It's often fun to geek out and to look at a technology
and say, wow, that's so cool.
And time-based ACLs are one of those.
So the concept of a time-based ACL
is that we can identify time ranges.
And so that implies also that we would want the clock
on that router to be accurate.
So we'd want to use NTP and also set the local time
zone for that router so that if we
say, between 2:00 PM and 4:00 PM,
that it really shows up as 2:00 PM to 4:00
PM so that that part of the access control WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
PM so that that part of the access control
can be activated.
So having the accurate time is a good prerequisite
to using time-based access control lists.
But here's the logic of the time-based access control list.
We create some entries called time ranges that specify times.
Periodic, daily.
And then we can specify those ranges of times on those days.
Like from 10:00 at night to midnight, or from 6:00
in the morning to 2:00 in the afternoon,
whatever time ranges we want.
And then when we create our access control list, which
are processed from top to bottom,
we can assign a time range to each and every line, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we can assign a time range to each and every line,
or any line that we want to.
And here's basically how it works.
If the time range is enforced-- let's
say we have a time range that says,
between 10:00 PM and midnight.
And it happens to be, the router believes it is
between 10:00 PM and midnight.
If it's associated with line 20, line 20 is active.
So whether line 20 says match and deny, or match and permit,
whatever that line 20 is, if the time range
is active at that moment, it's as if that line is there
and it's going to be processed. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and it's going to be processed.
If it's 2:00 in the afternoon and the time range isn't met,
it's as if that one line in the access control list
just doesn't exist.
It just skips it in the processing.
So that's how it works.
So what I thought we should do is, in this hands-on lab,
we're getting time based access control lists.
Let's come up with a plan.
We'll implement it.
And then we'll give it a chance to go ahead and troubleshoot it
if necessary.
Let's take a look at our topology.
And they'll implement time-based access controls.
So this is our topology we're going
to use for this hands-on lab.
And we're going to focus on traffic outbound on gig 0/0. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we're going to focus on traffic outbound on gig 0/0.
And so we'll create a couple of time ranges.
We'll create a couple lines in the access control list.
We'll apply it outbound on gig 0/0.
And then we can see, based on the access list in the time
range and what the current time is on that router,
whether or not those entries are active or not.
So let's go to R8.
The first thing we'd want to do is make sure that we have--
I'll just show access lists to see what we're starting with.
No access list.
And let's also show time range.
No time range options yet.
And let's also show clock. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's also show clock.
See what time it is.
[LAUGHING]
Show clo-ah.
All right.
Show clock.
All right.
So as I'm recording this right now,
this router believes it is 15:52.
All right.
So let's create two time ranges so that it's very obvious which
one is going to be hit.
And we'll do a config t.
The syntax to create a time range is time-range.
And then we'll give it a name.
Let's call this ItsLate.
And press Enter. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And press Enter.
Now we're in time range configuration mode.
And let's specify that this is going to be periodic
and that it is going to be weekdays not weekends.
And let's also specify the starting time.
It's going to be 10:00 at night, which would be 22:00 hours.
And then we'll put in the keyword to for the range.
Let's go for 23:59, which is really close to midnight.
And then we'll press Enter.
And bada bing, bada boom. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And bada bing, bada boom.
We now have a time range called ItsLate.
If we did a do show time range, and press Enter,
there's our time range.
And currently it shows us based on the current clock
on this router that it's an inactive.
So if we associate this time range with an access control
list entry, a single line, that one entry would not be valid,
would not be active at this moment.
All right.
Let's create another time range so we
can see them both in action.
Let's exit out.
And let's create time-range.
And let's call this Earlier. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's call this Earlier.
And I'm just making up these names.
This time range is going to be a time that's
earlier than 10:00 at night.
So time-range Earlier.
And let's go ahead and do a periodic and weekdays.
Actually, you know what?
Because you may be doing this on a weekend, let's go ahead
and say periodic and let's say daily.
