WEBVTT 00:00:01.000 --> 00:00:05.760 But as promised we are not done access control lists because now I have to 00:00:05.760 --> 00:00:12.960 teach you about this concept of time-based access control lists. So 00:00:12.960 --> 00:00:21.920 time-based access control lists give us the ability to turn on and off an entry 00:00:21.920 --> 00:00:34.880 an entry in the ACL based on the time. So when you think about an ACL without 00:00:34.880 --> 00:00:42.080 any time aspects applied to it your entries are always what we mean by it on 00:00:42.080 --> 00:00:48.200 they are always on meaning they always apply. Top-down processing, immediate 00:00:48.200 --> 00:00:55.320 execution on a match they are all being applied because they are all active 00:00:55.320 --> 00:01:04.360 they are all on. But with time-based ACLs I can go ahead and put a time 00:01:04.360 --> 00:01:11.639 requirement on the entry itself and that allows me to have them on or off active 00:01:11.639 --> 00:01:19.160 or deactive based on certain times of day. So take a peek at this example here. 00:01:19.160 --> 00:01:26.239 In this example we are saying deny, deny, deny, permit. Now many times I teach this 00:01:26.239 --> 00:01:29.080 and people are like you don't have to deny all those Raymond it doesn't matter 00:01:29.080 --> 00:01:33.760 it doesn't matter I know I know. Why? Because of the implicit denial at the 00:01:33.760 --> 00:01:37.919 very end and that's okay. But I just show it here so you can see I'm denying all 00:01:37.919 --> 00:01:42.639 the private IP addresses and I'm permitting what just our public IP 00:01:42.639 --> 00:01:48.160 addresses in this scenario and we are applying it to this interface right here 00:01:48.160 --> 00:01:53.279 in the outbound direction. And so this for example would be an access control 00:01:53.279 --> 00:01:58.599 list that we would use for network address translation. So I would now have 00:01:58.599 --> 00:02:04.559 not not for network address translation but as a way to make sure that you can't 00:02:04.680 --> 00:02:09.119 go to the internet unless you have been successfully network address translated 00:02:09.119 --> 00:02:13.279 to one of those public IP addresses. So now with my network address translation 00:02:13.279 --> 00:02:17.080 configuration I would have it set up so that if you belong to any of those 00:02:17.080 --> 00:02:22.320 private networks you can be translated to that public IP addressing space and 00:02:22.320 --> 00:02:25.320 we're gonna use port address translation and different things like that. So then 00:02:25.320 --> 00:02:29.399 you get translated and then you get sent out the interface. So now that you've 00:02:29.399 --> 00:02:32.520 been translated you are gonna match the permit statement. If you weren't 00:02:32.559 --> 00:02:36.520 translated then you'd match one of these deny statements and then you can't go 00:02:36.520 --> 00:02:41.160 to the internet. So in this case here let's focus on this entry here. This is 00:02:41.160 --> 00:02:47.880 going to be the focus of our discussion. Right now this entry is on 24 hours a 00:02:47.880 --> 00:02:56.720 day, 7 days a week, 365 days a year. That means anybody at any time that has 00:02:57.080 --> 00:03:03.880 their address translated are allowed to go to the internet. Why? Because as long 00:03:03.880 --> 00:03:08.440 as you've been translated to an address that matches that range then you are 00:03:08.440 --> 00:03:11.759 allowed to go to the internet now because this interface ACL lets you go 00:03:11.759 --> 00:03:21.000 out the interface. So what if we restricted when that ACL was active 00:03:21.000 --> 00:03:27.080 versus deactive. That entry, the entry, not the whole ACL, just the entry. Let me 00:03:27.080 --> 00:03:31.160 create what is called a time range. So a time range is a completely different 00:03:31.160 --> 00:03:35.960 construct in our operating system. So you'll see I go to global configuration 00:03:35.960 --> 00:03:43.520 when I type in time range and then internet access. I just called it 00:03:43.520 --> 00:03:48.559 internet access. That's a name, locally significant to me. And in here I typed in 00:03:48.559 --> 00:04:00.440 periodic weekdays 830 to 1729. Pay very close attention please to that 1729. Why 00:04:00.440 --> 00:04:14.320 1729? Because my requirements were from 830 to 530. So you put in one minute 00:04:14.320 --> 00:04:23.320 less. One minute less. Why? Because this is valid to the very next minute. So when 00:04:23.320 --> 00:04:32.040 you put in 1729 it means 17 colon 29 colon what 59 would be. Right we are 00:04:32.040 --> 