- Ukuhlukanisa inethiwekhi ibe ama-VLAN ahlelwe kahle futhi ahlukanisiwe kunciphisa kakhulu umthelela wezigameko zokuphepha.
- Izici zesigaba sesi-2 njenge-DHCP Snooping, i-Dynamic ARP Inspection, kanye ne-Port Security ziyisihluthulelo ekuhlaselweni kwangaphakathi.
- Ama-ACL, ukuhlunga kwe-DNS, kanye nokuhlolwa kwesendlalelo 3 no-4 kuqinisa ukulawulwa kwethrafikhi phakathi kwama-VLAN kanye ne-inthanethi.
- Ukuhlanganiswa kokuphathwa okuphephile, ukuhlolwa kwamabhuku, kanye nokuqeqeshwa kwabasebenzi kugcina ukuphepha kwama-VLAN isikhathi eside.
Kunoma iyiphi inethiwekhi yezinkampani engathi sína, ama-VLAN awaseyona into yokunethezeka, kodwa ayisidingo. Ukuhlukanisa ithrafikhi ngomnyango , isevisi, kanye nezinga lokubucayi kubalulekile ekuvimbeleni isigameko esisodwa ukuthi singakhuli sibe yinkinga yomhlaba wonke ekhubaza ingxenye yenhlangano. Kodwa ukudala ama-VLAN akwanele: uma engaklanywanga futhi engavikelekile kahle, avula umnyango wokuhlaselwa okuyingozi kakhulu.
Ngakho-ke, uma sikhuluma ngokulungiselelwa kwe-VLAN okuthuthukisiwe kanye nokuphepha, asikhulumi nje ngokwabela ama-ID nama-port. Sikhuluma ngokuhlela , ukuhlukaniswa okunengqondo, izilawuli zokufinyelela, ukuqapha okuqhubekayo , kanye nokusetshenziswa kwezici ezithile zokushintsha njenge-DHCP Snooping, i-Dynamic ARP Inspection, kanye ne-Port Security, ngaphezu kwezinqubomgomo ze-Layer 3 kanye ne-Layer 4. Sizobheka konke ngokuthula, kodwa ngendlela esebenzayo nenengqondo "yangempela".
Ukuhlela i-VLAN kanye nokuhlela inethiwekhi
Ngaphambi kokuthinta umyalo owodwa kuswishi, kubalulekile ukuhlala phansi ucabange ngendlela inethiwekhi ezohlelwa ngayo. Ukuhlela okuhle kwe-VLAN kuqala ngokuhlonza ngokucacile izindawo, iminyango, noma izingxenye zenkampani ezidinga ukuhlukaniswa okunengqondo: izinsizakusebenza zabantu, ezezimali, intuthuko, ama-VLAN ezivakashi , amadivayisi e-IoT, njll.
Umqondo uwukuthi isigameko engxenyeni eyodwa yenethiwekhi akufanele sithinte ngqo okunye. Uma umshini ku-VLAN yesivakashi usengozini, akufanele ukwazi ukufinyelela kalula ku -VLAN yokubala noma amaseva abalulekile . Lokhu kudinga ukudala ama-VLAN ahlukene nokuchaza kusukela ekuqaleni ukuthi iyiphi ithrafikhi engahamba phakathi kwawo nokuthi yimiphi imikhawulo.
Ngaphezu kokuhlukaniswa kweminyango, ngokuvamile kuyalulekwa ukubhukha i -VLAN ethile yokuphatha yokuphatha amaswishi, ama-router, namanye amadivayisi enethiwekhi. Nakuba le VLAN yokuphatha ingakadalwa ezintweni zokubhekisela, kuyisinyathelo esifanele ukuhlela ukuvimbela ukucushwa ukuthi kungaphathwa kusuka kunethiwekhi efanayo yomsebenzisi, okubeka ingozi ecacile.
Esinye isici esibalulekile sokuhlela ukuqinisekisa ukuthi i-VLAN ngayinye ihlukaniswe kahle futhi ivikelwe ngezindlela ezengeziwe: uhlu lokulawula ukufinyelela (ama-ACL), ama-firewall angaphakathi , ukulawulwa kokufinyelela okusekelwe ezindimeni, kanye nezinqubomgomo zokuphepha eziqhubekayo. Akukhona nje ukuhlukaniswa, kodwa mayelana nokulawula ngokunembile ukuthi hlobo luni lwethrafikhi oluvunyelwe phakathi kwezingxenye.
