{"id":55847,"date":"2020-01-30T00:00:00","date_gmt":"2020-01-29T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/acl-kommutatorov-v-detalyah"},"modified":"2020-02-18T14:04:00","modified_gmt":"2020-02-18T11:04:00","slug":"acl-kommutatorov-v-detalyah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/acl-kommutatorov-v-detalyah","title":{"rendered":"ACL l\u00fclitite \u00fcksikasjad","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

ACL (Access Control List) suudavad v\u00f5rgu seadmetes olla realiseeritud nii riistvara kui ka tarkvara kaudu, v\u00f5i nagu tavatsetud \u00f6elda, hardware ja software-based ACL. Ja kui tarkvara-p\u00f5histe ACL-ide puhul peaks k\u00f5ik selge olema \u2014 need on reeglid, mis salvestatakse ja t\u00f6\u00f6deldakse muutm\u00e4\u00e4ras (st Control Plane'is), koos k\u00f5igi sellega kaasnevate piirangutega, siis uurime, kuidas riistvara-p\u00f5hised ACL-id on realiseeritud ja toimivad meie artiklis. N\u00e4iteks kasutatakse Extreme Networks'i ExtremeSwitching seeria l\u00fcliteid.<\/p>\n

\"ACL
\n <\/a><\/noindex>
\nKuna meid huvitavad eelk\u00f5ige riistvara-p\u00f5hised ACL-id, on meie jaoks \u00e4\u00e4rmiselt oluline just Data Plane'i sisemine rakendus v\u00f5i kasutatavad kiibid (ASIC). K\u00f5ik Extreme Networks'i l\u00fclitusliinid p\u00f5hinevad Broadcom'i ASIC-del, seet\u00f5ttu kehtib enamik alltoodud teabest ka teiste turul esindatud, samade ASIC-dega realiseeritud l\u00fclitite kohta.<\/p>\n

\u041a\u0430\u043a \u0432\u0438\u0434\u043d\u043e \u0438\u0437 \u0440\u0438\u0441\u0443\u043d\u043a\u0430 \u0432\u044b\u0448\u0435 \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0437\u0430 \u0440\u0430\u0431\u043e\u0442\u0443 ACL \u0432 \u0447\u0438\u043f\u0441\u0435\u0442\u0435 \u043e\u0442\u0432\u0435\u0447\u0430\u044e\u0442 \u201cContentAware Engine\u201d, \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e \u043d\u0430 \u201cingress\u201d \u0438 \u201cegress\u201d. \u0410\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u043e \u043e\u043d\u0438 \u043e\u0434\u0438\u043d\u0430\u043a\u043e\u0432\u044b, \u0442\u043e\u043b\u044c\u043a\u043e \u201cegress\u201d \u043c\u0435\u043d\u0435\u0435 \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u0438\u0440\u0443\u0435\u043c\u044b\u0439, \u0438 \u043c\u0435\u043d\u0435\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0439. \u0424\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u0438 \u0436\u0435 \u043e\u0431\u0430 \u201cContentAware Engine\u201d \u044d\u0442\u043e TCAM \u043f\u0430\u043c\u044f\u0442\u044c \u043f\u043b\u044e\u0441 \u0441\u043e\u043f\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0430\u044f \u043b\u043e\u0433\u0438\u043a\u0430, \u0430 \u043a\u0430\u0436\u0434\u043e\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0435 \u0438\u043b\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u043e ACL \u044d\u0442\u043e \u043f\u0440\u043e\u0441\u0442\u0430\u044f \u0431\u0438\u0442 \u043c\u0430\u0441\u043a\u0430 (bit-mask) \u0437\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u0430\u044f \u0432 \u044d\u0442\u0443 \u043f\u0430\u043c\u044f\u0442\u044c. \u0418\u043c\u0435\u043d\u043d\u043e \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0430 \u0447\u0438\u043f\u0441\u0435\u0442\u043e\u043c \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u043f\u0430\u043a\u0435\u0442\u043d\u043e \u0438 \u0431\u0435\u0437 \u0434\u0435\u0433\u0440\u0430\u0434\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438.<\/p>\n

