{"id":55847,"date":"2020-01-30T00:00:00","date_gmt":"2020-01-29T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/acl-kommutatorov-v-detalyah"},"modified":"2020-02-18T14:04:00","modified_gmt":"2020-02-18T11:04:00","slug":"acl-kommutatorov-v-detalyah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/acl-kommutatorov-v-detalyah","title":{"rendered":"Podrobnosti o ACL switchov","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

ACL (Seznam za nadzor dostopa) na omre\u017enih napravah je mogo\u010de implementirati tako strojno kot programsko, ali pa re\u010deno druga\u010de, kot hardware in software-based ACL. In \u010de je pri software-based ACL vse jasno \u2014 to so pravila, ki se shranjujejo in obdelujejo v pomnilniku (tj. na kontrolnem nivoju), skupaj z vsemi omejitvami, ki iz tega izhajajo, se bomo v na\u0161em \u010dlanku osredoto\u010dili na to, kako so implementirani in kako delujejo hardware-based ACL. Kot primer bomo uporabili stikala serije ExtremeSwitching podjetja Extreme Networks.<\/p>\n

\"Podrobnosti
\n <\/a><\/noindex>
\nKer nas zanima predvsem hardware-based ACL, je za nas najpomembnej\u0161a notranja implementacija podatkovnega nivoja, oziroma konkretno uporabljenih \u010dipov (ASIC). Stikala vseh serij podjetja Extreme Networks temeljijo na ASIC \u010dipih podjetja Broadcom, zato bo ve\u010dina spodaj navedenih informacij veljavna tudi za druga stikala, ki so na trgu in so implementirana na podobnih ASIC.<\/p>\n

Kot je razvidno iz zgornje slike, za delovanje ACL v \u010dipu skrbijo \"Content-Aware Engine\", lo\u010deno na \"ingress\" in \"egress\". Arhitekturno sta si podobna, le da je \"egress\" manj raz\u0161irljiv in manj funkcionalen. Fizi\u010dno pa sta oba \"Content-Aware Engine\" TCAM pomnilnik plus pripadajo\u010da logika, vsako uporabni\u0161ko ali sistemsko pravilo ACL pa je preprosta bitna maska (bit-mask), zapisana v to pomnilnik. Zato \u010dip obdeluje promet paket po paket, brez zmanj\u0161anja zmogljivosti.<\/p>\n

Fizi\u010dno ista Ingress\/Egress TCAM se logi\u010dno deli na ve\u010d segmentov (odvisno od koli\u010dine samega pomnilnika in platforme), tako imenovane \"ACL slices\". Na primer, enako se dogaja s fizi\u010dno enim in istim trdim diskom (HDD) v va\u0161em prenosniku, ko ustvarite ve\u010d logi\u010dnih diskov \u2013 C:>, D:>. Vsak ACL-slice pa je sestavljen iz spomina, v obliki \"vrst\", kjer se zapisujejo \"rules\" (pravila\/bitne maske).<\/p>\n

\"Podrobnosti
\nRazdelitev TCAM na ACL-slices ima dolo\u010deno logiko. V vsakem od lo\u010denih ACL-slice se lahko zapi\u0161ejo le med sabo zdru\u017eljiva \"rules\". \u010ce je katero od \"rules\" nezdru\u017eljivo s predhodnim, se bo zapisalo v naslednji po vrsti ACL-slice, ne glede na to, koliko prostih vrstic za \"rules\" je ostalo v prej\u0161njem. <\/p>\n

Kje torej izvira ta zdru\u017eljivost ali nezdru\u017eljivost pravil ACL? Dejstvo je, da ima ena \"vrstica\" TCAM, kjer so zapisani \"pravila\", dol\u017eino 232 bit in je razdeljena na ve\u010d polj \u2013 Fixed, Field1, Field2, Field3. 232 bit ali 29 byte TCAM pomnilnika je povsem dovolj za zapis bit-maske dolo\u010denega MAC ali IP naslova, vendar je bistveno manj od celotne glave Ethernet paketa. V vsakem posameznem ACL-slicu ASIC izvaja neodvisno iskanje po nastavljeni bit-maski v F1-F3. Na splo\u0161no pa se to iskanje lahko izvede po prvih 128 byteih Ethernet glave. Pravzaprav je prav zaradi tega, ker se lahko iskanje izvede po 128 byteh, zapisano pa je lahko le 29 byte, za pravilno iskanje treba nastaviti odklon (offset) v razmerju do za\u010detka paketa. Offset za vsak ACL-slice se nastavi med zapisom prvega pravila, in \u010de pri zapisovanju naslednjega pravila pride do potrebe po drugem offsetu, se to pravilo \u0161teje za nezdru\u017eljivo s prvim in se zapi\u0161e v naslednji ACL-slice.<\/p>\n

