{"id":55847,"date":"2020-01-30T00:00:00","date_gmt":"2020-01-29T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/acl-kommutatorov-v-detalyah"},"modified":"2020-02-18T14:04:00","modified_gmt":"2020-02-18T11:04:00","slug":"acl-kommutatorov-v-detalyah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/acl-kommutatorov-v-detalyah","title":{"rendered":"ACL sl\u0113dz\u0113jiem deta\u013c\u0101s","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

ACL (Access Control List) t\u012bklos var tikt \u012bstenota gan aparat\u016bras, gan programmat\u016bras veid\u0101, vai, vienk\u0101r\u0161\u0101k sakot, hardware un software-based ACL. Un, ja software-based ACL ir saprotams k\u0101 noteikumi, kas tiek glab\u0101ti un apstr\u0101d\u0101ti operat\u012bvaj\u0101 atmi\u0146\u0101 (t.i., Control Plane), ar vis\u0101m no t\u0101 izrieto\u0161aj\u0101m ierobe\u017eojumiem, tad k\u0101 tiek \u012bstenoti un darbojas hardware-based ACL, to m\u0113s izp\u0113t\u012bsim m\u016bsu rakst\u0101. Par piem\u0113ru \u0146emsim Extreme Networks korpor\u0101cijas ExtremeSwitching s\u0113rijas sl\u0113d\u017eus.<\/p>\n

\"ACL
\n <\/a><\/noindex>
\n\u0145emot v\u0113r\u0101, ka m\u016bs interes\u0113 tie\u0161i hardware-based ACL, mums ir svar\u012bga iek\u0161\u0113j\u0101 Data Plane realiz\u0101cija, jeb faktiski izmantotie \u010dipseti (ASIC). Visu Extreme Networks sl\u0113d\u017eu s\u0113riju pamat\u0101 ir Broadcom ASIC, un t\u0101d\u0113\u013c liel\u0101k\u0101 da\u013ca no zem\u0101k nor\u0101d\u012bt\u0101s inform\u0101cijas b\u016bs attiecin\u0101ma ar\u012b uz citiem tirg\u016b pieejamajiem sl\u0113d\u017eiem, kas balst\u0101s uz t\u0101diem pa\u0161iem ASIC.<\/p>\n

K\u0101 redzams iepriek\u0161\u0113j\u0101 att\u0113l\u0101, tie\u0161i par ACL darb\u012bbu \u010dipset\u0101 atbild \u201cContentAware Engine\u201d, kas atsevi\u0161\u0137i darbojas uz \u201cingress\u201d un \u201cegress\u201d. Arhitekt\u016bra ir identiska, tikai \u201cegress\u201d ir maz\u0101k m\u0113rogojams un maz\u0101k funkcion\u0101ls. Fiziski abi \u201cContentAware Engine\u201d ir TCAM atmi\u0146a plus attiec\u012bg\u0101 lo\u0123ika, un katrs lietot\u0101ja vai sist\u0113mas ACL noteikums ir vienk\u0101r\u0161a bitu maska (bit-mask), kas ierakst\u012bta \u0161aj\u0101 atmi\u0146\u0101. T\u0101d\u0113\u013c \u010dipsets veic trafika apstr\u0101di pa pakotn\u0113m un bez veiktsp\u0113jas pasliktin\u0101\u0161an\u0101s.<\/p>\n

Fiziski viena un t\u0101 pati Ingress\/Egress TCAM savuk\u0101rt tiek lo\u0123iski sadal\u012bta vair\u0101kos segmentos (atkar\u012bb\u0101 no atmi\u0146as apjoma un platformas), t\u0101 sauktajos \u201cACL slices\u201d. Piem\u0113ram, tie\u0161i t\u0101pat notiek ar fiziski vienu un to pa\u0161u HDD j\u016bsu kl\u0113pjdator\u0101, kad j\u016bs izveidojat uz t\u0101 vair\u0101kus lo\u0123iskos diskus \u2013 C:>, D:>. Katrs ACL-slice sast\u0101v, savuk\u0101rt, no atmi\u0146as \u0161\u016bn\u0101m, kas ir \u201crind\u0101s\u201d, kur\u0101s tiek ierakst\u012bti \u201crules\u201d (noteikumi\/bitu maskas).<\/p>\n