\u0424\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u0438 \u043e\u0434\u043d\u0430 \u0438 \u0442\u0430 \u0436\u0435 Ingress\/Egress TCAM \u0432 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u0434\u0435\u043b\u0438\u0442\u0441\u044f \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u043e\u0432 (\u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u0441\u0430\u043c\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 \u0438 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b), \u0442\u0430\u043a \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u043c\u044b\u0435 \u201cACL slices\u201d. \u041a \u043f\u0440\u0438\u043c\u0435\u0440\u0443, \u0442\u043e\u0436\u0435 \u0441\u0430\u043c\u043e\u0435 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0441 \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u0438 \u043e\u0434\u043d\u0438\u043c \u0438 \u0442\u0435\u043c \u0436\u0435 HDD \u043d\u0430 \u0432\u0430\u0448\u0435\u043c \u043d\u043e\u0443\u0442\u0431\u0443\u043a\u0435, \u043a\u043e\u0433\u0434\u0430 \u0432\u044b \u0441\u043e\u0437\u0434\u0430\u0435\u0442\u0435 \u043d\u0430 \u043d\u0451\u043c \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0434\u0438\u0441\u043a\u043e\u0432 \u2013 \u0421:>, D:>. \u041a\u0430\u0436\u0434\u044b\u0439 ACL-slice \u0432 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 \u044f\u0447\u0435\u0435\u043a \u043f\u0430\u043c\u044f\u0442\u0438, \u0432 \u0432\u0438\u0434\u0435 \u201c\u0441\u0442\u0440\u043e\u043a\u201d \u043a\u0443\u0434\u0430 \u0438 \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442\u044c\u0441\u044f \u201crules\u201d (\u043f\u0440\u0430\u0432\u0438\u043b\u0430\/\u0431\u0438\u0442-\u043c\u0430\u0441\u043a\u0438).<\/p>\n

\"ACL
\nTCAM-i jagamine ACL-slice'ideks j\u00e4rgib kindlat loogikat. Igas eraldi ACL-slice'is v\u00f5ivad olla kirjutatud ainult omavahel \u00fchilduvad \"reeglid\". Kui m\u00f5ni \"reegel\" ei ole eelneva reegliga \u00fchilduv, kirjutatakse see j\u00e4rgmisse ACL-slice'i, s\u00f5ltumata sellest, mitu vabade rida eelnevas \"reeglite\" osas veel on. <\/p>\n

Kust aga tuleneb see ACL reeglite \u00fchilduvus v\u00f5i \u00fchilduvus? Asi on selles, et \u00fches \"rea\" TCAM-is, kuhu salvestatakse \"reeglid\", on pikkus 232 bitti ja see jaguneb mitmeks v\u00e4ljadeks \u2013 Fixed, Field1, Field2, Field3. 232 bitti ehk 29 baiti TCAM-m\u00e4lust on t\u00e4iesti piisav, et salvestada teatud MAC v\u00f5i IP-aadressi bitmask, kuid see on oluliselt v\u00e4iksem kui t\u00e4ielik Etherneti paketi pealkiri. Igas eraldi ACL-slices toodab ASIC s\u00f5ltumatut otsingut F1-F3 bitmaskidesse seadistatud seadistuste p\u00f5hjal. \u00dcldiselt v\u00f5ib see otsing toimuda esialgsete 128 baiti Etherneti pealkirja j\u00e4rgi. Tegelikult ongi probleem selles, et otsing v\u00f5ib toimuda 128 baitide ulatuses, samas kui salvestatud v\u00f5ib olla vaid 29 baiti, seet\u00f5ttu peab \u00f5igeks otsinguks olema seadistatud nihke (offset) asukoht paketi algusest. Iga ACL-slice jaoks seadistatakse offset esimeses reeglis salvestamise ajal, ja kui j\u00e4rgmise reegli salvestamise ajal avastatakse vajadus teise offseti j\u00e4rele, siis loetakse selline reegel esimesele mitte\u00fchilduvaks ja salvestatakse j\u00e4rgmisse ACL-slice'i.<\/p>\n

Allpool on toodud ACL-i tingimuste \u00fchilduvuse tabel. Iga rida sisaldab omavahel \u00fchilduvaid ja teiste ridadega \u00fchildumatuid bit-mask'e.<\/p>\n

\"ACL
\nIga eraldi pakett, mida ASIC t\u00f6\u00f6delda, k\u00e4ivitab iga ACL-slice'i jaoks paralleelse otsingu. Kontrollimine toimub kuni esimese vastavuseni ACL-slice'is, kuid sama paketi puhul on lubatud mitmekordne vastavus erinevates ACL-slice'ides. Iga eraldi 'reegel' sisaldab vastavat toimingut, mida tuleb t\u00e4ita, kui tingimus (bit-mask) on t\u00e4idetud. Kui vastavus toimub mitmes ACL-slice'is, siis 'Action Conflict Resolution' plokis, ACL-slice'i prioriteedi p\u00f5hjal, otsustatakse, millist tegevust teostada. Kui ACL-is on m\u00e4\u00e4ratud nii 'action' (lubamine\/keelamine) kui ka 'action-modifier' (arvuta\/QoS\/logi\/...), siis mitmekordsete vastavuste korral t\u00e4idetakse ainult k\u00f5rgema prioriteediga 'action', samas k\u00f5ik 'action-modifier'id t\u00e4idetakse. Allolev n\u00e4ide n\u00e4itab, et m\u00f5lemad loendurid suurenevad ja toimub k\u00f5rgema prioriteediga 'keelamine'.<\/p>\n