V tabeli spodaj je prikazan redosled zdru\u017eljivosti pogojev, zapisanih v ACL. Vsaka posamezna vrstica vsebuje zdru\u017eljive med seboj in nezdru\u017eljive z drugimi vrsticami oblikovane bit-maske.<\/p>\n

\"Podrobnosti
\nVsak posamezen paket, obdelan z ASIC, spro\u017ei vzporedno iskanje v vsakem ACL-slicu. Preverjanje poteka do prvega ujemanja v ACL-slicu, vendar je omogo\u010deno ve\u010dkratno ujemanje za isti paket v razli\u010dnih ACL-slicih. Vsako posamezno \"pravilo\" ima ustrezno dejanje, ki ga je treba izvesti v primeru ujemanja pogoja (bit-maske). \u010ce pride do ujemanja hkrati v ve\u010d ACL-slicih, se v bloku \"Re\u0161evanje konfliktov dejanj\" na podlagi prednosti ACL-slica sprejme odlo\u010ditev, katero dejanje izvesti. \u010ce je v ACL zapisano tako \"dejanje\" (dovoli\/zavrni) kot \"dejanje-modifikator\" (\u0161tej\/QoS\/log\/...), se pri ve\u010dkratnih ujemanjih izvede le bolj prioritetno \"dejanje\", medtem ko se vsa \"dejanje-modifikator\" izvedejo. Na spodnjem primeru je prikazano, da bosta oba \u0161tevcem pove\u010dana in bo izvedeno bolj prioritetno \"zavrni\".<\/p>\n

\"Podrobnosti
\n\"Vodnik za re\u0161itve ACL\"<\/a><\/noindex> z bolj podrobnimi informacijami o delovanju ACL na voljo na spletnem mestu extremenetworks.com<\/a><\/noindex>. Kak\u0161na koli vpra\u0161anja ali nejasnosti lahko vedno postavite zaposlenim v na\u0161em uradu \u2013 cis@extremenetworks.com<\/a><\/noindex>.
\n
Izvor: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

ACL (Access Control List) \u043d\u0430 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u044b \u043a\u0430\u043a \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e, \u0442\u0430\u043a \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e, \u0438\u043b\u0438 \u043f\u0440\u0438\u0432\u044b\u0447\u043d\u0435\u0439 \u0433\u043e\u0432\u043e\u0440\u044f hardware \u0438 software-based ACL. \u0418 \u0435\u0441\u043b\u0438 \u0441 software-based ACL \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u0442\u044c \u0432\u0441\u0451 \u043f\u043e\u043d\u044f\u0442\u043d\u043e, \u2014 \u044d\u0442\u043e \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0445\u0440\u0430\u043d\u044f\u0442\u0441\u044f \u0438 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u0432 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 (\u0442.\u0435. \u043d\u0430 Control Plane), \u0441\u043e \u0432\u0441\u0435\u043c\u0438 \u0432\u044b\u0442\u0435\u043a\u0430\u044e\u0449\u0438\u043c\u0438 \u043e\u0442\u0441\u044e\u0434\u0430 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f\u043c\u0438, \u0442\u043e \u043a\u0430\u043a \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u044b \u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-55847","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Podrobnosti o ACL stikalo | ProHoster","description":"ACL (Access Control List) na omre\u017enih napravah je mogo\u010de uresni\u010diti tako strojno kot programsko, ali bolj pogosto re\u010deno hardware in software-based ACL.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/acl-kommutatorov-v-detalyah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47ACL \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 \u0432 \u0434\u0435\u0442\u0430\u043b\u044f\u0445 | ProHoster","og:description":"ACL (Access Control List) \u043d\u0430 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u044b \u043a\u0430\u043a \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e, \u0442\u0430\u043a \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e, \u0438\u043b\u0438 \u043f\u0440\u0438\u0432\u044b\u0447\u043d\u0435\u0439 \u0433\u043e\u0432\u043e\u0440\u044f hardware \u0438 software-based ACL.","og:url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/acl-kommutatorov-v-detalyah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-29T21:00:00+00:00","article:modified_time":"2020-02-18T11:04:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55847","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:35:41","updated":"2022-09-29 07:17:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/55847","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=55847"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/55847\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=55847"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=55847"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=55847"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}