00:04:39.440 getting right down. Right so minus what? One second. Minus one second. So 530 minus 00:04:39.440 --> 00:04:44.600 one second. So if your result is 530 you got to go 1729. If you're told you want 00:04:44.600 --> 00:04:49.200 530 and you put 530 in there then that means you're going to 531 which would be 00:04:49.200 --> 00:04:52.799 wrong and they'd mark you wrong on the exam. I know we're talking about nitty 00:04:52.799 --> 00:04:56.720 gritty stuff here like oh really we're one minute off. Yeah well on the exam it 00:04:56.720 --> 00:05:00.359 matters. I would never test you on something like that but it doesn't mean 00:05:00.359 --> 00:05:04.839 Cisco is not going to test you on that. So always remember that in that time 00:05:04.839 --> 00:05:11.359 range the ending number you specify is what? Valid until the beginning of the 00:05:11.359 --> 00:05:19.239 next minute. So if we come here and we type in for example time range and we 00:05:19.239 --> 00:05:24.480 look here I have options like absolute and I have periodic. So an absolute time 00:05:24.480 --> 00:05:29.959 and date or periodic. So if I type in periodic now we got Monday, Friday, 00:05:30.200 --> 00:05:36.079 Saturday, Sunday, all of this. So I put week ends or weekdays I believe in the 00:05:36.079 --> 00:05:39.480 example yeah weekdays. So weekdays that'd be Monday, Tuesday, Wednesday, Thursday, 00:05:39.480 --> 00:05:49.679 Friday. Weekdays starting so as we said 8 colon 30 and ending at what time? 2. 00:05:49.679 --> 00:05:57.839 There. Stays valid until the beginning of the next minute. Make sure you know that. 00:06:00.239 --> 00:06:13.279 So now that you have the time range created let's apply it to the entry of 00:06:13.279 --> 00:06:23.640 the access control list. So in my example here access list 100 permit IP 203 yada 00:06:23.959 --> 00:06:33.799 yada okay I added this to the very end of it. I added that to it. So now what 00:06:33.799 --> 00:06:43.640 does that mean? It means this entry is on is active from here to here. So if we 00:06:43.640 --> 00:06:49.799 are outside of that time range then it's not active. Notice I didn't say deny 00:06:49.799 --> 00:07:03.000 that's not what I said. I said not active with a difference between active 00:07:03.000 --> 00:07:10.559 deactive or not active and deny. So if it's outside of that time range it 00:07:10.559 --> 00:07:15.640 simply means this doesn't exist. Which means that the entry is not even 00:07:15.640 --> 00:07:22.239 processed. It's not even checked. So in the end if we were outside of our time 00:07:22.239 --> 00:07:28.920 range then the implicit deny all would be the one that would deny traffic. But 00:07:28.920 --> 00:07:33.399 if we are inside the time range then this permit statement is the one that 00:07:33.399 --> 00:07:38.160 allows the traffic. You see the difference there? So when it's inactive 00:07:38.160 --> 00:07:40.839 it doesn't turn that into a deny it just simply means we're not even going to 00:07:40.839 --> 00:07:45.040 look at it. So if you ever see a time range on any of the entries on the 00:07:45.040 --> 00:07:48.679 certification exam if it's within the time range you got to understand that 00:07:48.679 --> 00:07:52.359 that is a valid entry that you need to look at. But if it's outside of the time 00:07:52.359 --> 00:07:58.600 range then that means it's an entry that is not even being used right now. Now and 00:07:58.600 --> 00:08:01.839 that could also be the problem right? What if the time range was created 00:08:01.839 --> 00:08:07.079 incorrectly? Then in that case you might be skipping over that when you should be 00:08:07.079 --> 00:08:10.720 applying it at this point in time. So definitely the time range could be the 00:08:10.720 --> 00:08:16.160 thing that's wrong. Also keep in mind that if you apply a time range that does 00:08:16.160 --> 00:08:23.079 not exist meaning if I typed all of this in and this was not there you 00:08:23.079 --> 00:08:29.959 automatically get the time range created without any time parameters and it means 00:08:29.959 --> 00:08:34.960 that the entry is active a hundred percent of the time 24 hours a day seven 00:08:34.960 --> 00:08:40.000 days a week. So therefore regards of the entry being a permitted to deny it's 00:08:40.000 --> 00:08:45.239 always going to be active. So for example if you had deny and you had a 00:08:45.239 --> 00:08:53.200 time range applied well what is the time? If there's no time there because you 00:08:53.200 --> 00:08:57.000 didn't even create it you forgot then that means you're active that means you 00:08:57.000 --> 00:09:02.359 are