{"id":55847,"date":"2020-01-30T00:00:00","date_gmt":"2020-01-29T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/acl-kommutatorov-v-detalyah"},"modified":"2020-02-18T14:04:00","modified_gmt":"2020-02-18T11:04:00","slug":"acl-kommutatorov-v-detalyah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/acl-kommutatorov-v-detalyah","title":{"rendered":"ACL p\u00e5 switche i detaljer","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

ACL (Access Control List) p\u00e5 netv\u00e6rksudstyr kan implementeres b\u00e5de hardware- og softwarebaseret. Og hvis softwarebaserede ACL er let at forst\u00e5 \u2013 det er regler, der opbevares og behandles i RAM (dvs. p\u00e5 Control Plane), med alle de heraf f\u00f8lgende begr\u00e6nsninger, s\u00e5 skal vi i denne artikel se n\u00e6rmere p\u00e5, hvordan hardwarebaserede ACL fungerer. Vi vil anvende switchene fra ExtremeSwitching serien fra Extreme Networks som eksempel.<\/p>\n

\"ACL
\n <\/a><\/noindex>
\nDa vi specifikt er interesserede i hardwarebaserede ACL, er den interne implementering af Data Plane, eller de anvendte chipsets (ASIC), af prim\u00e6r betydning for os. Switchene fra alle serier fra Extreme Networks er bygget p\u00e5 ASIC fra Broadcom, og derfor vil de fleste af de oplysninger, der pr\u00e6senteres nedenfor, ogs\u00e5 g\u00e6lde for andre switches, som findes p\u00e5 markedet, og som er baseret p\u00e5 de samme ASIC.<\/p>\n

Som det fremg\u00e5r af diagrammet ovenfor, er det \"ContentAware Engine\", der direkte styrer ACL i chipsettet, opdelt i \"ingress\" og \"egress\". Arkitektonisk er de ens, men \"egress\" er mindre skalerbar og mindre funktionel. Fysisk best\u00e5r begge \"ContentAware Engines\" af TCAM-hukommelse plus tilknyttede logik, og hver bruger- eller systemregel i ACL er en simpel bitmaske, der er skrevet ind i denne hukommelse. Derfor behandles trafik af chipsettet pakke for pakke uden nedgang i ydeevnen.<\/p>\n

Fysisk deles den samme Ingress\/Egress TCAM logisk op i flere segmenter (afh\u00e6nger af hukommelsens st\u00f8rrelse og platformen), s\u00e5kaldte \"ACL slices\". For eksempel sker der noget tilsvarende med den fysiske HDD p\u00e5 din b\u00e6rbare computer, n\u00e5r du opretter flere logiske drev p\u00e5 den \u2013 C:>, D:>. Hver ACL-slice best\u00e5r i sin tur af hukommelsesceller i form af \"r\u00e6kker\", hvor \"rules\" (regler\/bitmasker) skrives ind.<\/p>\n

\"ACL
\nOpdelingen af TCAM i ACL-slices har en bestemt logik. I hver enkelt ACL-slice kan kun kompatible \"rules\" skrives. Hvis en af \"rules\" ikke er kompatibel med den tidligere, vil den blive skrevet ind i den n\u00e6ste i r\u00e6kkef\u00f8lgen af ACL-slices, uanset hvor mange frie r\u00e6kker der er tilbage i det forrige. <\/p>\n

Hvor kommer s\u00e5 denne kompatibilitet eller inkompatibilitet af ACL-reglerne fra? Faktisk har \u00e9n \"linje\" TCAM, hvor \"reglerne\" gemmes, en l\u00e6ngde p\u00e5 232 bit og er delt op i flere felter \u2013 Fixed, Field1, Field2, Field3. 232 bit eller 29 byte TCAM-hukommelse er tilstr\u00e6kkeligt til at gemme bit-masken for en bestemt MAC- eller IP-adresse, men er betydeligt mindre end hele Ethernet-pakkens header. I hver enkelt ACL-slice udf\u00f8rer ASIC et uafh\u00e6ngigt opslag baseret p\u00e5 de indstillede bit-masker i F1-F3. Generelt kan dette opslag udf\u00f8res p\u00e5 de f\u00f8rste 128 byte af Ethernet-headeren. Det er faktisk fordi, at opslaget kan udf\u00f8res p\u00e5 128 byte, mens der kun kan gemmes 29 byte, at der skal angives en offset i forhold til begyndelsen af pakken for korrekt opslag. Offset for hver ACL-slice angives under skrivningen af den f\u00f8rste regel, og hvis der under skrivningen af den n\u00e6ste regel opdages behov for en anden offset, betragtes denne regel som inkompatibel med den f\u00f8rste og skrives ind i den n\u00e6ste ACL-slice.<\/p>\n