Okokugcina, ukuhleleka okuhle kuhilela ukubhala phansi ukuthi yimaphi ama-VLAN abelwe ukuthi yimaphi amachweba, yimaphi amadivayisi axhunywe ku-VLAN ngayinye, nokuthi yimiphi imithetho yokuxhumana esebenza phakathi kwawo. Lo mbhalo ubaluleke kakhulu lapho kuphenywa ngesigameko noma kwandiswe ingqalasizinda.
Ukuqapha okuqhubekayo kanye nokuqapha ithrafikhi
Uma ama-VLAN esechaziwe futhi ahlelwe, umsebenzi awupheli. Ukuqapha okuqhubekayo komsebenzi ngaphakathi kwesigaba ngasinye kubalulekile. Uma ukuziphatha kwenethiwekhi kungaqashwa, ukuhlaselwa kungabonakala isikhathi eside kakhulu.
Ukuze kufezwe lokhu, kunconywa ukusebenzisa amathuluzi okuhlaziya ithrafikhi ngesikhathi sangempela angathola ukungalingani, amaphethini asolisayo, kanye nokwanda okungavamile kuma-VLAN athile. Lokhu kufaka phakathi izixazululo zokuqapha inethiwekhi, izinhlelo zokuthola ukungena (i-IDS/IPS), kanye namapulatifomu okuhlaziya amalogi.
Ngaphezu kwalokho, uhlelo lokuphendula ezigamekweni oluchazwe kahle lubalulekile : okufanele ukwenze uma kutholakala ithrafikhi engavamile ku-VLAN, indlela yokuhlukanisa imbobo, indlela yokuvimba ububanzi be-IP, noma indlela yokuhoxisa ukufinyelela ngokushesha. Ukuthola ukuhlaselwa akusizi ngalutho uma inhlangano ingazi ukuthi kufanele isabele kanjani ngokushesha.
Kubaluleke ngokulinganayo ukuqapha izinguquko zokucushwa kumaswishi nama-router. Ukusebenzisa amathuluzi okuphatha ukucushwa kanye nokulandelela ushintsho kusiza ukuqinisekisa ukuthi imithetho yokuphepha ihlala ihambisana nokuthi akekho (kungaba ngengozi noma ngengozi) oguqula inqubomgomo ngaphandle kokushiya umkhondo.
Ngamafuphi, ama-VLAN akuyona into oyimisayo bese uyikhohlwa: adinga ukuqapha ngesikhathi sangempela, izexwayiso, kanye nokubuyekezwa okuvamile ukuqinisekisa ukuthi ayaqhubeka nokufeza umsebenzi wawo wokulawula nokuvikela.
Izinqubomgomo zokufinyelela ezisekelwe ezindimeni kanye nokulawula kwangaphakathi
Ukuhlukaniswa kwe-VLAN kufanele kuhambisane nezinqubomgomo zokulawula ukufinyelela okusekelwe ezindimeni (RBAC). Lokhu kusho ukuthi umsebenzisi noma iqembu ngalinye lithola isethi ecacile yezimvume namalungelo afanele indima yalo enhlanganweni, ngaphandle kokufinyelela okungadingekile.
Isibonelo, abasebenzi be-HR abadingi ukufinyelela kumaseva okuthuthukisa, futhi ithimba lokuthuthukisa alidingi ukufinyelela kusizindalwazi semiholo. Ukuchaza le mingcele nokuyiphoqelela ngama-ACL, ama-firewall angaphakathi, noma izilawuli zokuqinisekisa ze-VLAN kunciphisa kakhulu indawo yokuhlasela.
Kubalulekile futhi ukunciphisa ukufinyelela kolwazi olubucayi ngokusekelwe endimeni, ngisho nangaphakathi kwe-VLAN efanayo. Nakuba babelana ngesigaba, akubona bonke abasebenzisi okufanele babe nezinga elifanayo lokubonakala noma ikhono lokusebenza ngezinsizakusebenza zenethiwekhi nezinhlelo.
