{"id":55847,"date":"2020-01-30T00:00:00","date_gmt":"2020-01-29T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/acl-kommutatorov-v-detalyah"},"modified":"2020-02-18T14:04:00","modified_gmt":"2020-02-18T11:04:00","slug":"acl-kommutatorov-v-detalyah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/acl-kommutatorov-v-detalyah","title":{"rendered":"ACL-ul switch-urilor \u00een detaliu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

ACL (Lista de Control al Accesului) pe dispozitivele de re\u021bea pot fi implementate at\u00e2t hardware, c\u00e2t \u0219i software, sau mai bine zis, ACL bazate pe hardware \u0219i software. \u0218i dac\u0103 pentru ACL bazate pe software este clar \u2013 acestea sunt regulile stocate \u0219i procesate \u00een memoria RAM (adic\u0103 pe Control Plane), cu toate restric\u021biile care decurg din aceasta, vom analiza cum sunt implementate \u0219i func\u021bioneaz\u0103 ACL-urile bazate pe hardware \u00een articolul nostru. Ca exemplu, vom folosi switch-urile din seria ExtremeSwitching ale companiei Extreme Networks.<\/p>\n

\"ACL-ul
\n <\/a><\/noindex>
\nDat fiind c\u0103 ne intereseaz\u0103 \u00een mod special ACL-urile bazate pe hardware, este esen\u021bial pentru noi s\u0103 ne concentr\u0103m pe implementarea intern\u0103 a Data Plane-ului, sau a chipset-urilor utilizate (ASIC). Switch-urile din toate liniile companiei Extreme Networks sunt construite pe ASIC-uri de la Broadcom, a\u0219a c\u0103 majoritatea informa\u021biilor prezentate mai jos vor fi valabile \u0219i pentru alte switch-uri disponibile pe pia\u021b\u0103, construite pe acelea\u0219i ASIC-uri.<\/p>\n

Dup\u0103 cum se poate observa \u00een imaginea de mai sus, responsabilitatea direct\u0103 pentru func\u021bionarea ACL-ului \u00een chipset este a \u201eContentAware Engine\u201d, at\u00e2t pentru \u201eingress\u201d, c\u00e2t \u0219i pentru \u201eegress\u201d. Arhitectural, acestea sunt identice, doar c\u0103 \u201eegress\u201d este mai pu\u021bin scalabil \u0219i func\u021bional. Fizic, ambele \u201eContentAware Engine\u201d sunt memorie TCAM plus logica asociat\u0103, iar fiecare regul\u0103 ACL, fie ea utilizator sau sistem, este o simpl\u0103 masc\u0103 de bi\u021bi (bit-mask) stocat\u0103 \u00een aceast\u0103 memorie. De aceea, procesarea traficului de c\u0103tre chipset se face pe pachete, f\u0103r\u0103 degradarea performan\u021bei.<\/p>\n

Fizic, aceea\u0219i memorie Ingress\/Egress TCAM este \u00eemp\u0103r\u021bit\u0103 logic \u00een mai multe segmente (\u00een func\u021bie de cantitatea memoriei \u0219i de platform\u0103), numite \u201eACL slices\u201d. De exemplu, acela\u0219i lucru se \u00eent\u00e2mpl\u0103 cu HDD-ul fizic de pe laptopul dumneavoastr\u0103, atunci c\u00e2nd crea\u021bi pe el mai multe discuri logice \u2013 C:>, D:>. Fiecare ACL-slice const\u0103 la r\u00e2ndul s\u0103u din celule de memorie, sub form\u0103 de \u201er\u00e2nduri\u201d unde sunt scrise \u201erules\u201d (reguli\/masci de bi\u021bi).<\/p>\n

\"ACL-ul
\n\u00cemp\u0103r\u021birea TCAM \u00een ACL-slices are o logic\u0103 specific\u0103. \u00cen fiecare ACL-slice separat pot fi scrise doar \u201erules\u201d compatibile \u00eentre ele. Dac\u0103 o \u201erule\u201d nu este compatibil\u0103 cu precedentul, va fi scris\u0103 \u00een urm\u0103torul ACL-slice, indiferent de c\u00e2te r\u00e2nduri libere pentru \u201erules\u201d mai r\u0103m\u00e2n \u00een anteriorul. <\/p>\n

De unde apare, a\u0219adar, aceast\u0103 compatibilitate sau incompatibilitate a regulilor ACL? Problema este c\u0103 o \"linie\" TCAM, \u00een care sunt stocate \"regulile\", are o lungime de 232 bit \u0219i este \u00eemp\u0103r\u021bit\u0103 \u00een mai multe c\u00e2mpuri \u2013 Fixed, Field1, Field2, Field3. 232 bit sau 29 byte de memorie TCAM sunt suficien\u021bi pentru a stoca o masc\u0103 de bit a unui anumit MAC sau IP, dar mult mai pu\u021bin dec\u00e2t \u00eentreaga antet al pachetului Ethernet. \u00cen fiecare ACL-slice, ASIC realizeaz\u0103 o c\u0103utare independent\u0103 \u00een baza m\u0103\u0219tii de bi\u021bi stabilite \u00een F1-F3. \u00cen general, aceast\u0103 c\u0103utare poate fi efectuat\u0103 pe primii 128 bytes ai antetului Ethernet. \u00cen esen\u021b\u0103, tocmai din cauza faptului c\u0103 c\u0103utarea poate fi efectuat\u0103 pe 128 bytes, \u00een timp ce se pot stoca doar 29 bytes, pentru o c\u0103utare corect\u0103 trebuie s\u0103 fie stabilit un offset relativ la \u00eenceputul pachetului. Offset-ul pentru fiecare ACL-slice este stabilit \u00een momentul \u00een care se scrie prima regul\u0103, iar dac\u0103 la scrierea urm\u0103toarei reguli se constat\u0103 necesitatea unui alt offset, acea regul\u0103 este considerat\u0103 incompatibil\u0103 cu prima \u0219i este scris\u0103 \u00een urm\u0103torul ACL-slice.<\/p>\n

