But as promised we are not done access control lists because now I have to
teach you about this concept of time-based access control lists. So
time-based access control lists give us the ability to turn on and off an entry
an entry in the ACL based on the time. So when you think about an ACL without
any time aspects applied to it your entries are always what we mean by it on
they are always on meaning they always apply. Top-down processing, immediate
execution on a match they are all being applied because they are all active
they are all on. But with time-based ACLs I can go ahead and put a time
requirement on the entry itself and that allows me to have them on or off active
or deactive based on certain times of day. So take a peek at this example here.
In this example we are saying deny, deny, deny, permit. Now many times I teach this
and people are like you don't have to deny all those Raymond it doesn't matter
it doesn't matter I know I know. Why? Because of the implicit denial at the
very end and that's okay. But I just show it here so you can see I'm denying all
the private IP addresses and I'm permitting what just our public IP
addresses in this scenario and we are applying it to this interface right here
in the outbound direction. And so this for example would be an access control
list that we would use for network address translation. So I would now have
not not for network address translation but as a way to make sure that you can't
go to the internet unless you have been successfully network address translated
to one of those public IP addresses. So now with my network address translation
configuration I would have it set up so that if you belong to any of those
private networks you can be translated to that public IP addressing space and
we're gonna use port address translation and different things like that. So then
you get translated and then you get sent out the interface. So now that you've
been translated you are gonna match the permit statement. If you weren't
translated then you'd match one of these deny statements and then you can't go
to the internet. So in this case here let's focus on this entry here. This is
going to be the focus of our discussion. Right now this entry is on 24 hours a
day, 7 days a week, 365 days a year. That means anybody at any time that has
their address translated are allowed to go to the internet. Why? Because as long
as you've been translated to an address that matches that range then you are
allowed to go to the internet now because this interface ACL lets you go
out the interface. So what if we restricted when that ACL was active
versus deactive. That entry, the entry, not the whole ACL, just the entry. Let me
create what is called a time range. So a time range is a completely different
construct in our operating system. So you'll see I go to global configuration
when I type in time range and then internet access. I just called it
internet access. That's a name, locally significant to me. And in here I typed in
periodic weekdays 830 to 1729. Pay very close attention please to that 1729. Why
1729? Because my requirements were from 830 to 530. So you put in one minute
less. One minute less. Why? Because this is valid to the very next minute. So when
you put in 1729 it means 17 colon 29 colon what 59 would be. Right we are
getting right down. Right so minus what? One second. Minus one second. So 530 minus
one second. So if your result is 530 you got to go 1729. If you're told you want
530 and you put 530 in there then that means you're going to 531 which would be
wrong and they'd mark you wrong on the exam. I know we're talking about nitty
gritty stuff here like oh really we're one minute off. Yeah well on the exam it
matters. I would never test you on something like that but it doesn't mean
Cisco is not going to test you on that. So always remember that in that time
range the ending number you specify is what? Valid until the beginning of the
next minute. So if we come here and we type in for example time range and we
look here I have options like absolute and I have periodic. So an absolute time
and date or periodic. So if I type in periodic now we got Monday, Friday,
Saturday, Sunday, all of this. So I put week ends or weekdays I believe in the
example yeah weekdays. So weekdays that'd be Monday, Tuesday, Wednesday, Thursday,
Friday. Weekdays starting so as we said 8 colon 30 and ending at what time? 2.
There. Stays valid until the beginning of the next minute. Make sure you know that.
So now that you have the time range created let's apply it to the entry of
the access control list. So in my example here access list 100 permit IP 203 yada
yada okay I added this to the very end of it. I added that to it. So now what
does that mean? It means this entry is on is active from here to here. So if we
are outside of that time range then it's not active. Notice I didn't say deny
that's not what I said. I said not active with a difference between active
deactive or not active and deny. So if it's outside of that time range it
simply means this doesn't exist. Which means that the entry is not even
processed. It's not even checked. So in the end if we were outside of our time
range then the implicit deny all would be the one that would deny traffic. But
if we are inside the time range then this permit statement is the one that
allows the traffic. You see the difference there? So when it's inactive
it doesn't turn that into a deny it just simply means we're not even going to
look at it. So if you ever see a time range on any of the entries on the
certification exam if it's within the time range you got to understand that
that is a valid entry that you need to look at. But if it's outside of the time
range then that means it's an entry that is not even being used right now. Now and
that could also be the problem right? What if the time range was created
incorrectly? Then in that case you might be skipping over that when you should be
applying it at this point in time. So definitely the time range could be the
thing that's wrong. Also keep in mind that if you apply a time range that does
not exist meaning if I typed all of this in and this was not there you
automatically get the time range created without any time parameters and it means
that the entry is active a hundred percent of the time 24 hours a day seven
days a week. So therefore regards of the entry being a permitted to deny it's
always going to be active. So for example if you had deny and you had a
time range applied well what is the time? If there's no time there because you
didn't even create it you forgot then that means you're active that means you
are denying traffic. If it is permit then you would be permitting traffic. So just
little things to keep in mind for the exam when it comes to that. So let's take
a look at our clock right now. We look at our clock our clock says it's 208
February 4th 2020. Yes that's when I did this example I did the screenshot still
perfectly applicable to this day. So when we look down here we'll see we have the
time range notice it actually says active when you look at the output of
show accesses it actually tells you that it's active. So now we have
the right we are in the time range we are active we are in the time range it
even says it is active right now because we are in that time range. So
when we're out of the time range it even says inactive. So we look at our time
range there you go. Right so the only difference here now for you folks is to
make sure for the exam you recognize that if there's a time range applied
you're gonna have to double check the time range as well and just ensure that
things are appropriate based on all the information they provide to you. Now if
they don't give you this and you see this you know you are outside of the
time range you know you're outside of the time range. So right now let's say
the question was users are complaining they can't get on the internet. Users are
complaining the internet's broken. There you go that's even a better one. Why?
Well in my case here it is after hours it is outside of our normal time range
for internet connectivity for internet access. As a result of that you are being
denied by what? Are you being denied by sequence 40? No you're being denied by
the implicit deny all. Because network address translation would have happened
first then you would have been so you would have had a public IP address like
203.0.113.4 given to you. You are now at the interface getting ready to leave and
what? Now the ACL is being checked and this ACL says what? Well deny if you're
private well you're not private you're not private you're not private this is
not even active so I skip over it and oh implicit deny all you're denied. So
it's actually implicit deny all here that is dropping the traffic not
sequence 40. That's important for you to recognize. Inactive doesn't mean it's the
opposite. Inactive simply means ignore and skip it and go to the next one.
Andrew says what if you're going over an IPsec and have a private-to-private NAT?
So I'm not sure in reference to what that is. I mean we were talking I
believe you typed that in when we were over here just talking about this at
this point in time. I think it was at this point in time when that came in but
whatever you're going over an IPsec with a private. So this example here is just
purely about having denying all traffic going to the Internet that's private and
allowing public IP addresses. So I'm not sure specifically your scenario or how
deep you want to get. Yeah you're being rhetorical to your deny statements. Okay
well in that case if you're private-to-private NAT and you are going
over IPsec then obviously you can't deny those IP addresses. Yes because you're
going to be using the private IP addresses across the IPsec VPN tunnel.
All right so that is your time-based access control lists. Make sure you know
them for the exam because there's a pretty good chance you may see them a
couple of times on the exam.