{"id":55847,"date":"2020-01-30T00:00:00","date_gmt":"2020-01-29T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/acl-kommutatorov-v-detalyah"},"modified":"2020-02-18T14:04:00","modified_gmt":"2020-02-18T11:04:00","slug":"acl-kommutatorov-v-detalyah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/acl-kommutatorov-v-detalyah","title":{"rendered":"ACL-switchar i detalj","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

ACL (Access Control List) p\u00e5 n\u00e4tverksenheter kan implementeras b\u00e5de h\u00e5rdvaru- och mjukvarubaserat, eller mer vanligt uttryckt hardware och software-based ACL. Om mjukvarubaserade ACL \u00e4r tydliga, det vill s\u00e4ga regler som lagras och behandlas i RAM (det vill s\u00e4ga p\u00e5 Control Plane), med alla d\u00e4rav f\u00f6ljande begr\u00e4nsningar, s\u00e5 kommer vi att unders\u00f6ka hur h\u00e5rdvarubaserade ACL implementeras och fungerar i v\u00e5r artikel. Vi kommer att anv\u00e4nda switchar fr\u00e5n ExtremeSwitching-serien fr\u00e5n Extreme Networks som exempel.<\/p>\n

\"ACL-switchar
\n <\/a><\/noindex>
\nEftersom vi \u00e4r intresserade av just h\u00e5rdvarubaserade ACL \u00e4r den interna implementeringen av Data Plane, eller de anv\u00e4ndna chipp med ASIC, av st\u00f6rsta vikt f\u00f6r oss. Switchar i alla serier fr\u00e5n Extreme Networks \u00e4r byggda p\u00e5 ASIC fr\u00e5n Broadcom, och d\u00e4rf\u00f6r g\u00e4ller den mesta av informationen nedan \u00e4ven f\u00f6r andra switchar p\u00e5 marknaden som \u00e4r implementerade med liknande ASIC.<\/p>\n

Som man kan se i bilden ovan \u00e4r det \"ContentAware Engine\" som direkt ansvarar f\u00f6r operationen av ACL i chippet, uppdelat i ing\u00e5ng och utg\u00e5ng. Arkitekturellt \u00e4r de identiska, men \"egress\" \u00e4r mindre skalbar och mindre funktionell. Fysiskt \u00e4r b\u00e5da \"ContentAware Engine\" TCAM-minne plus tillh\u00f6rande logik, och varje anv\u00e4ndar- eller systemregel f\u00f6r ACL \u00e4r en enkel bitmask (bit-mask) som skrivs in i detta minne. Det \u00e4r just d\u00e4rf\u00f6r som behandlingen av trafik av chippet sker paket f\u00f6r paket utan prestandaf\u00f6rs\u00e4mring.<\/p>\n

Fysiskt delas samma Ingress\/Egress TCAM logiskt upp i flera segment (beroende p\u00e5 minnesm\u00e4ngd och plattform), s\u00e5 kallade \"ACL slices\". Till exempel sker samma sak med en fysisk h\u00e5rddisk i din laptop n\u00e4r du skapar flera logiska enheter \u2013 C:>, D:>. Varje ACL-slice best\u00e5r i sin tur av minnesceller i form av \"rader\" d\u00e4r \"rules\" (regler\/bitmasker) skrivs in.<\/p>\n

\"ACL-switchar
\nUppdelningen av TCAM i ACL-slices bygger p\u00e5 en viss logik. I varje separat ACL-slice kan endast kompatibla \"rules\" skrivas. Om n\u00e5got av \"rules\" inte \u00e4r kompatibelt med det f\u00f6reg\u00e5ende, kommer det att skrivas i n\u00e4sta ACL-slice i ordningen, oavsett hur m\u00e5nga lediga rader f\u00f6r \"rules\" som finns kvar i det f\u00f6reg\u00e5ende. <\/p>\n

Varifr\u00e5n kommer d\u00e5 denna kompatibilitet eller inkompatibilitet av ACL-regler? Tanken \u00e4r att en \"rad\" TCAM, d\u00e4r \"regler\" skrivs, har en l\u00e4ngd av 232 bitar och delas upp i flera f\u00e4lt \u2013 Fixed, Field1, Field2, Field3. 232 bitar eller 29 byte TCAM-minne \u00e4r mer \u00e4n tillr\u00e4ckligt f\u00f6r att skriva en bitmask f\u00f6r en viss MAC- eller IP-adress, men \u00e4r betydligt mindre \u00e4n hela Ethernet-paketets rubrik. I varje enskild ACL-slice utf\u00f6r ASIC en oberoende uppslagning baserat p\u00e5 de inst\u00e4llda bitmaskerna i F1-F3. I allm\u00e4nhet kan denna uppslagning g\u00f6ras i de f\u00f6rsta 128 byte av Ethernet-rubriken. Just p\u00e5 grund av att s\u00f6kningen kan g\u00f6ras i 128 byte, medan endast 29 byte kan skrivas, m\u00e5ste en f\u00f6rskjutning (offset) st\u00e4llas in relativt paketets b\u00f6rjan f\u00f6r en korrekt uppslagning. F\u00f6rskjutningen f\u00f6r varje ACL-slice st\u00e4lls in vid skrivningen av den f\u00f6rsta regeln, och om det vid skrivning av en efterf\u00f6ljande regel uppt\u00e4cks ett behov av en annan f\u00f6rskjutning, anses detta regel inkompatibelt med den f\u00f6rsta och skrivs in i n\u00e4sta ACL-slice.<\/p>\n

