{"id":55847,"date":"2020-01-30T00:00:00","date_gmt":"2020-01-29T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/acl-kommutatorov-v-detalyah"},"modified":"2020-02-18T14:04:00","modified_gmt":"2020-02-18T11:04:00","slug":"acl-kommutatorov-v-detalyah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/acl-kommutatorov-v-detalyah","title":{"rendered":"Podrobnosti o ACL switchech","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

ACL (Access Control List) na s\u00ed\u0165ov\u00fdch za\u0159\u00edzen\u00edch mohou b\u00fdt realizov\u00e1ny jak hardwarov\u011b, tak softwarov\u011b, jin\u00fdmi slovy hardware a software-based ACL. A zat\u00edmco software-based ACL jsou pravidla, kter\u00e1 se uchov\u00e1vaj\u00ed a zpracov\u00e1vaj\u00ed v opera\u010dn\u00ed pam\u011bti (tj. na \u0159\u00eddic\u00edm pl\u00e1nu), se v\u0161emi vypl\u00fdvaj\u00edc\u00edmi omezen\u00edmi, jak jsou realizov\u00e1ny a funguj\u00ed hardware-based ACL, prozkoum\u00e1me v na\u0161em \u010dl\u00e1nku. Jako p\u0159\u00edklad budeme pou\u017e\u00edvat switche s\u00e9rie ExtremeSwitching spole\u010dnosti Extreme Networks.<\/p>\n

\"Podrobnosti
\n <\/a><\/noindex>
\nJeliko\u017e n\u00e1s zaj\u00edmaj\u00ed p\u0159edev\u0161\u00edm hardware-based ACL, je pro n\u00e1s kl\u00ed\u010dov\u00e1 vnit\u0159n\u00ed realizace Data Plane, nebo pou\u017e\u00edvan\u00fdch \u010dipset\u016f (ASIC). Switche v\u0161ech \u0159ad spole\u010dnosti Extreme Networks jsou zalo\u017eeny na ASIC od spole\u010dnosti Broadcom, a proto v\u011bt\u0161ina n\u00ed\u017ee uveden\u00fdch informac\u00ed bude tak\u00e9 platit pro dal\u0161\u00ed switche dostupn\u00e9 na trhu, kter\u00e9 jsou realizov\u00e1ny na stejn\u00fdch ASIC.<\/p>\n

Jak je vid\u011bt z obr\u00e1zku v\u00fd\u0161e, za funk\u010dnost ACL v \u010dipsetu zodpov\u00eddaj\u00ed \"Content-Aware Engine\", a to samostatn\u011b na \"ingress\" a \"egress\". Architektonicky jsou stejn\u00e9, pouze \"egress\" je m\u00e9n\u011b \u0161k\u00e1lovateln\u00fd a m\u00e9n\u011b funk\u010dn\u00ed. Fyzicky jsou oba \"Content-Aware Engine\" TCAM pam\u011b\u0165 plus p\u0159idru\u017een\u00e1 logika, a ka\u017ed\u00e9 u\u017eivatelsk\u00e9 nebo syst\u00e9mov\u00e9 pravidlo ACL je jednoduch\u00e1 bitov\u00e1 maska (bit-mask) zapsan\u00e1 do t\u00e9to pam\u011bti. Pr\u00e1v\u011b proto se zpracov\u00e1n\u00ed provozu \u010dipsetem prov\u00e1d\u00ed po paketech a bez degradace v\u00fdkonu.<\/p>\n

Fyzicky je stejn\u00e1 Ingress\/Egress TCAM logicky rozd\u011blena na n\u011bkolik segment\u016f (z\u00e1vis\u00ed na mno\u017estv\u00ed pam\u011bti a platform\u011b), tzv. \"ACL slices\". Nap\u0159\u00edklad, to sam\u00e9 se d\u011bje s fyzicky stejn\u00fdm HDD na va\u0161em notebooku, kdy\u017e na n\u011bm vytv\u00e1\u0159\u00edte n\u011bkolik logick\u00fdch disk\u016f \u2013 C:>, D:>. Ka\u017ed\u00fd ACL-slice se skl\u00e1d\u00e1 z pam\u011b\u0165ov\u00fdch bun\u011bk, ve form\u011b \"\u0159\u00e1dk\u016f\", kam se zapisuj\u00ed \"rules\" (pravidla\/bitov\u00e9 masky).<\/p>\n