Lezi zinqubomgomo zokufinyelela azigcini nje ngokuhlala ezingeni elinengqondo: kumele zivumelaniswe neziqondisi zezinkampani (njenge-AD/LDAP), izinqubomgomo zomlilo, kanye nezindlela zokuqinisekisa inethiwekhi ezinezintambo nezingenantambo . Ngale ndlela, ubulungu eqenjini noma endimeni bunquma ngokuzenzakalelayo ukuthi iyiphi i-VLAN umsebenzisi abelwe kuyo nokuthi yini angayenza ngaphakathi kwayo.
Ukuhlanganisa incazelo enhle yezindima nama-VLAN aklanywe kahle kuphumela kumodeli enamandla kakhulu yamalungelo aphansi, okwenza kube nzima ngomhlaseli ofaka i-akhawunti engcupheni ukuhamba eceleni kwenethiwekhi ngaphandle kokubhekana nezithiyo.
Izibuyekezo zokuphepha kanye nokuphathwa kwedivayisi
Ukwakheka okuhle akusizi ngalutho uma imishini esekelayo igcwele ubuthakathaka. Amaswishi, ama-router, kanye nama-firewall aphatha ama-VLAN kudingeka avuselelwe njalo ngama-patches okuphepha kanye nezibuyekezo , njengoba evame ukuqondiswa yizenzo ezithile.
Kunconywa ukuthi kusungulwe inqubo evamile yokubuyekeza ama-bulletin omkhiqizi, ukuhlela amafasitela okulungisa, kanye nokusebenzisa i-firmware kanye nezibuyekezo zesofthiwe. Ukulibazisa le misebenzi ngokungenasiphelo kushiya ubuthakathaka obaziwayo buvulekele ukusetshenziswa kalula.
Ngasohlangothini lokuphatha, kunconywa ukuthi ukhubaze amaphrothokholi okuphatha angavikelekile (njengeTelnet noma i-HTTP engabethelwe) bese usebenzisa izindlela ezikude ezivikelekile njenge-SSH ne-HTTPS zekhonsoli yokuphatha. Ngaphezu kwalokho, i-VLAN yokuphatha kufanele ifinyeleleke kuphela kumadivayisi agunyaziwe.
Ukuqapha ukucushwa nakho kubalulekile. Ukugcina ama-backups, ukulawula ukuthi ubani owenza izinguquko, nokuqhathanisa izinguqulo kukuvumela ukuthi uthole izinguquko ezingagunyaziwe noma amaphutha okucushwa angenza buthaka ukuphepha kwe-VLAN.
Okokugcina, ukuhlanganisa amadivayisi enethiwekhi ezinhlelweni zokubhalisa ezihlanganisiwe (i-SIEM, isibonelo) kusiza ukuhlanganisa imicimbi, okwenza kube lula ukubona izitayela kanye nemizamo yokuhlasela engaba khona ethinta ama-VLAN amaningi ngesikhathi esisodwa.
Ukuqeqeshwa kwabasebenzi nokuqwashisa
Izindlela zokuphepha ezisezingeni eliphezulu kakhulu azisizi ngalutho uma isici somuntu sehluleka kuzo zonke izigaba. Kubalulekile ukuthi abasebenzi baqeqeshwe ngezindlela ezinhle kakhulu zokuphepha kwenethiwekhi , ikakhulukazi mayelana nokusetshenziswa kwansuku zonke kwezinsizakusebenza zenkampani.
Kunconywa ukufundisa abasebenzi ukuthi bangayibona kanjani futhi babike imizamo engaba khona yobugebengu bokweba imininingwane ebucayi, ukuthi bangaxhuma kanjani amadivayisi angaziwa noma omuntu siqu kuma-port enethiwekhi yenkampani ngaphandle kwemvume, nokuthi bangahlonipha kanjani izinqubomgomo zangaphakathi zokusetshenziswa kwengqalasizinda.
Kufanele futhi kugcizelelwe ekudaleni nasekuphatheni amaphasiwedi aqinile , kusetshenziswa ukuqinisekiswa kwezinto eziningi uma kutholakala, kanye nokubaluleka kokungabelani ngeziqinisekiso nozakwabo noma ukusebenzisa kabusha okhiye kuzo zonke izinsizakalo eziningi.