\"ACL
\nTCAM sadal\u012bjums ACL-slices pamatojas noteikt\u0101 lo\u0123ik\u0101. Katram atsevi\u0161\u0137ajam ACL-slice var tikt ierakst\u012bti tikai savstarp\u0113ji sader\u012bgi \u201crules\u201d. Ja k\u0101ds no \u201crules\u201d nav sader\u012bgs ar iepriek\u0161\u0113jo, tas tiks ierakst\u012bts n\u0101kamaj\u0101 ACL-slice, neatkar\u012bgi no t\u0101, cik br\u012bvas rindas v\u0113l paliku\u0161as iepriek\u0161\u0113j\u0101. <\/p>\n

K\u0101 tad rastos \u0161\u012b ACL noteikumu sader\u012bba vai nesader\u012bba? Probl\u0113ma ir t\u0101da, ka viena \u201drinda\u201d TCAM, kur\u0101 tiek ierakst\u012bti \u201dnoteikumi\u201d, ir 232 bitu gara un tiek sadal\u012bta vair\u0101k\u0101s laukos \u2013 Fixed, Field1, Field2, Field3. 232 bitu vai 29 baitus TCAM atmi\u0146as ir pietiekami, lai ierakst\u012btu noteikta MAC vai IP adreses bitu masku, bet iev\u0113rojami maz\u0101k nek\u0101 pilns Ethernet paketes virsraksts. Katrs atsevi\u0161\u0137ais ACL slices ASIC veic neatkar\u012bgu mekl\u0113\u0161anu p\u0113c F1-F3 bitu mask\u0101 noteikto. Kopum\u0101 \u0161is mekl\u0113jums var tikt veikts pa pirmajiem 128 baitiem Ethernet virsraksta. Faktiski tie\u0161i t\u0101p\u0113c, ka mekl\u0113\u0161ana var tikt veikta pa 128 baitiem, bet ierakst\u012bts var b\u016bt tikai 29 baitus, pareizam mekl\u0113jumam ir j\u0101b\u016bt noteiktam nob\u012bdei attiec\u012bb\u0101 uz paketes s\u0101kumu. Nob\u012bde katram ACL-slice tiek noteikta, ierakstot pirmo noteikumu, un, ja ierakstot n\u0101kamo noteikumu tiek konstat\u0113ta nepiecie\u0161am\u012bba p\u0113c cita nob\u012bdes, tad \u0161\u0101ds noteikums tiek uzskat\u012bts par nesader\u012bgu ar pirmo un tiek ierakst\u012bts n\u0101kamaj\u0101 ACL-slice.<\/p>\n

Zem\u0101k eso\u0161aj\u0101 tabul\u0101 ir nor\u0101d\u012bts nosac\u012bjumu sader\u012bbas sec\u012bba, kas tiek ierakst\u012bta ACL. Katrs atsevi\u0161\u0137s rinda satur savstarp\u0113ji sader\u012bgas un savstarp\u0113ji nesader\u012bgas bitu maskas, kas tiek veidotas starp cit\u0101m rind\u0101m.<\/p>\n