Nedenfor i tabellen er r\u00e6kkef\u00f8lgen af kompatibilitet for betingelserne, der skrives ind i ACL. Hver enkelt linje indeholder de kompatible og inkompatible bit-masker med andre linjer.<\/p>\n

\"ACL
\nHver enkelt pakke, der behandles af ASIC, starter et parallelt opslag i hver ACL-slice. Kontrollen udf\u00f8res indtil den f\u00f8rste match i ACL-slice, men der tillades flere matches for den samme pakke i forskellige ACL-slices. Hver enkelt \"regel\" har en tilh\u00f8rende handling, der skal udf\u00f8res i tilf\u00e6lde af en match (bit-mask). Hvis der er en match i flere ACL-slices, tr\u00e6ffes der en beslutning om, hvilken handling der skal udf\u00f8res i \"Action Conflict Resolution\"-blokken baseret p\u00e5 prioriteten af ACL-slice. Hvis der i ACL'en er angivet b\u00e5de \"action\" (permit\/deny) og \"action-modifier\" (count\/QoS\/log\/...), vil kun den mest prioriterede \"action\" blive udf\u00f8rt ved flere matches, mens alle \"action-modifiers\" vil blive udf\u00f8rt. Eksemplet nedenfor viser, at begge t\u00e6llere vil blive \u00f8get, og den mest prioriterede \"deny\" vil blive udf\u00f8rt.<\/p>\n

\"ACL
\n\u201cACL Solutions Guide\u201d<\/a><\/noindex> med mere detaljeret information om arbejdet med ACL, der er offentligt tilg\u00e6ngelig p\u00e5 hjemmesiden extremenetworks.com<\/a><\/noindex>. Enhver opst\u00e5et eller resterende sp\u00f8rgsm\u00e5l kan altid stilles til medarbejderne p\u00e5 vores kontor \u2013 cis@extremenetworks.com<\/a><\/noindex>.
\n
Kilde: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

ACL (Access Control List) \u043d\u0430 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u044b \u043a\u0430\u043a \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e, \u0442\u0430\u043a \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e, \u0438\u043b\u0438 \u043f\u0440\u0438\u0432\u044b\u0447\u043d\u0435\u0439 \u0433\u043e\u0432\u043e\u0440\u044f hardware \u0438 software-based ACL. \u0418 \u0435\u0441\u043b\u0438 \u0441 software-based ACL \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u0442\u044c \u0432\u0441\u0451 \u043f\u043e\u043d\u044f\u0442\u043d\u043e, \u2014 \u044d\u0442\u043e \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0445\u0440\u0430\u043d\u044f\u0442\u0441\u044f \u0438 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u0432 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 (\u0442.\u0435. \u043d\u0430 Control Plane), \u0441\u043e \u0432\u0441\u0435\u043c\u0438 \u0432\u044b\u0442\u0435\u043a\u0430\u044e\u0449\u0438\u043c\u0438 \u043e\u0442\u0441\u044e\u0434\u0430 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f\u043c\u0438, \u0442\u043e \u043a\u0430\u043a \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u044b \u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-55847","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 ACL for switchere i detaljer | ProHoster","description":"ACL (Access Control List) p\u00e5 netv\u00e6rksenheder kan implementeres b\u00e5de hardware- og softwarebaseret, eller med andre ord hardware og software-baserede ACL.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/acl-kommutatorov-v-detalyah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47ACL \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 \u0432 \u0434\u0435\u0442\u0430\u043b\u044f\u0445 | ProHoster","og:description":"ACL (Access Control List) \u043d\u0430 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u044b \u043a\u0430\u043a \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e, \u0442\u0430\u043a \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e, \u0438\u043b\u0438 \u043f\u0440\u0438\u0432\u044b\u0447\u043d\u0435\u0439 \u0433\u043e\u0432\u043e\u0440\u044f hardware \u0438 software-based ACL.","og:url":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/acl-kommutatorov-v-detalyah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-29T21:00:00+00:00","article:modified_time":"2020-02-18T11:04:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55847","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:35:41","updated":"2022-09-29 07:17:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/55847","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=55847"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/55847\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=55847"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=55847"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=55847"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}