{"id":55847,"date":"2020-01-30T00:00:00","date_gmt":"2020-01-29T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/acl-kommutatorov-v-detalyah"},"modified":"2020-02-18T14:04:00","modified_gmt":"2020-02-18T11:04:00","slug":"acl-kommutatorov-v-detalyah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/acl-kommutatorov-v-detalyah","title":{"rendered":"L\u00fclitite ACL-id detailides","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

ACL (Access Control List) v\u00f5rguseadmetes v\u00f5ivad olla rakendatud nii riistvaraliselt kui ka tarkvaraliselt, v\u00f5i nagu tavaliselt \u00f6eldakse, hardware ja software-based ACL. Ja kui software-based ACL on t\u00f5en\u00e4oliselt h\u00e4sti arusaadav \u2014 need on reeglid, mis salvestatakse ja t\u00f6\u00f6deldakse RAM-is (st Control Plane\u2019is), k\u00f5ikide piirangutega, mis sellest tulenevad, siis kuidas on rakendatud ja kuidas t\u00f6\u00f6tavad hardware-based ACL, uurime meie artiklis. N\u00e4itena kasutame Extreme Networks'i ExtremeSwitching seeria l\u00fclitusi.<\/p>\n

\"L\u00fclitite
\n <\/a><\/noindex>
\nKuna meid huvitavad just hardware-based ACL, on meie jaoks esmat\u00e4htis sisemise Data Plane'i rakendamine ehk tegelikult kasutatavad kiibid (ASIC). K\u00f5ik Extreme Networks'i l\u00fclituste seeriad on \u00fcles ehitatud Broadcom'i ASIC-idele, seega enamik allpooltoodud teabest kehtib ka teiste turul saadaval olevate l\u00fclituste kohta, mis on rakendatud sellistele ASIC-idele.<\/p>\n

Nagu jooniselt n\u00e4ha, vastutavad ACL-i t\u00f6\u00f6 eest kiipide sees \"ContentAware Engine\", eraldi \"ingress\" ja \"egress\" kohta. Arhitektuurselt on nad identsed, ainult \"egress\" on v\u00e4hem skaleeritav ja v\u00e4hem funktsionaalne. F\u00fc\u00fcsiliselt on m\u00f5lemad \"ContentAware Engine\" TCAM-m\u00e4lu pluss kaasneva loogika kombinatsioon, ja iga kasutajale v\u00f5i s\u00fcsteemile m\u00e4\u00e4ratud ACL-reegel on lihtne bitmask, mis on salvestatud sellesse m\u00e4llu. Seet\u00f5ttu toimub kiibi poolt liikluse t\u00f6\u00f6tlemine pakettide kaupa ja ilma j\u00f5udluse languseta.<\/p>\n

F\u00fc\u00fcsiliselt jaguneb sama Ingress\/Egress TCAM loogiliselt mitmeks segmentiks (s\u00f5ltuvalt m\u00e4lu mahust ja platvormist), nn \u201cACL slices\u201d. N\u00e4iteks toimub sama ka f\u00fc\u00fcsiliselt \u00fche ja sama HDD puhul teie s\u00fclearvutis, kui loote sellel mitu loogilist ketast \u2013 C:>, D:>. Iga ACL-slice koosneb omakorda m\u00e4lu rakkudest, mis on kujundatud \"ridade\" kujul, kuhu salvestatakse \"rules\" (reeglid\/bitmaskid).<\/p>\n

\"L\u00fclitite
\nTCAM-i jagamine ACL-slice'ideks p\u00f5hineb kindlal loogikal. Igas eraldi ACL-slice'is v\u00f5ivad olla salvestatud ainult omavahel \u00fchilduvad \"rules\". Kui m\u00f5ni reegel ei \u00fchildu eelmisega, salvestatakse see j\u00e4rgmistesse ACL-slice'idesse, olenemata sellest, kui palju vabu ridu eelmisest j\u00e4\u00e4b \"rules\" k\u00f5igis eelnevalt. <\/p>\n

Kust tuleb siis see \u00fchilduvus v\u00f5i \u00fchilduvus puudumine ACL reeglite puhul? Asi on selles, et \u00fcks \"rida\" TCAM-is, kuhu kirjutatakse \"reeglid\", on 232 bit pikk ja jaguneb mitmeks v\u00e4liseks - Fixed, Field1, Field2, Field3. 232 bit v\u00f5i 29 byte TCAM m\u00e4lust on t\u00e4iesti piisav, et salvestada bit-mask teatud MAC v\u00f5i IP aadressi jaoks, kuid see on oluliselt v\u00e4hem kui t\u00e4is Etherneti paketi pealkiri. Igas eraldi ACL-slice'is toodab ASIC s\u00f5ltumatut otsingut, kasutades F1-F3 bit-mask-is m\u00e4\u00e4ratud. \u00dcldiselt v\u00f5ib see otsing toimuda esimestel 128 byte-l Etherneti pealkirjast. Just sellep\u00e4rast, et otsing v\u00f5ib toimuda 128 byte ulatuses, samas kui salvestada saab vaid 29 byte, peab korrektse otsingu tagamiseks olema m\u00e4\u00e4ratud nihke (offset) algusest paketi. Nihke m\u00e4\u00e4ratakse iga ACL-slice jaoks, kui sinna kirjutatakse esimene reegel, ja kui j\u00e4rgneva reegli kirjutamisel avastatakse vajadus teistsuguse nihke j\u00e4rele, peetakse sellist reeglit esimese suhtes \u00fchilduvaks ja kirjutatakse j\u00e4rgmisse ACL-slice'i.<\/p>\n