Ukuphakamisa ulwazi kuhilela ukuchaza, ngolimi olucacile nolufinyelelekayo, ukuthi kungani kukhona ama-VLAN nokuthi kungani ukufinyelela okuthile kuvinjelwe. Uma abasebenzisi beqonda ukuthi lokhu kwenzelwa ukuvikela idatha yenkampani (futhi, ezimweni eziningi, imininingwane yabo siqu), bavame ukuba nokubambisana okukhulu kunokuba kube nemingcele ebekwe nje ngaphandle komongo.
Ngamafuphi, ukuphepha kwe-VLAN akuyona nje umthwalo wemfanelo womnyango we-IT; kudinga ukubandakanyeka kwansuku zonke kanye nokuzibophezela kwabasebenzi bonke ukunciphisa amathuba ezigameko ezibangelwa amaphutha abantu.
Ukuqinisekiswa kanye nokulawulwa kokufinyelela kwenethiwekhi (802.1X kanye ne-NAC)
Isinyathelo esibalulekile ekuqiniseni ukuphepha ezindaweni ze-VLAN ukusebenzisa uhlelo lokuqinisekisa oluqinile lwamadivayisi nabasebenzisi ngaphambi kokubanika ukufinyelela kunethiwekhi. Yilapho indinganiso ye-802.1X iqala khona ukusebenza, esetshenziswa kabanzi kumanethiwekhi e-Wi-Fi anezintambo kanye nawezinkampani.
Nge-802.1X, i-switch port isebenza "njengomgcini wesango" futhi ayivumeli ithrafikhi egcwele kuze kube yilapho idivayisi exhunyiwe iqinisekisa ngempumelelo ngeseva yokuqinisekisa ephakathi (ngokuvamile i-RADIUS noma i-TACACS+). Kuye ngeziqinisekiso, i-VLAN ethile inganikezwa, noma izinqubomgomo ezithile zingasetshenziswa.
Lo modeli uvame ukuhambisana nezixazululo ze -Network Access Control (NAC) , eziqinisekisa hhayi igama lomsebenzisi nephasiwedi kuphela, kodwa futhi nesimo sedivayisi: ukuthi ngabe inesofthiwe ye-antivirus, ukuthi isesikhathini, ukuthi iyahlangabezana yini nezidingo ezithile zokuphepha, njll. Amadivayisi ahluleka ukuhlolwa angathunyelwa ku-VLAN yokuhlukaniswa.
Inzuzo yale ndlela ukuthi inciphisa kakhulu amathuba okuthi umuntu ohlaselayo axhume idivayisi echwebeni lokushintsha elingasetshenziswanga futhi athole ukufinyelela ngaphandle kokuchitha isikhathi. Ngisho noma bekwazile ukuxhuma ngokoqobo, kuzodingeka banqobe izinqubomgomo zokuqinisekisa kanye ne-NAC ngaphambi kokuthi bakwazi ukuxhumana nenethiwekhi yonke.
Ukusebenzisa i-802.1X kanye ne-NAC kunezela ubunzima futhi kudinga ukuhlela okuhle, kodwa kungenye yezindlela eziphumelela kakhulu zokulawula ukuthi ubani ngempela ofaka i-VLAN ngayinye nokuvimbela amadivayisi angagunyaziwe ukuthi angene ezigabeni ezibalulekile.
Ukuvikelwa kwesigaba 2: ukuhlaselwa okuvamile kanye nezindlela zokulwa nakho
Ukuhlaselwa okuningi kwamanethiwekhi endawo (ama-LAN) kuhlose i-Layer 2 yemodeli ye-OSI, kusetshenziswa umbono ovamile wokuthi konke "okungaphakathi kwe-LAN" kuthembekile. Akukho okungaba kude neqiniso: kunezindlela eziningi zokulawula ithrafikhi phakathi kwama-host ngaphakathi kwe-VLAN efanayo.
Lokhu kuhlasela kufaka phakathi ukukhwabanisa ikheli le-MAC, ukugcwala kwamatafula okushintshana, ukukhwabanisa kwe-ARP, ukusetshenziswa kwamaseva e-DHCP angagunyaziwe, kanye nokufakwa kwethrafikhi okunonya okwenzelwe ukuxhaphaza ubuthakathaka kumadivayisi abasebenzisi bokugcina noma enethiwekhi.
