34-14
Cisco IE 3000 Switch Software Configuration Guide
OL-13018-03
Chapter 34 Configuring Network Security with ACLs
Configuring IPv4 ACLs
Using Time Ranges with ACLs
You can selectively apply extended ACLs based on the time of day and the week by using the
time-range
global configuration command. First, define a time-range name and set the times and the
dates or the days of the week in the time range. Then enter the time-range name when applying an ACL
to set restrictions to the access list. You can use the time range to define when the permit or deny
statements in the ACL are in effect, for example, during a specified time period or on specified days of
the week. The
time-range
keyword and argument are referenced in the named and numbered extended
ACL task tables in the previous sections, the
“Creating Standard and Extended IPv4 ACLs” section on
page 34-5
, and the
“Creating Named Standard and Extended ACLs” section on page 34-12
.
Time-based access lists trigger CPU activity because the new configuration of the access list must be
merged with other features and the combined configuration loaded into the TCAM. For this reason, you
should be careful not to have several access lists configured to take affect in close succession (within a
small number of minutes of each other.)
Note
The time range relies on the switch system clock; therefore, you need a reliable clock source. We
recommend that you use Network Time Protocol (NTP) to synchronize the switch clock. For more
information, see the
“Managing the System Time and Date” section on page 8-1
.
Beginning in privileged EXEC mode, follow these steps to configure a time-range parameter for an
ACL:
Repeat the steps if you have multiple items that you want in effect at different times.
To remove a configured time-range limitation, use the
no
time-range
time-range-name
global
configuration command.
This example shows how to configure time ranges for
workhours
and to configure January 1, 2006, as a
company holiday and to verify your configuration.
Switch(config)#
time-range workhours
Switch(config-time-range)#
periodic weekdays 8:00 to 12:00
Command
Purpose
Step 1
configure terminal
Enter global configuration mode.
Step 2
time-range
time-range-name
Assign a meaningful name (for example,
workhours
) to the time range to
be created, and enter time-range configuration mode. The name cannot
contain a space or quotation mark and must begin with a letter.
Step 3
absolute
[
start
time date
]
[
end
time date
]
or
periodic
day-of-the-week hh:mm to
[
day-of-the-week
]
hh:mm
or
periodic
{
weekdays
|
weekend
|
daily
}
hh:mm to hh:mm
Specify when the function it will be applied to is operational.
•
You can use only one
absolute
statement in the time range. If you
configure more than one absolute statement, only the one configured
last is executed.
•
You can enter multiple
periodic
statements. For example, you could
configure different hours for weekdays and weekends.
See the example configurations.
Step 4
end
Return to privileged EXEC mode.
Step 5
show time-range
Verify the time-range configuration.
Step 6
copy running-config startup-config
(Optional) Save your entries in the configuration file.
