Using Time-Based Access-Lists

2017-11-03 09:05:05

Problem

You want to filter application data based on the time of day.

Solution

To filter application data based on the time of day, use the following commands:

Router1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router1(config)#time-range NOSURF Router1(config-time-range)# periodic weekdays 9:00 to 17:00 Router1(config-time-range)#exit Router1(config)#ip access-list extended NOSURFING Router1(config-ext-nacl)# deny tcp any any eq www time-range NOSURF Router1(config-ext-nacl)# permit ip any any Router1(config-ext-nacl)#exit Router1(config)#interface FastEthernet0/1 Router1(config-if)#ip access-group NOSURFING in Router1(config-if)#end Router1#

This feature relies on an accurate system clock to function properly. It is highly recommended that you use NTP to synchronize the router's clock. See Chapter 14 for more information regarding NTP.

Discussion

Timed-based access-lists allow you to filter application data based on the time of day. In our example, we've built an access-list that denies HTTP traffic during the work hours, Monday to Friday, from 9:00 to 17:00. Timed-based access-lists also allows control over other router features, based on the time of day, such as policy-based routing, CAR statements, ACL logging, on-demand link activation, or security policies, to name a few.

To configure a timed-based access-list, you must first configure a time-range:

Router2#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router2(config)#time-range MONDAYONLY Router2(config-time-range)#periodic monday 9:00 to 17:00 Router2(config-time-range)#end Router2#

In this example, we've named the time-range MONDAYONLY, and assigned it a time range from Monday at 9:00 to 17:00. The periodic keyword is one way to define a time range. The other method is assign an absolute time by using the absolute keyword. Using the absolute method assigns a specific date in time to begin. The following is an example of a time range that uses the absolute keyword:

Router2#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router2(config)#time-range SAMPLE Router2(config-time-range)#absolute start 9:00 1 October 2006 end 18:00 31 December 2006 Router2(config-time-range)#end Router2#

Notice that we have set an exact date and time to start and end on using the absolute keyword. In this example, the start time is 9:00 on October 1, 2006, and the end time is 18:00 on December 31, 2006.

You can combine periodic and absolute statements within a single time range; however, keep in mind that the absolute statements are given priority:

Notice in this example that we've included a periodic and absolute statement within the same time range. In this case, the periodic statement is ignored until the absolute start time is reached, and then each Monday the time range will become active. The same holds true for the absolute end time. Once we reach the absolute end time of 18:00 on December 31, then the periodic statements will again be ignored.

You can configure multiple periodic statements within a time range but only one absolute statement.

Once you configure the time range, then you can assign it to an ACL entry:

Router1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router1(config)#ip access-list extended NOSURFING Router1(config-ext-nacl)# deny tcp any any eq www time-range NOSURF Router1(config-ext-nacl)# permit ip any any Router1(config-ext-nacl)#end Router1#

Notice that we've assigned the time range NOSURF to the first ACL entry. This ACL entry will become active when the time range becomes TRue. Once active, the ACL entry acts like a normal entry, and will start denying traffic that matches its criteria. In this case, during work hours, our ACL will deny all HTTP traffic.

If we look at the timed access-list during the evening hours, we will see the timed ACL entry is inactive:

Router1#show clock 20:10:50.985 EDT Tue Aug 22 2006 Router1# Router1#show ip access-list Extended IP access list NOSURFING 10 deny tcp any any eq www time-range NOSURF (inactive) 20 permit ip any any Router1#

During this period, the timed ACL entry is marked inactive and HTTP-based traffic is allowed to pass. During normal workday hours, however, the timed ACL entry is changed to active and HTTP traffic is now blocked:

Router1#show clock 09:39:22.279 EDT Wed Aug 23 2006 Router1# Router1#show ip access-list Extended IP access list NOSURFING 10 deny tcp any any eq www time-range NOSURF (active) 20 permit ip any any Router1#

You can also construct more complicated examples where different lines in the same ACL have different time-range rules. In the following example, we have defined two time ranges: one is called NOSURF, and is valid every day between 9:00 AM and 5:00 PM; the other is NOTELNET, and is valid between 5:00 PM and 9:00 AM:

Router1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router1(config)#time-range NOSURF Router(config-time-range)# periodic weekdays 9:00 to 17:00 Router1(config-time-range #exit Router1(config)#time-range NOTELNET Router1(config-time-range)# periodic weekdays 17:00 to 9:00 Router1(config-time-range)#exit Router1(config)#ip access-list extended NOSURFING Router1(config-ext-nacl)# deny tcp any any eq www time-range NOSURF Router1(config-ext-nacl)# deny tcp any any eq telnet time-range NOTELNET Router1(config-ext-nacl)# permit ip any any Router1(config-ext-nacl)#end Router1#

Then, when you look at this ACL with the show ip accesslist command, the output shows which timed lines are currently being used (active) and which are not (inactive):

Router1#show ip access-list NOSURFING Extended IP access list NOSURFING 10 deny tcp any any eq www time-range NOSURF (inactive) 20 deny tcp any any eq telnet time-range NOTELNET (active) 20 permit ip any any Router1#

Категории