denying traffic. If it is permit then you would be permitting traffic. So just 00:09:02.359 --> 00:09:05.119 little things to keep in mind for the exam when it comes to that. So let's take 00:09:05.119 --> 00:09:10.039 a look at our clock right now. We look at our clock our clock says it's 208 00:09:10.039 --> 00:09:15.119 February 4th 2020. Yes that's when I did this example I did the screenshot still 00:09:15.119 --> 00:09:20.479 perfectly applicable to this day. So when we look down here we'll see we have the 00:09:20.479 --> 00:09:23.640 time range notice it actually says active when you look at the output of 00:09:23.640 --> 00:09:35.000 show accesses it actually tells you that it's active. So now we have 00:09:40.200 --> 00:09:47.760 the right we are in the time range we are active we are in the time range it 00:09:47.760 --> 00:09:57.760 even says it is active right now because we are in that time range. So 00:09:57.760 --> 00:10:04.799 when we're out of the time range it even says inactive. So we look at our time 00:10:04.799 --> 00:10:16.119 range there you go. Right so the only difference here now for you folks is to 00:10:16.119 --> 00:10:19.799 make sure for the exam you recognize that if there's a time range applied 00:10:19.799 --> 00:10:24.200 you're gonna have to double check the time range as well and just ensure that 00:10:24.200 --> 00:10:28.440 things are appropriate based on all the information they provide to you. Now if 00:10:28.440 --> 00:10:35.280 they don't give you this and you see this you know you are outside of the 00:10:35.280 --> 00:10:40.280 time range you know you're outside of the time range. So right now let's say 00:10:40.280 --> 00:10:45.440 the question was users are complaining they can't get on the internet. Users are 00:10:45.440 --> 00:10:51.799 complaining the internet's broken. There you go that's even a better one. Why? 00:10:52.320 --> 00:11:01.119 Well in my case here it is after hours it is outside of our normal time range 00:11:01.119 --> 00:11:08.320 for internet connectivity for internet access. As a result of that you are being 00:11:08.320 --> 00:11:15.239 denied by what? Are you being denied by sequence 40? No you're being denied by 00:11:15.479 --> 00:11:22.200 the implicit deny all. Because network address translation would have happened 00:11:22.200 --> 00:11:26.440 first then you would have been so you would have had a public IP address like 00:11:26.440 --> 00:11:32.719 203.0.113.4 given to you. You are now at the interface getting ready to leave and 00:11:32.719 --> 00:11:42.119 what? Now the ACL is being checked and this ACL says what? Well deny if you're 00:11:42.119 --> 00:11:45.159 private well you're not private you're not private you're not private this is 00:11:45.159 --> 00:11:49.479 not even active so I skip over it and oh implicit deny all you're denied. So 00:11:49.479 --> 00:11:53.479 it's actually implicit deny all here that is dropping the traffic not 00:11:53.479 --> 00:11:58.479 sequence 40. That's important for you to recognize. Inactive doesn't mean it's the 00:11:58.479 --> 00:12:03.840 opposite. Inactive simply means ignore and skip it and go to the next one. 00:12:03.840 --> 00:12:08.599 Andrew says what if you're going over an IPsec and have a private-to-private NAT? 00:12:08.599 --> 00:12:22.520 So I'm not sure in reference to what that is. I mean we were talking I 00:12:22.520 --> 00:12:25.520 believe you typed that in when we were over here just talking about this at 00:12:25.520 --> 00:12:30.119 this point in time. I think it was at this point in time when that came in but 00:12:30.119 --> 00:12:34.039 whatever you're going over an IPsec with a private. So this example here is just 00:12:34.039 --> 00:12:39.559 purely about having denying all traffic going to the Internet that's private and 00:12:39.559 --> 00:12:44.760 allowing public IP addresses. So I'm not sure specifically your scenario or how 00:12:44.760 --> 00:12:48.960 deep you want to get. Yeah you're being rhetorical to your deny statements. Okay 00:12:48.960 --> 00:12:53.119 well in that case if you're private-to-private NAT and you are going 00:12:53.119 --> 00:12:58.599 over IPsec then obviously you can't deny those IP addresses. Yes because you're 00:12:58.599 --> 00:13:03.880 going to be using the private IP addresses across the IPsec VPN tunnel. 00:13:04.960 --> 00:13:10.559 All right so that is your time-based access control lists. Make sure you know 00:13:10.559 --> 00:13:13.719 them for the exam because there's a pretty good chance you may see them a 00:13:13.719 --> 00:13:16.960 couple of times on the exam.