Configuring Access Control Lists 587
A named time range can contain up to 10 configured time ranges. Only one
absolute time range can be configured per time range. During the ACL
configuration, you can associate a configured time range with the ACL to
provide additional control over permitting or denying a user access to network
resources.
Benefits of using time-based ACLs include:
• Providing more control over permitting or denying a user access to
resources, such as an application (identified by an IP address/mask pair and
a port number).
• Providing control of logging messages. Individual ACL rules defined within
an ACL can be set to log traffic only at certain times of the day so you can
simply deny access without needing to analyze many logs generated during
peak hours.
What Are the ACL Limitations?
There are two hardware matching engines visible to the Dell switch
administrator: the ingress processor and the egress processor. Each of these
processors has different limits and actions. The ingress matching engine
processes packets on ingress to the switch an d can apply actions such as
applying CoS processing, diverting to a different port, etc. The egress
matching engine processes packets after they are switched and queued for
egress and supports policies such as rewriting the DSCP or CoS values, as well
as the normal permit (forward) and deny (drop) actions.
ACLs operate by matching on specific fields within packets. Various match
conditions (operators) are supported (e.g., equal, less than, not equal, etc.),
along with masks that support selection of all or a portion of a field. Each field
to be matched is assigned to a matching engine (slice). A slice is defined by
an offset into the packet that is compared against a set of matching values
and masks along with an associated action (ACEs). Each Dell Networking
switch series supports a fixed number of slices and each slice supports a fixed
number of matching criteria (values and masks). Slices operate in parallel to
perform the configured matching operations. An ACL with a different offset
requires the use of a new hardware slice but multiple matching values can be
specified for a single slice (e.g., an IPv4 destination address with a 32-bit mask
is 192.168.21.1 or 192.168.12.3). Slices can also be joined together to match
widths larger than 32 bits or they can be concatenated to provide a larger
number of matching values with a single offset. In general, ACLs that match