I tabellen nedan ges ordningen f\u00f6r kompatibiliteten av villkor som skrivs in i ACL. Varje enskild rad inneh\u00e5ller de bitmasker som \u00e4r kompatibla med varandra och inkompatibla med andra rader.<\/p>\n

\"ACL-switchar
\nVarje enskilt paket som behandlas av ASIC startar en parallell uppslagning i varje ACL-slice. Kontrollen g\u00f6rs till den f\u00f6rsta matchningen i ACL-slice, men flera matchningar f\u00f6r samma paket i olika ACL-slice till\u00e5ts. Varje enskild \"regel\" har en motsvarande \u00e5tg\u00e4rd som m\u00e5ste utf\u00f6ras vid en matchning av villkoren (bitmask). Om en matchning sker i flera ACL-slices, fattas beslutet om vilken \u00e5tg\u00e4rd som ska utf\u00f6ras i blocket \u201cAction Conflict Resolution\u201d baserat p\u00e5 prioriteten av ACL-slice. Om det i ACL \u00e4r angivet b\u00e5de \u201caction\u201d (permit\/deny) och \u201caction-modifier\u201d (count\/QoS\/log\/\u2026), kommer endast den mer prioriterade \u201caction\u201d att utf\u00f6ras vid flera matchningar, medan alla \u201caction-modifier\u201d kommer att genomf\u00f6ras. I exemplet nedan visas att b\u00e5da r\u00e4knarna \u00f6kas och den mer prioriterade \u201cdeny\u201d utf\u00f6rs.<\/p>\n

\"ACL-switchar
\n\u201cACL Solutions Guide\u201d<\/a><\/noindex> med mer detaljerad information om hur ACL fungerar tillg\u00e4nglig p\u00e5 webbplatsen extremenetworks.com<\/a><\/noindex>. Eventuella uppkomna eller kvarst\u00e5ende fr\u00e5gor kan alltid st\u00e4llas till medarbetarna p\u00e5 v\u00e5rt kontor \u2013 cis@extremenetworks.com<\/a><\/noindex>.
\n
K\u00e4lla: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

ACL (Access Control List) \u043d\u0430 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u044b \u043a\u0430\u043a \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e, \u0442\u0430\u043a \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e, \u0438\u043b\u0438 \u043f\u0440\u0438\u0432\u044b\u0447\u043d\u0435\u0439 \u0433\u043e\u0432\u043e\u0440\u044f hardware \u0438 software-based ACL. \u0418 \u0435\u0441\u043b\u0438 \u0441 software-based ACL \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u0442\u044c \u0432\u0441\u0451 \u043f\u043e\u043d\u044f\u0442\u043d\u043e, \u2014 \u044d\u0442\u043e \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0445\u0440\u0430\u043d\u044f\u0442\u0441\u044f \u0438 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u0432 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 (\u0442.\u0435. \u043d\u0430 Control Plane), \u0441\u043e \u0432\u0441\u0435\u043c\u0438 \u0432\u044b\u0442\u0435\u043a\u0430\u044e\u0449\u0438\u043c\u0438 \u043e\u0442\u0441\u044e\u0434\u0430 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f\u043c\u0438, \u0442\u043e \u043a\u0430\u043a \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u044b \u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-55847","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47ACL f\u00f6r switchar i detalj | ProHoster","description":"ACL (Access Control List) p\u00e5 n\u00e4tverksenheter kan implementeras b\u00e5de h\u00e5rdvaru- och mjukvarubaserat, eller mer bekant sagt hardware och software-baserat ACL.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/acl-kommutatorov-v-detalyah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47ACL \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 \u0432 \u0434\u0435\u0442\u0430\u043b\u044f\u0445 | ProHoster","og:description":"ACL (Access Control List) \u043d\u0430 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u044b \u043a\u0430\u043a \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e, \u0442\u0430\u043a \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e, \u0438\u043b\u0438 \u043f\u0440\u0438\u0432\u044b\u0447\u043d\u0435\u0439 \u0433\u043e\u0432\u043e\u0440\u044f hardware \u0438 software-based ACL.","og:url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/acl-kommutatorov-v-detalyah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-29T21:00:00+00:00","article:modified_time":"2020-02-18T11:04:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55847","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:35:41","updated":"2022-09-29 07:17:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/55847","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=55847"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/55847\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=55847"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=55847"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=55847"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}