Allolevas tabelis on esitatud ACL-isse kirjutatud tingimuste \u00fchilduvuse j\u00e4rjekord. Iga eraldi rida sisaldab omavahel \u00fchilduvaid ja teiste ridadega \u00fchilduvaid bit-mask-e.<\/p>\n

\"L\u00fclitite
\nIga eraldi pakett, mida ASIC t\u00f6\u00f6deldakse, k\u00e4ivitab paralleelse otsingu igas ACL-slice'is. Kontroll toimub kuni esimese kokkusobivuseni ACL-slice'is, kuid samal ajal on lubatud mitu kokkusobivust \u00fche ja sama paketi puhul erinevates ACL-slice'ides. Igal eraldi \"reeglil\" on vastav tegevus, mida tuleb teha, kui tingimus (bit-mask) on t\u00e4idetud. Kui vastavus toimub kohe mitu ACL-slice'is, siis \"Action Conflict Resolution\" plokis vastavalt ACL-slice'i prioriteedile otsustatakse, milline tegevus ellu viia. Kui ACL-is on toodud nii \"action\" (permit\/deny) kui ka \"action-modifier\" (count\/QoS\/log\/\u2026), siis mitmete vastavuste korral viiakse ellu vaid prioriteetsem \"action\", kuid k\u00f5ik \u201caction-modifier\u2019id\u201d t\u00e4idetakse. Alloleval n\u00e4itel on n\u00e4idatud, et m\u00f5lemad loendurid suurenevad ja prioriteetsem \"deny\" teostatakse.<\/p>\n

\"L\u00fclitite
\n\"ACL Solutions Guide\"<\/a><\/noindex> rohkema teabe saamiseks ACL t\u00f6\u00f6 kohta on avatud juurdep\u00e4\u00e4s veebisaidil extremenetworks.com<\/a><\/noindex>. K\u00f5ik tekkinud v\u00f5i j\u00e4\u00e4vad k\u00fcsimused saab alati esitada meie kontori t\u00f6\u00f6tajatele - cis@extremenetworks.com<\/a><\/noindex>.
\n
Allikas: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

ACL (Access Control List) \u043d\u0430 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u044b \u043a\u0430\u043a \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e, \u0442\u0430\u043a \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e, \u0438\u043b\u0438 \u043f\u0440\u0438\u0432\u044b\u0447\u043d\u0435\u0439 \u0433\u043e\u0432\u043e\u0440\u044f hardware \u0438 software-based ACL. \u0418 \u0435\u0441\u043b\u0438 \u0441 software-based ACL \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u0442\u044c \u0432\u0441\u0451 \u043f\u043e\u043d\u044f\u0442\u043d\u043e, \u2014 \u044d\u0442\u043e \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0445\u0440\u0430\u043d\u044f\u0442\u0441\u044f \u0438 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u0432 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 (\u0442.\u0435. \u043d\u0430 Control Plane), \u0441\u043e \u0432\u0441\u0435\u043c\u0438 \u0432\u044b\u0442\u0435\u043a\u0430\u044e\u0449\u0438\u043c\u0438 \u043e\u0442\u0441\u044e\u0434\u0430 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f\u043c\u0438, \u0442\u043e \u043a\u0430\u043a \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u044b \u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-55847","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47L\u00fclitite ACL-id detailides | ProHoster","description":"ACL (Access Control List) v\u00f5rgusseadmetes saab rakendada nii riistvaraliselt kui ka tarkvaraliselt, v\u00f5i nagu tavaliselt \u00f6eldakse, hardware ja software-based ACL.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/acl-kommutatorov-v-detalyah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47ACL \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 \u0432 \u0434\u0435\u0442\u0430\u043b\u044f\u0445 | ProHoster","og:description":"ACL (Access Control List) \u043d\u0430 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u044b \u043a\u0430\u043a \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e, \u0442\u0430\u043a \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e, \u0438\u043b\u0438 \u043f\u0440\u0438\u0432\u044b\u0447\u043d\u0435\u0439 \u0433\u043e\u0432\u043e\u0440\u044f hardware \u0438 software-based ACL.","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/acl-kommutatorov-v-detalyah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-29T21:00:00+00:00","article:modified_time":"2020-02-18T11:04:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55847","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:35:41","updated":"2022-09-29 07:17:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/55847","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=55847"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/55847\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=55847"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=55847"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=55847"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}