Ukuze kuncishiswe lezi zingozi, abakhiqizi bezinkinobho bafake izici ezithile. Isici esibalulekile ukulawula ukufinyelela kwenethiwekhi (i-NAC), esesikushilo kakade, futhi okuvimbela ukufinyelela kumadivayisi angahlangabezani nezinqubomgomo ezichaziwe . Kodwa kukhona nezindlela ezithile zokuvimba ukuhlaselwa okuvamile kakhulu.
Elinye lamathuluzi anamandla kakhulu yi-DHCP Snooping, ekuvumela ukuthi unqume ukuthi yimaphi amachweba abhekwa njengathembekile ekuthumeleni izimpendulo ze-DHCP. Lokhu kuvimbela umhlaseli ukuthi axhume iseva ye-DHCP mbumbulu futhi anikeze abasebenzisi amakheli e-IP anobungozi kanye namapharamitha enethiwekhi .
Esinye isici esiyisisekelo ku-Layer 2 yi-Dynamic ARP Inspection (DAI), eqinisekisa izimpendulo ze-ARP ngokuziqhathanisa nedathabheyisi ekhiqizwe yi-DHCP snooping noma amathebula angaguquki. Lokhu kunciphisa amathuba okukhwabanisa kwe-ARP kanye nokuhlasela komuntu phakathi nendawo ngaphakathi kwe-VLAN efanayo.
Ukusnooper kwe-DHCP: ukuqinisekisa ukwabiwa kwamakheli e-IP
Ukuhlasela kobuqili be-DHCP kuhilela ukufaka iseva ye-DHCP mbumbulu ephendula ngokushesha kuneseva esemthethweni, iletha ama-IP aguquliwe kanye namasango. Ngenxa yalokho, amadivayisi enethiwekhi angagcina ethumela ithrafikhi yawo noma kuphi lapho umhlaseli efuna khona, kanye nemiphumela engaba khona.
Ukuze kuvinjelwe lokhu, umsebenzi we -DHCP Snooping uvulwa ku-switch , okuphoqa incazelo yokuthi yimaphi ama-port "athenjwayo" ekuthumeleni izimpendulo ze-DHCP nokuthi yimaphi "angathenjwanga." Ngokuvamile, i-port eya kuseva ye-DHCP noma i-firewall esebenza njengeseva imakwe njengethembekile, kanti ama-port kubasebenzisi ashiywa njengangathenjwanga.
Esibonelweni esisebenzayo se-VLAN 20, ukucushwa okuvamile kuswishi ye-Cisco kuzofaka into efana nokuvumela i-DHCP Snooping emhlabeni jikelele bese kuba ku-VLAN ehambisanayo, ukumaka isikhombimsebenzisi kuseva ye-DHCP njengechweba elithembekile , kanye nokunciphisa izinga lemiyalezo ye-DHCP kumachweba abasebenzisi:
Shintsha(config)# ip dhcp ukusnooping
Shintsha(config)# ip dhcp snooping vlan 20
Shintsha(ukusetha)# isikhombimsebenzisi Gi0/0
Shintsha(config-if)# ip dhcp snooping trust
I-Switch(config)# ububanzi besixhumi esibonakalayo Gi1/0 – 3
I-Switch(config-if-range)# ip dhcp izinga lomkhawulo wokusnooping 10
Ngale ndlela yokucushwa, ichweba elithembekile kuphela elingaletha izimpendulo ze-DHCP ezivumelekile , futhi izinga lomgwaqo we-DHCP kumachweba abasebenzisi nalo lilinganiselwe ukunciphisa ukuhlaselwa kwezikhukhula noma ukuziphatha okungajwayelekile.
Uma i-DHCP Snooping isivuliwe, iswishi igcina isizindalwazi sezixhumanisi ze-IP-MAC-port, ezizosetshenziswa njengereferensi yezinye izici zokuphepha ezifana ne-Dynamic ARP Inspection, ngaleyo ndlela kuqiniswa ubuqotho bokubhekana nolwazi olukunethiwekhi.
