This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.T2600G-28TS Time Range and ACL
This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
Hello all,
I have defined a Time Range in order to inhibit WWW access deep in the night for my kids. System time ist set using ntp with local time zone, time range follows local time.
An ACL with DENY_ALL on all protocols and bound to specific ports works as desired (blocks always).
Now adding the TimeRange to the ACL does not trigger ACL, it seems to be always active. I tested this with my desired time range outside its "active" duty range (the time range is shown properly as "inactive" on the time range definition pane). A cross check with a second "active" time range (replaced in the ACL in question) did not change the behaviour. The ACL acts as if no time range was inserted, i.e. it blocks all the time.
What do I get wrong here?
-Michael
OK, Screenshots
Time Ranges under System-> Time Range (note Status "Inactive" out of defined time span, becomes "active" if within.
This specific time rage is defined as follows:
and used in the ACL under "Rime Range"
see drop-down (time range)
This ACL, if bound to a port, blocks even if the time range in question is inactive.
This is how it works for me on a T1500G-10PS, which also runs the new firmware:
Time range (your settings leave one hour for your kids to surf at the weekend's Geisterstunde, intentional?):
ACL needs two rules:
First rule to deny access during sleeptime:
Second rule to permit access by default:
The switch seems to add a default Deny rule at the end of the ACL ruleset much like Cisco switches do. @Mitya, can you confirm this?
However, I would reverse the logic to allow for a more readable continguous time range:
– First rule bound to time period (say, Daytime) allows use of the port or VLAN.
– Second rule always denies use of the port or VLAN. Not necessarily needed b/c of the default Deny rule, but IMHO it's good style to explicitly state what you want for better readability and for documentation.
Thus, this should work, too:
ACL rule 1 is bound to the time range, rule 999 is the catch all:
