakethi ezineentloko ezingachanekanga, ngoko ukunye nabanye, hayi kunye. Ithuba elincinci elinjalo (ngokusekwe kumava am), ungakhupha izixhobo eziphezulu. Ngoko ke, kwinqanaba lesi-2, usebenzisa ii-ACL eziqhelekileyo (kwinqanaba le-L3 / L4), vumela kuphela i-traffic kwinethiwekhi yakho ekufuneka ingene apho.