\"ACL
\n\u201cACL Solutions Guide\u201d<\/a><\/noindex> detsember 2023 kohta t\u00e4iendava teabega ACL-i toimimise kohta on avalikult saadaval veebis extremenetworks.com<\/a><\/noindex>. Kui teil on k\u00fcsimusi v\u00f5i muresid, v\u00f5ite alati meie kontori t\u00f6\u00f6tajatele p\u00f6\u00f6rduda \u2013 cis@extremenetworks.com<\/a><\/noindex>.
\n
Allikas: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

ACL (Access Control List) \u043d\u0430 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u044b \u043a\u0430\u043a \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e, \u0442\u0430\u043a \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e, \u0438\u043b\u0438 \u043f\u0440\u0438\u0432\u044b\u0447\u043d\u0435\u0439 \u0433\u043e\u0432\u043e\u0440\u044f hardware \u0438 software-based ACL. \u0418 \u0435\u0441\u043b\u0438 \u0441 software-based ACL \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u0442\u044c \u0432\u0441\u0451 \u043f\u043e\u043d\u044f\u0442\u043d\u043e, \u2014 \u044d\u0442\u043e \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0445\u0440\u0430\u043d\u044f\u0442\u0441\u044f \u0438 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u0432 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 (\u0442.\u0435. \u043d\u0430 Control Plane), \u0441\u043e \u0432\u0441\u0435\u043c\u0438 \u0432\u044b\u0442\u0435\u043a\u0430\u044e\u0449\u0438\u043c\u0438 \u043e\u0442\u0441\u044e\u0434\u0430 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f\u043c\u0438, \u0442\u043e \u043a\u0430\u043a \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u044b \u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-55847","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47ACL l\u00fclitite \u00fcksikasjad | ProHoster","description":"ACL (Access Control List) v\u00f5rguseadmetes v\u00f5ivad olla rakendatud nii riistvaraliselt kui ka tarkvaraliselt, v\u00f5i tavaliselt \u00f6eldes hardware ja software-based ACL. Ja kui tarkvaraliste ACL-ide kohta on k\u00f5ik arusaadav \u2013 need on reeglid, mis salvestatakse ja t\u00f6\u00f6deldakse vahem\u00e4lus (st Control Plane'is), koos k\u00f5igi sellega seotud piirangutega, siis kuidas on rakendatud ja t\u00f6\u00f6tavad","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/acl-kommutatorov-v-detalyah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47ACL \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 \u0432 \u0434\u0435\u0442\u0430\u043b\u044f\u0445 | ProHoster","og:description":"ACL (Access Control List) \u043d\u0430 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u044b \u043a\u0430\u043a \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e, \u0442\u0430\u043a \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e, \u0438\u043b\u0438 \u043f\u0440\u0438\u0432\u044b\u0447\u043d\u0435\u0439 \u0433\u043e\u0432\u043e\u0440\u044f hardware \u0438 software-based ACL. \u0418 \u0435\u0441\u043b\u0438 \u0441 software-based ACL \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u0442\u044c \u0432\u0441\u0451 \u043f\u043e\u043d\u044f\u0442\u043d\u043e, \u2014 \u044d\u0442\u043e \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0445\u0440\u0430\u043d\u044f\u0442\u0441\u044f \u0438 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u0432 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 (\u0442.\u0435. \u043d\u0430 Control Plane), \u0441\u043e \u0432\u0441\u0435\u043c\u0438 \u0432\u044b\u0442\u0435\u043a\u0430\u044e\u0449\u0438\u043c\u0438 \u043e\u0442\u0441\u044e\u0434\u0430 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f\u043c\u0438, \u0442\u043e \u043a\u0430\u043a \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u044b \u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/acl-kommutatorov-v-detalyah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-29T21:00:00+00:00","article:modified_time":"2020-02-18T11:04:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55847","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:35:41","updated":"2022-09-29 07:17:30"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/55847","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=55847"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/55847\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=55847"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=55847"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=55847"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}