\"Podrobnosti
\nRozd\u011blen\u00ed TCAM na ACL-slices m\u00e1 ur\u010dit\u00fd logick\u00fd z\u00e1klad. V ka\u017ed\u00e9m jednotliv\u00e9m ACL-slice mohou b\u00fdt zaps\u00e1na pouze vz\u00e1jemn\u011b kompatibiln\u00ed \"rules\". Pokud je n\u011bkter\u00e9 z \"rules\" nekompatibiln\u00ed s p\u0159edchoz\u00edm, bude zaps\u00e1no do dal\u0161\u00edho po sob\u011b jdouc\u00edho ACL-slice, bez ohledu na to, kolik voln\u00fdch \u0159\u00e1dk\u016f pro \"rules\" z\u016fstalo v p\u0159edchoz\u00edm. <\/p>\n

Odkud tedy poch\u00e1z\u00ed tato kompatibilita nebo nekompatibilita pravidel ACL? Jde o to, \u017ee jedna \u201c\u0159\u00e1dka\u201d TCAM, do kter\u00e9 se zapisuj\u00ed \u201cpravidla\u201d, m\u00e1 d\u00e9lku 232 bit\u016f a d\u011bl\u00ed se na n\u011bkolik pol\u00ed \u2013 Fixed, Field1, Field2, Field3. 232 bit\u016f nebo 29 byte TCAM pam\u011bti je dostate\u010dn\u00e9 na to, aby zapsalo bit-mask ur\u010den\u00e9 MAC nebo IP adresy, ale je to v\u00fdrazn\u011b m\u00e9n\u011b ne\u017e cel\u00fd z\u00e1hlav\u00ed Ethernet paketu. V ka\u017ed\u00e9m jednotliv\u00e9m ACL-slice ASIC prov\u00e1d\u00ed nez\u00e1visl\u00e9 vyhled\u00e1v\u00e1n\u00ed podle nastaven\u00fdch v F1-F3 bit-maskech. Celkov\u011b v\u0161ak m\u016f\u017ee b\u00fdt toto vyhled\u00e1v\u00e1n\u00ed prov\u00e1d\u011bno podle prvn\u00edch 128 byte Ethernet z\u00e1hlav\u00ed. Vlastn\u011b pr\u00e1v\u011b kv\u016fli tomu, \u017ee vyhled\u00e1v\u00e1n\u00ed m\u016f\u017ee prob\u00edhat podle 128 byte, zat\u00edmco m\u016f\u017ee b\u00fdt zaps\u00e1no pouze 29 byte, pro spr\u00e1vn\u00e9 vyhled\u00e1v\u00e1n\u00ed mus\u00ed b\u00fdt nastavena offset (posun) v\u016f\u010di za\u010d\u00e1tku paketu. Offset pro ka\u017ed\u00fd z ACL-slice je nastaven p\u0159i z\u00e1pisu prvn\u00edho pravidla, a pokud p\u0159i z\u00e1pisu n\u00e1sleduj\u00edc\u00edho pravidla dojde k pot\u0159eb\u011b jin\u00e9ho offsetu, pova\u017euje se takov\u00e9 pravidlo za nekompatibiln\u00ed s prvn\u00edm a zapisuje se do n\u00e1sleduj\u00edc\u00edho ACL-slice.<\/p>\n

V tabulce n\u00ed\u017ee je uveden po\u0159\u00e1dek kompatibility podm\u00ednek zapisovan\u00fdch do ACL. Ka\u017ed\u00fd jednotliv\u00fd \u0159\u00e1dek obsahuje vz\u00e1jemn\u011b kompatibiln\u00ed a nekompatibiln\u00ed bit-masks pro ostatn\u00ed \u0159\u00e1dky.<\/p>\n