Ukuhlolwa kwe-Dynamic ARP (DAI): ukuzivikela ekuhlaselweni yi-ARP
Ukuhlasela kwe-ARP kuwukuhlasela okuvamile kumanethiwekhi endawo: umhlaseli uthumela izimpendulo ze-ARP ezingamanga ezihlobanisa ikheli lakhe le-MAC nekheli le-IP lesango noma enye idivayisi, ngaleyo ndlela akwazi ukuvimba, ukuqondisa kabusha, noma ukuguqula ithrafikhi phakathi kwezisulu ngaphakathi kwe-VLAN efanayo.
Ukuhlolwa kwe-Dynamic ARP (DAI) kusebenza kahle ukuze kumiswe le ndlela emthonjeni wayo. Uma i-DAI ivuliwe ku-VLAN, iswishi ibamba amaphakethe e-ARP futhi iwaqinisekise ngokumelene nesizindalwazi sesixhumanisi se-IP-MAC esithole ngokuskena kwe-DHCP noma ukucushwa okungaguquki.
Endabeni ye-VLAN 20, ukusebenza kwe-DAI kungenziwa ngesethi yemiyalo efana nalokhu:
I-Switch(config)# ip arp inspection vlan 20
Shintsha(ukusetha)# isikhombimsebenzisi Gi0/0
I-Switch(config-if)# ip arp inspection trust
Imbobo ephawulwe njengethembekile ngokuvamile yileyo exhuma kuseva ye-DHCP noma isango, kuyilapho amambobo abasebenzisi asele ebhekwa njengangathembekile futhi imiyalezo yawo ye-ARP ihlolwa ngokuningiliziwe. Noma yiliphi iphakethe le-ARP elingahambisani nesizindalwazi se-DHCP Snooping noma imithetho elungiselelwe ivinjiwe.
Lokhu kwenza kube nzima kakhulu ukuhlaselwa kobuqili be-ARP, njengoba iswishi ngeke yamukele ukumepha kwe-IP-MAC okwenziwe ngokungahleliwe. Lokhu kuvikelwa kubaluleke kakhulu ezindaweni ezinabasebenzisi abaningi, lapho idivayisi eyodwa ethintekile ingazama ukuhlola noma ukulawula ithrafikhi yabanye.
Ukuphepha Kwesigaba 3 kanye Nesigaba 4: Ama-ACL, Ukuhlunga, kanye ne-DPI
Ama-VLAN ahlinzeka ngezigaba ze-Layer 2, kodwa ukuze kulawulwe ngempela ukuthi ithrafikhi ingahamba kanjani phakathi kwawo, kudingeka izinyathelo ezingqimbeni eziphakeme, ikakhulukazi i-Layer 3 (IP) kanye ne-Layer 4 (TCP/UDP) . Uhlu lokulawula ukufinyelela (ama-ACL) luyithuluzi eliyisisekelo lalokhu.
Ngokusebenzisa uhlu lokulawula ukufinyelela (ama-ACL) alungiselelwe kuma-router, amaswishi e-Layer 3, noma ama-firewall, ungachaza ngokuningiliziwe ukuthi yimaphi ama-VLAN angaxhumana nawo, yiziphi izinqubo ezivunyelwe, yiziphi amakheli e-IP, kanye nokuthi yiziphi izimbobo. Lokhu kukuvumela ukuthi uhlukanise amanethiwekhi abucayi, ukhawulele izinsizakalo, futhi unciphise ukunyakaza kwe-lateral ngabahlaseli abangaba khona.
Ngaphezu kwama-ACL, izinto eziningi zokuphepha zifaka ukuhlunga amaphakethe kanye ne -Deep Packet Inspection (DPI) , okuhlaziya okuqukethwe kwethrafikhi kanye nokuziphatha ukuze kutholakale amaphethini anonya, ngisho nalapho kusetshenziswa ama-port ajwayelekile noma amasu okubalekela.
Isibonelo, ungachaza ama-ACL athile e-DNS, HTTP, noma enye iphrothokholi ebalulekile, uvumele ithrafikhi iye kumaseva athembekile kuphela futhi uvimbele bonke abanye. Lokhu kuwusizo ikakhulukazi ekunciphiseni umthelela wokukhwabanisa kwe-DNS noma izimpendulo eziguquliwe ezivela emithonjeni engagunyaziwe.
Uma kuhlanganiswa, ukuphepha kwesigaba 3 no-4 kusebenza njengomugqa wesibili wokuzivikela oqinisa ukuhlukaniswa kwe-VLAN futhi kuqinisekisa ukuthi ithrafikhi phakathi kwabo ne-inthanethi ihambisana nezinqubomgomo zokuphepha zenhlangano.