\u00cen tabelul de mai jos este prezentat\u0103 ordinea compatibilit\u0103\u021bii condi\u021biilor stipulate \u00een ACL. Fiecare linie con\u021bine m\u0103\u0219ti de bi\u021bi care sunt compatibile \u00eentre ele \u0219i m\u0103\u0219ti de bi\u021bi care nu sunt compatibile cu alte linii.<\/p>\n

\"ACL-ul
\nFiecare pachet procesat de ASIC ini\u021biaz\u0103 o c\u0103utare paralel\u0103 \u00een fiecare ACL-slice. Verificarea se efectueaz\u0103 p\u00e2n\u0103 la prima potrivire \u00een ACL-slice, \u00eens\u0103 este permis\u0103 \u0219i multiple potriviri pentru acela\u0219i pachet \u00een diferite ACL-slice. Fiecare regul\u0103 are o ac\u021biune corespunz\u0103toare care trebuie realizat\u0103 \u00een cazul unei potriviri a condi\u021biei (masc\u0103 de bi\u021bi). Dac\u0103 potrivirea a avut loc simultan \u00een mai multe ACL-slice, blocul \"Rezolvarea conflictelor de ac\u021biune\" va decide, pe baza priorit\u0103\u021bii ACL-slice, care ac\u021biune trebuie executat\u0103. Dac\u0103 \u00een ACL este definit\u0103 at\u00e2t o \"ac\u021biune\" (permit\/deny), c\u00e2t \u0219i un \"modificator de ac\u021biune\" (count\/QoS\/log\/\u2026), atunci \u00een cazul potrivirilor multiple se va executa doar ac\u021biunea de prioritate mai mare, \u00eens\u0103 toate modificatoarele de ac\u021biune vor fi realizate. \u00cen exemplul de mai jos se arat\u0103 c\u0103 ambele contoare vor fi incrementate \u0219i se va executa ac\u021biunea de deny cu prioritate mai mare.<\/p>\n

\"ACL-ul
\n\"Ghidul solu\u021biilor ACL\"<\/a><\/noindex> cu informa\u021bii mai detaliate despre func\u021bionarea ACL, disponibile pe site-ul extremenetworks.com<\/a><\/noindex>. Orice \u00eentreb\u0103ri ap\u0103rute sau r\u0103mase pot fi adresate \u00eentotdeauna angaja\u021bilor biroului nostru \u2013 cis@extremenetworks.com<\/a><\/noindex>.
\n
Sursa: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

ACL (Access Control List) \u043d\u0430 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u044b \u043a\u0430\u043a \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e, \u0442\u0430\u043a \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e, \u0438\u043b\u0438 \u043f\u0440\u0438\u0432\u044b\u0447\u043d\u0435\u0439 \u0433\u043e\u0432\u043e\u0440\u044f hardware \u0438 software-based ACL. \u0418 \u0435\u0441\u043b\u0438 \u0441 software-based ACL \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u0442\u044c \u0432\u0441\u0451 \u043f\u043e\u043d\u044f\u0442\u043d\u043e, \u2014 \u044d\u0442\u043e \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0445\u0440\u0430\u043d\u044f\u0442\u0441\u044f \u0438 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u0432 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 (\u0442.\u0435. \u043d\u0430 Control Plane), \u0441\u043e \u0432\u0441\u0435\u043c\u0438 \u0432\u044b\u0442\u0435\u043a\u0430\u044e\u0449\u0438\u043c\u0438 \u043e\u0442\u0441\u044e\u0434\u0430 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f\u043c\u0438, \u0442\u043e \u043a\u0430\u043a \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u044b \u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-55847","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Detalii despre ACL-urile switch-urilor | ProHoster","description":"ACL (Lista de Control al Acces) pe dispozitivele de re\u021bea pot fi implementate at\u00e2t hardware, c\u00e2t \u0219i software, sau, cum ne este mai familiar, ACL bazate pe hardware \u0219i software.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/acl-kommutatorov-v-detalyah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47ACL \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 \u0432 \u0434\u0435\u0442\u0430\u043b\u044f\u0445 | ProHoster","og:description":"ACL (Access Control List) \u043d\u0430 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u044b \u043a\u0430\u043a \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e, \u0442\u0430\u043a \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e, \u0438\u043b\u0438 \u043f\u0440\u0438\u0432\u044b\u0447\u043d\u0435\u0439 \u0433\u043e\u0432\u043e\u0440\u044f hardware \u0438 software-based ACL.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/acl-kommutatorov-v-detalyah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-29T21:00:00+00:00","article:modified_time":"2020-02-18T11:04:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55847","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:35:41","updated":"2022-09-29 07:17:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/55847","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=55847"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/55847\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=55847"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=55847"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=55847"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}