\"Podrobnosti
\nKa\u017ed\u00fd jednotliv\u00fd paket zpracov\u00e1van\u00fd ASIC spou\u0161t\u00ed paraleln\u00ed vyhled\u00e1v\u00e1n\u00ed v ka\u017ed\u00e9m ACL-slice. Kontrola prob\u00edh\u00e1 do prvn\u00edho shody v ACL-slice, ale z\u00e1rove\u0148 je povolena v\u00edce shod pro jeden a ten sam\u00fd paket v r\u016fzn\u00fdch ACL-slice. Ka\u017ed\u00e9 jednotliv\u00e9 \u201cpravidlo\u201d m\u00e1 p\u0159\u00edslu\u0161nou akci, kterou je t\u0159eba prov\u00e9st v p\u0159\u00edpad\u011b spln\u011bn\u00ed podm\u00ednky (bit-mask). Pokud dojde k shod\u011b ihned v n\u011bkolika ACL-slice, v bloku \u201cAction Conflict Resolution\u201d se na z\u00e1klad\u011b priority ACL-slice rozhoduje, kterou z akc\u00ed prov\u00e9st. Pokud je v ACL zaps\u00e1no jak \u201caction\u201d (permit\/deny), tak \u201caction-modifier\u201d (count\/QoS\/log\/\u2026), pak p\u0159i v\u00edce shod\u00e1ch bude provedena pouze prioritn\u00ed \u201caction\u201d, p\u0159i\u010dem\u017e v\u0161echny \u201caction-modifier\u201d budou provedeny. Na p\u0159\u00edkladu n\u00ed\u017ee je uk\u00e1z\u00e1no, \u017ee budou zv\u00fd\u0161eny oba po\u010d\u00edta\u010de a provedena prioritn\u00ed \u201cdeny\u201d.<\/p>\n

\"Podrobnosti
\n\u201ePr\u016fvodce \u0159e\u0161en\u00edmi ACL\u201c<\/a><\/noindex> s podrobn\u011bj\u0161\u00edmi informacemi o funkci ACL voln\u011b dostupn\u00fd na str\u00e1nk\u00e1ch extremenetworks.com<\/a><\/noindex>. Jak\u00e9koliv vznikl\u00e9 nebo zb\u00fdvaj\u00edc\u00ed dotazy m\u016f\u017eete v\u017edy sm\u011b\u0159ovat na zam\u011bstnance na\u0161\u00ed kancel\u00e1\u0159e \u2013 cis@extremenetworks.com<\/a><\/noindex>.
\n
Zdroj: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

ACL (Access Control List) \u043d\u0430 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u044b \u043a\u0430\u043a \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e, \u0442\u0430\u043a \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e, \u0438\u043b\u0438 \u043f\u0440\u0438\u0432\u044b\u0447\u043d\u0435\u0439 \u0433\u043e\u0432\u043e\u0440\u044f hardware \u0438 software-based ACL. \u0418 \u0435\u0441\u043b\u0438 \u0441 software-based ACL \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u0442\u044c \u0432\u0441\u0451 \u043f\u043e\u043d\u044f\u0442\u043d\u043e, \u2014 \u044d\u0442\u043e \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0445\u0440\u0430\u043d\u044f\u0442\u0441\u044f \u0438 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u0432 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 (\u0442.\u0435. \u043d\u0430 Control Plane), \u0441\u043e \u0432\u0441\u0435\u043c\u0438 \u0432\u044b\u0442\u0435\u043a\u0430\u044e\u0449\u0438\u043c\u0438 \u043e\u0442\u0441\u044e\u0434\u0430 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f\u043c\u0438, \u0442\u043e \u043a\u0430\u043a \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u044b \u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-55847","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Podrobnosti o ACL switch\u016f | ProHoster","description":"ACL (Access Control List) na s\u00ed\u0165ov\u00fdch za\u0159\u00edzen\u00edch mohou b\u00fdt realizov\u00e1ny jak hardwarov\u011b, tak softwareov\u011b, nebo jak se b\u011b\u017en\u011b \u0159\u00edk\u00e1, jako hardware a software-based ACL.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/acl-kommutatorov-v-detalyah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47ACL \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 \u0432 \u0434\u0435\u0442\u0430\u043b\u044f\u0445 | ProHoster","og:description":"ACL (Access Control List) \u043d\u0430 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u044b \u043a\u0430\u043a \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e, \u0442\u0430\u043a \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e, \u0438\u043b\u0438 \u043f\u0440\u0438\u0432\u044b\u0447\u043d\u0435\u0439 \u0433\u043e\u0432\u043e\u0440\u044f hardware \u0438 software-based ACL.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/acl-kommutatorov-v-detalyah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-29T21:00:00+00:00","article:modified_time":"2020-02-18T11:04:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55847","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:35:41","updated":"2022-09-29 07:17:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/55847","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=55847"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/55847\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=55847"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=55847"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=55847"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}