Ukuhlunga ithrafikhi ye-DNS ngama-ACL athile
Enye yezindlela zokuhlasela eziyingozi kakhulu kumanethiwekhi anamuhla ukuphathwa kabi kwe-DNS, njengoba kuvumela abahlaseli ukuthi baqondise kabusha abasebenzisi kumawebhusayithi mbumbulu yize i-URL ibonakala isemthethweni. Ukuze kuncishiswe le ngozi ngaphakathi kwe-VLAN, i- ACL ingadalwa ukuze ihlunge ithrafikhi ye-DNS futhi ivumele kuphela izimpendulo ezivela kumaseva athile, athembekile.
Ake sithi kunethiwekhi ene-VLAN 20, sifuna ukuvumela izimpendulo ze-DNS ezivela kumaseva agunyaziwe kuphela , isibonelo, amaseva e-DNS omphakathi e-Google ne-Cloudflare achazwe ku-firewall ye-pfSense: 8.8.8.8 kanye ne-1.1.1.1. I-ACL ingase ibukeke kanje:
Shintsha(config)# uhlu lokufinyelela lwe-ip olunwetshiwe DNS_FILTER
I-Switch(config-ext-nacl)# vumela i-udp host 8.8.8.8 noma iyiphi i-eq 53
I-Switch(config-ext-nacl)# vumela i-udp host 1.1.1.1 noma iyiphi i-eq 53
Shintsha(config-ext-nacl)# phika i-udp noma iyiphi i-eq 53
Shintsha(config-ext-nacl)# vumela i-ip noma iyiphi
I-Switch(config)# ububanzi besixhumi esibonakalayo Gi1/0 – 3
Shintsha (ukusetha-uma-ububanzi)# ip access-group DNS_FILTER ku
Ngale ndlela yokucushwa, ama-port abasebenzisi azokwamukela kuphela ithrafikhi ye-DNS evela kulawo maseva , avimbele izimpendulo ezivela kumaseva e-DNS angagunyaziwe angase asebenze ngendlela enonya. Lokhu kwenza kube nzima kakhulu ukusebenzisa i-DNS spoofing ngaphakathi kwe-VLAN.
Kuhle ukukhumbula ukuthi, noma ngabe amaphakethe ahlungiwe ku-switch, kungumqondo omuhle ukuba nenqubomgomo ehambisanayo ku-firewall nakuseva ye-DNS noma isixazululo esiphindaphindayo uqobo, okuvimbela amakhompyutha ekusebenziseni amaseva angaphandle kokulawulwa yinkampani ukuze adlule imikhawulo.
Ukuphepha Kwechweba: Nciphisa futhi ulawule amakheli e-MAC
Enye indlela ewusizo kakhulu yokuqinisa ukuphepha kwe-VLAN yi-Port Security. Lesi sici sikuvumela ukuthi ukhawulele inani lamakheli e-MAC angavela ku- switch port ngayinye, ukuvimba noma ukukhawulela ukufinyelela uma kutholakala amadivayisi angagunyaziwe.
Esimweni esingokoqobo, umuntu anganquma ukuthi i-port yomsebenzisi ngamunye ku-VLAN 20 ivumela ikheli elilodwa le-MAC kuphela, okuvimbela othile ekuxhumeni iswishi engagunyaziwe noma idivayisi yesibili "i-piggybacking" ku-port efanayo yenethiwekhi. Ngaphezu kwalokho, inketho "enamathelayo" ingasetshenziswa ukuze iswishi ifunde ngokuzenzakalelayo ikheli le-MAC elilibheka njengelisemthethweni.
