Time Ranges For Acls; Ipv4 Acl Interface Considerations - Cisco Catalyst 2960-XR Security Configuration Manual

Configuring IPv4 ACLs
Log messages are generated on a per-flow basis. A flow is defined as packets with the same IP addresses and
Layer 4 (UDP or TCP) port numbers. If a flow does not receive any packets in the 5-minute interval, that flow
is removed from the cache. When a syslog message is generated, the timer and packet counter are reset.
VACL logging restrictions:
• Only denied IP packets are logged.
• Packets that require logging on the outbound port ACLs are not logged if they are denied by a VACL.

Time Ranges for ACLs

You can selectively apply extended ACLs based on the time of day and the week by using the time-range
global configuration command. First, define a time-range name and set the times and the dates or the days of
the week in the time range. Then enter the time-range name when applying an ACL to set restrictions to the
access list. You can use the time range to define when the permit or deny statements in the ACL are in effect,
for example, during a specified time period or on specified days of the week. The time-range keyword and
argument are referenced in the named and numbered extended ACL task tables.
These are some benefits of using time ranges:
• You have more control over permitting or denying a user access to resources, such as an application
• You can control logging messages. ACL entries can be set to log traffic only at certain times of the day.
Time-based access lists trigger CPU activity because the new configuration of the access list must be merged
with other features and the combined configuration loaded into the hardware memory. For this reason, you
should be careful not to have several access lists configured to take affect in close succession (within a small
number of minutes of each other.)
The time range relies on the switch system clock; therefore, you need a reliable clock source. We
Note
recommend that you use Network Time Protocol (NTP) to synchronize the switch clock.
Related Topics
Configuring Time Ranges for ACLs, on page 128

IPv4 ACL Interface Considerations

When you apply the ip access-group interface configuration command to a Layer 3 interface (an SVI, a Layer
3 EtherChannel, or a routed port), the interface must have been configured with an IP address. Layer 3 access
groups filter packets that are routed or are received by Layer 3 processes on the CPU. They do not affect
packets bridged within a VLAN.
For inbound ACLs, after receiving a packet, the switch checks the packet against the ACL. If the ACL permits
the packet, the switch continues to process the packet. If the ACL rejects the packet, the switch discards the
packet.
OL-29434-01
(identified by an IP address/mask pair and a port number).
Therefore, you can simply deny access without needing to analyze many logs generated during peak
hours.
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
Time Ranges for ACLs
119