Chapter 34 Configuring Network Security with ACLs

Configuring IPv4 ACLs

Beginning in privileged EXEC mode, follow these steps to configure a time-range parameter for an ACL:

 

Command

Purpose

Step 1

 

 

configure terminal

Enter global configuration mode.

Step 2

 

 

time-rangetime-range-name

Assign a meaningful name (for example, workhours) to the time range to

 

 

be created, and enter time-range configuration mode. The name cannot

 

 

contain a space or quotation mark and must begin with a letter.

Step 3

 

 

absolute [start time date]

Specify when the function it will be applied to is operational.

 

[end time date]

You can use only one absolute statement in the time range. If you

 

 

 

or

configure more than one absolute statement, only the one configured

 

periodic day-of-the-week hh:mm to

last is executed.

 

[day-of-the-week]hh:mm

You can enter multiple periodic statements. For example, you could

 

 

 

or

configure different hours for weekdays and weekends.

 

periodic {weekdays weekend daily}

See the example configurations.

 

hh:mm to hh:mm

 

 

Step 4

 

 

end

Return to privileged EXEC mode.

Step 5

 

 

show time-range

Verify the time-range configuration.

Step 6

 

 

copy running-config startup-config

(Optional) Save your entries in the configuration file.

 

 

 

Repeat the steps if you have multiple items that you want in effect at different times.

To remove a configured time-range limitation, use the no time-rangetime-range-nameglobal configuration command.

This example shows how to configure time ranges for workhours and to configure January 1, 2006, as a company holiday and to verify your configuration.

Switch(config)# time-range workhours

Switch(config-time-range)#periodic weekdays 8:00 to 12:00

Switch(config-time-range)#periodic weekdays 13:00 to 17:00

Switch(config-time-range)# exit

Switch(config)# time-range new_year_day_2006

Switch(config-time-range)#absolute start 00:00 1 Jan 2006 end 23:59 1 Jan 2006

Switch(config-time-range)# end

Switch# show time-range

time-range entry: new_year_day_2003 (inactive)

absolute start 00:00 01 January 2006 end 23:59 01 January 2006 time-range entry: workhours (inactive)

periodic weekdays 8:00 to 12:00 periodic weekdays 13:00 to 17:00

To apply a time range, enter the time-range name in an extended ACL that can implement time ranges. This example shows how to create and verify extended access list 188 that denies TCP traffic from any source to any destination during the defined holiday times and permits all TCP traffic during work hours.

Switch(config)# access-list 188 deny tcp any any time-range new_year_day_2006

Switch(config)# access-list 188 permit tcp any any time-range workhours

Switch(config)# end

Switch# show access-lists

Extended IP access list 188

10deny tcp any any time-range new_year_day_2006 (inactive)

20permit tcp any any time-range workhours (inactive)

 

Catalyst 3750-E and 3560-E Switch Software Configuration Guide

34-18

OL-9775-02

Page 716
Image 716
Cisco Systems 3750E manual Absolute start time date, Periodic weekdays weekend daily, Show time-range, 34-18