Ukucushwa okuvamile kuswishi ye-Cisco yamachweba i-Gi1/0 kuya ku-Gi1/3 kungase kubukeke kanje:
I-Switch(config)# ububanzi besixhumi esibonakalayo Gi1/0 – 3
Ukufinyelela kwemodi ye-switchport (config-if-range)# switchport
Shintsha (ububanzi bokuhlela uma)# ukufinyelela kwe-switchport vlan 20
Shintsha (ububanzi bokuhlela uma ukhona)# ukuphepha kwe-port ye-switchport
I-Switch(config-if-range)# i-switchport port-security maximum 1
I-Switch(config-if-range)# i-switchport port-security mac-address sticky
Umkhawulo wokwephulwa kokuphepha kwe-switchport port (config-if-range)#
Ngale ndlela, uma kutholwa ikheli elisha le-MAC echwebeni elilungiselelwe nge-Port Security, iswishi ithatha isinyathelo esichaziwe (kulokhu, "khawulela" ukukhawulela ithrafikhi futhi ikhiqize amalogi emicimbi). Lokhu kunciphisa amathuba okuhlaselwa okukhohlisayo ngokomzimba noma ukuxhumana okungagunyaziwe kunethiwekhi yangaphakathi.
Kuhlanganiswe ne-DHCP Snooping kanye ne-DAI, i-Port Security isiza ekwenzeni i-VLAN iphephe kakhulu, ikakhulukazi ezindaweni lapho kungaziwa khona ukuthi umsebenzisi angaxhuma ini echwebeni yamahhala uma kungekho ukulawula.
Ukuphathwa okuphephile kanye nokuhlolwa kwengqalasizinda okuvamile
Ukuze zonke lezi zinyathelo zihlale zisebenza kahle ngokuhamba kwesikhathi, kudingeka imodeli yokuphatha nokuqapha eqinile yengqalasizinda yenethiwekhi. Lokhu kufaka phakathi ukusetshenziswa kwezinqubo ezivikelekile zokuphatha kude, ukucushwa okuphakathi, kanye nokulandelelwa kwezinguquko.
Kunconywa kakhulu ukusebenzisa i-SSH ukuze ufinyelele kuma-consoles amaswishi nama-router, kanye ne-HTTPS yokuphathwa kwe-web interface uma kudingeka. Ngesikhathi esifanayo, kuyacetyiswa ukuthi ukhubaze amaphrothokholi amadala noma angavikelekile angaveza iziqinisekiso noma ukucushwa kumbhalo ocacile uma othile elalele ithrafikhi.
Ngaphezu kwalokho, ukusebenzisa amathuluzi okuphatha ukucushwa kanye nokulawula inguqulo kukuvumela ukuthi ugcine ikhophi yesimo sedivayisi ngayinye isesikhathini, uthole izinguquko ezingalindelekile, futhi ubuyisele ngokushesha ukucushwa uma kwenzeka iphutha noma ukwehluleka kwehadiwe.
Ngakolunye uhlangothi, kubalulekile ukwenza ukuhlolwa nokuhlolwa kokuphepha njalo: ukuskena kobuthakathaka, ukuhlolwa kokungena kwangaphakathi, ukuhlaziywa kwengozi, kanye nokubuyekezwa okuningiliziwe kwezinqubomgomo ze-VLAN. Lokhu kusiza ekwembuleni ubuthakathaka, ukucushwa okudala , noma ukungahambisani okungaba yizindawo zokungena zokuhlaselwa.
Le ndlela yokuqapha ivumela ukuthi izinyathelo zokuphepha zilungiswe njengoba ingqalasizinda ishintsha, ama-VLAN amasha engezwa, noma kuvela izinhlobo ezintsha zezinsongo ezazingekho ku-radar ngaphambilini.
Ngokuhlanganisa ukuhlela i-VLAN ngokucophelela, ukuhlukaniswa kweminyango okusebenzayo, izindlela ezithuthukisiwe ze-Layer 2 njenge-DHCP Snooping, i-Dynamic ARP Inspection, kanye ne-Port Security, kanye nezinqubomgomo ze-Layer 3 kanye ne-4, ukuhlunga i-DNS, ukuphathwa kwedivayisi okuphephile, kanye nokuqapha okuqhubekayo, inethiwekhi ithola ukuqina okukhulu. Umphumela uba yindawo lapho ukuhlasela okukodwa noma ukutheleleka komshini kungenzeki kube yinhlekelele ngokuzenzakalelayo, ngoba izithiyo ezinengqondo, izilawuli zokufinyelela, kanye namathuluzi okuhlola kunciphisa umthelela futhi kwenza kube lula ukuthola kusenesikhathi, uma nje kusekelwa abasebenzi abaqeqeshiwe kanye nezinqubo ezicacile zokuphendula ezigamekweni.