And that way, if you're doing it on a weekend,
it'll still hit if it's before 10:00 at night
when you're doing this lab, based
on what the router believes the time to be.
So it is a periodic daily and starting at 00:00 to-- WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So it is a periodic daily and starting at 00:00 to--
and we'll go to 21:59.
Not 69, 59.
All right.
Let's do a show time-range.
And we have two time ranges.
One is active based on what the--
and again, one of the troubleshooting
steps if you have a time-based access control list
is tied to one of these things.
If the clock on the router is wrong,
you're going to get results that aren't expected.
So having NTP set up and setting the local time zone WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So having NTP set up and setting the local time zone
on the router so that it's acting on the local time,
that's important.
All right.
So I have two time ranges.
One's called Earlier that's active at this moment from zero
to 21:59.
And I have one that's called ItsLate.
And that goes from 22:00, which is 10:00 PM to midnight, just
before midnight.
All right.
So now let's apply these to an access control list.
So config t.
Let's do an extended named access control list, IP access
list, extended. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
list, extended.
And we'll call this TIME, TIME-ACL.
That will remind us what we're doing with this ACL.
And for our first sequence, let's do a deny of TCP
any to any if the time range is--
and let's go ahead and pick ItsLate.
Let's do this in fact.
Instead of just saying TCP, let's just say deny IP any any.
So no traffic.
We'll play this outbound on gig 0/0. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We'll play this outbound on gig 0/0.
No outbound transit traffic will be allowed on that interface
if that time range is active.
All right.
And let's make another sequence number that denies--
actually, we'll permit it, Earlier.
So permit IP any any time range and we'll
call this one Earlier.
All right.
And let's also do a deny IP any any log at the bottom.
And that way, if we miss something WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that way, if we miss something
or we later come and say, why did the network break?
We'll at least have some log messages
that'll tell us. whoo, here's what you denied and here's why.
Let's do the show access-lists.
And here's the details for that access list.
And the sequence 10 says, we can read what it says.
But the reality is it doesn't matter because it's inactive.
Right now, it's as if sequence 10 didn't exist.
[INAUDIBLE] come back to the future when he's erased.
Where it says inactive, so we can
do a to show time-range and see all of our time ranges WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
do a to show time-range and see all of our time ranges
and currently at this moment, whether this router believes
those are active or not.
So this sequence 10 is not going to be active.
It's going to be bypassed as it's being processed
if we did it right now.
And then sequence 20, which is associated
with a time range that is currently active,
would be acted upon.
And then the 30, sequence 30, once this access list
is applied, would be only matched
if there was no previous match in the access control list.
So let's apply this.
Let's do a config t.
Let's take a look at our topology real quick. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's take a look at our topology real quick.
So here on R8, let's apply this outbound on gig 0/0.
So we'll go back there.
Interface gig 0/0.
And we'll do an IP access-group.
And the name of the access control list is TIME-ACL.
And we'll play that outbound on that interface.
Right?
Then we do a show IP interface for gig 0/0.
Verify it's there.
Sure enough, it is there. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Sure enough, it is there.
Also remember that if you apply an access control list that
doesn't exist, you mistyped something,
it won't filter anything.
It won't stop all traffic.
It looks like you have an access control applied
but it won't filter anything because it doesn't exist.
All right.
Then we'll do a show access-list.
So basically, this deny statement is not
going to match because it's currently not active.
If we go to our client--
so here on our client, if we went to a browser
and we went to 192.168.1.100, which WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and we went to 192.168.1.100, which
is going to go through R8 and out that gig 0/0 interface,
it's working.
And if we go back to our management computer
and we go back to the console of R8,
and we do a show access-lists, one of those 1,419 matches
was our client going through there.
Because this sequence number 10 is inactive at the moment.
So thanks for joining me in this lab
and video on time-based access control lists.
I hope this has been informative for you.
And I'd like to thank you for viewing. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And I'd like to thank you for viewing.