\"ACL
\nKatrs atsevi\u0161\u0137ais pakets, ko apstr\u0101d\u0101 ASIC, uzs\u0101k paral\u0113lu mekl\u0113\u0161anu katr\u0101 ACL-slice. P\u0101rbaude tiek veikta l\u012bdz pirmajai sakrit\u012bbai ACL-slice, bet taj\u0101 pa\u0161\u0101 laik\u0101 ir at\u013cauta vair\u0101ku sakrit\u012bbu esam\u012bba vienam un tam pa\u0161am paketam da\u017e\u0101dos ACL slices. Katram atsevi\u0161\u0137am \u201cnoteikumam\u201d ir attiec\u012bg\u0101 darb\u012bba, kas j\u0101veic sakrit\u012bbas gad\u012bjum\u0101 (bitu maska). Ja sakrit\u012bba notiek vienlaic\u012bgi vair\u0101kos ACL-slices, tad \u201cDarb\u012bbu konfliktu atrisin\u0101\u0161anas\u201d blok\u0101, pamatojoties uz ACL-slice priorit\u0101ti, tiek pie\u0146emts l\u0113mums, kura no darb\u012bb\u0101m j\u0101veic. Ja ACL ir nor\u0101d\u012bta gan \u201cdarb\u012bba\u201d (at\u013caut\/atteikt), gan \u201cdarb\u012bbas modifikators\u201d (skait\u012bt\/QoS\/iespiedumu\/\u2026), tad, ja ir vair\u0101kas sakrit\u012bbas, tiek veikta tikai priorit\u0101r\u0101ka \u201cdarb\u012bba\u201d, bet visi \u201cdarb\u012bbas modifikatori\u201d tiks veikti. Zem\u0101k redzamaj\u0101 piem\u0113r\u0101 tiks palielin\u0101ti abi skait\u012bt\u0101ji un tiks veikta priorit\u0101r\u0101ka \u201catteikt\u201d.<\/p>\n

\"ACL
\n\u201cACL risin\u0101jumu ce\u013cvedis\u201d<\/a><\/noindex> ar detaliz\u0113t\u0101ku inform\u0101ciju par ACL darb\u012bbu ir pieejama atkl\u0101ti m\u0101jaslap\u0101 extremenetworks.com<\/a><\/noindex>. Jebkurus radu\u0161os vai paliku\u0161os jaut\u0101jumus vienm\u0113r var uzdot m\u016bsu biroja darbiniekiem \u2013 cis@extremenetworks.com<\/a><\/noindex>.
\n
Avots: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

ACL (Access Control List) \u043d\u0430 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u044b \u043a\u0430\u043a \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e, \u0442\u0430\u043a \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e, \u0438\u043b\u0438 \u043f\u0440\u0438\u0432\u044b\u0447\u043d\u0435\u0439 \u0433\u043e\u0432\u043e\u0440\u044f hardware \u0438 software-based ACL. \u0418 \u0435\u0441\u043b\u0438 \u0441 software-based ACL \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u0442\u044c \u0432\u0441\u0451 \u043f\u043e\u043d\u044f\u0442\u043d\u043e, \u2014 \u044d\u0442\u043e \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0445\u0440\u0430\u043d\u044f\u0442\u0441\u044f \u0438 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u0432 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 (\u0442.\u0435. \u043d\u0430 Control Plane), \u0441\u043e \u0432\u0441\u0435\u043c\u0438 \u0432\u044b\u0442\u0435\u043a\u0430\u044e\u0449\u0438\u043c\u0438 \u043e\u0442\u0441\u044e\u0434\u0430 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f\u043c\u0438, \u0442\u043e \u043a\u0430\u043a \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u044b \u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-55847","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47ACL sl\u0113d\u017eu deta\u013cas | ProHoster","description":"ACL (Access Control List) t\u012bkliek\u0101rt\u0101s var tikt \u012bstenots gan aparat\u016bras, gan programmat\u016bras veid\u0101, vai, k\u0101 bie\u017ei saka, hardware un software-based ACL.","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/acl-kommutatorov-v-detalyah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47ACL \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 \u0432 \u0434\u0435\u0442\u0430\u043b\u044f\u0445 | ProHoster","og:description":"ACL (Access Control List) \u043d\u0430 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u044b \u043a\u0430\u043a \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e, \u0442\u0430\u043a \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e, \u0438\u043b\u0438 \u043f\u0440\u0438\u0432\u044b\u0447\u043d\u0435\u0439 \u0433\u043e\u0432\u043e\u0440\u044f hardware \u0438 software-based ACL.","og:url":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/acl-kommutatorov-v-detalyah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-29T21:00:00+00:00","article:modified_time":"2020-02-18T11:04:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55847","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:35:41","updated":"2022-09-29 07:17:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/55847","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=55847"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/55847\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=55847"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=55847"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=55847"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}