Time-based control strategy for Cisco routers

In the campus network management, the client's access control is an important link, we often use access-list to control, if and time combined, control will be more flexible. Cisco introduced a time based access table from iOS version 12.0 to achieve control over a point or time period, such as: Our school control "class pass" in the classroom, the Internet time period is: 8:00 to 18:00 every weekday to allow web surfing, Internet access is blocked at other times. Implementing a Time based Access table takes only two steps: The first step is to define a time range; The second step is to use Time-range in the Access table to refer to the time range just defined. Let's give a detailed description of how it is used.

I. Definition of time range

Defining a time range is divided into two steps.

1. Use the Time-range command to specify the time range correctly.

Format: Time-range time-range-name

Time-range-name is used to flag a time span to refer to in an Access table.

2. Use absolute or one or more periodic statements to define a time range that can have only one absolute statement per time range, but it can have multiple periodic statements.

(1) Format: Absolute [start time Date] [end time Date]

Time enters the hour in hours and minutes (hh:mm).

Date enters dates in days, months, and years.

such as: Absolute start 8:00 end 18:00

(2) Format: Periodic days-of-the-

Week hh:mm to [Days-of-the-week] hh:mm

Days-of-the-week a day or a few days in which a function may occur; A parameter can be a single day (such as a Monday) or a few days (Monday to Friday) or daily, weekday, or weekend.

Daily from Monday to Sunday.

Weekday from Monday to Friday.

Weekend Saturday and Sunday.

such as: From Saturday 8:00 to Sunday night 18:00

Periodic weekend 8:00 to 18:00

Every day of the week from 8:00 to 18:00

Periodic daily 8:00 to 18:00

From 15:00 in Wednesday to 8:00 in Saturday

Periodic Wednesday 15:00 to Saturday 8:00

Second, use Time-range in the Access table to reference the time range just defined

For example: IP access-list-Permit any of the EQ time-range time-range-name

Time-range-name is the name defined with Time-range.

Third, the example

Objective: to restrict web surfing of 192.168.4.0 networks, allowing Web Access from Monday 7:00 to Friday 18:00 only from May 1, 2004 to December 31, 2004.

Interface FastEthernet 0

IP access-grop

Time-range allow-http

Absolute start 7:00 1 May 18:00 December 2004

Periodic weekday 7:00 to 18:00

IP access-list Permit tcp 192.168.4.0 0.0.0.255 any EQ time-range allow-http

The last statement applies the time range named Allow-http to the extended IP Access table, allowing only web surfing for a time span. Of course, we can also carry out other aspects of control, it depends on your needs.

In fact, as the most important equipment in the network layer, the router provides us with many means to control and maintain the network, the time based Access table not only can control the access of the network, but also can control the data flow of a certain time period, as long as we play the imagination, we can realize many functions.