When dealing with other people, we like to be treated fairly.
Well, in computer networks, we don't always
want to be fair to our traffic.
So in this Nugget, I'd like to chat with you
about a mechanism we can use to identify traffic
for special treatment.
And that is in the form of an access control list, or ACL.
An access control lists are usually
used as part of a 1-2 punch.
The first part of the 1-2 punch is
to identify specific types of traffic,
either looking at information at layer 2 in the layer 2 header
or looking at information layer 3 header and sometimes even
in layer 4 at the transport layer.
And then based on that, give it special treatment
or give those packets, or segments, or frames
special treatment as they go through the network.
And a logical question might be-- well, if I'm a packet,
and I want special treatment, what
could those special treatment look like?
Well, one element would be whether we're
going to permit or deny that traffic on the network.
Maybe we don't want some specific type of traffic.
Let's say, we have it out for the computer 1 here.
So computer 1 is at address 10.1.0.11.
And we see that that computer's been going out to the internet
to a specific server at 67.83.0.2
and as it communicates to that host in choosing the transport
layer, UDP, User Datagram Protocol.
And if we did not want to allow that, we could, first of all,
create an access control list that identifies that traffic
between these two specific IP addresses
and at layer 4 including the fact that it's UDP.
And we could simply say, we want to deny that traffic
and then apply that access list to the router interface.
Another example of where an access control list can be used
is to identify traffic that should be translated.
From an earlier Nugget, we took a look
at network address and port address translation,
where we translated the source IP address of computer 1
before it went out to the internet.
Well, we can be very granular with exactly who
gets to be translated.
And we can do that also by creating an access control
list that identifies the source IP addresses that we're
willing to translate and then combining
that with the translation rules on our NAT device or PAT
device.
Only those devices that match that access control list
will actually get the benefit of the translation
as they go through that NAT router.
Another variation of that is maybe we
have two servers-- one is a web server on port 80,
and one's a web server with security on TCP port 443.
However, if we only have one IP address that's globally
reachable-- let's say we have 23.1.1.50
as our only reachable IP address from the internet,
we could set up an access control
list that says specifically, if the traffic is coming
in to that IP address on port 80,
then we're going to translate to this server right here.
We'll call it server B. And if the incoming request
is destined for TCP 443 based on the access control
list and the translation statement,
then we'll go ahead and forward that traffic over
to server A who's listening for those incoming requests
on port 443.
And when we're doing translation on a specific port like that,
that's commonly referred to as port forwarding
because we're basing the forwarding
decisions specifically on the port that is being requested.
Another great example of where we could use an access control
list is to identify traffic that we
want to give preferential or different treatment
to as that traffic crosses our various network devices.
An example could be traffic is crossing this wide area network
link that's connecting our corporate headquarters over
here on the left to this branch office over here on the right.
And wide-area network connectivity
is going to be relatively slower than our high-speed ethernet
connectivity up here generally speaking.
And if it is, we may have traffic
that needs to be sent back and forth over this link.
And there may not be enough bandwidth to send
all that traffic the moment it shows up at the router.
And the concept of traffic shaping is to help the routers
not just drop all the traffic, but rather
to queue it up and make sure that the data can be sent even
if there is temporary burst where we have more traffic
than we can send instantaneously.
Another performance-related concept
that can be used in conjunction with access control lists
is QoS, which is an acronym that stands for Quality of Service.
And as packets go into the network,
depending on what device they come from and what device
they're going into, we can do special manipulation--
or they call it marking of the packets--
in the IP header.
And then, we can train our routers
to pay attention to those markings.
So if we have a user like Bob--
actually a better example, if we had an application like voice
over IP, which is very sensitive to delays.
If we want to have a conversation,
and it's going over voice over IP network,
we can't tolerate large amounts of variations or delays.
So with quality of service, we could mark all that voice
over IP traffic with specific markings in the IP header.
And then, we could train the routers
that when they see that traffic, they
should give that traffic priority treatment
with the intent of making sure that our voice over IP
communications are working--
or at least working well enough so
that the users have functionality.
And when we're doing quality of service,
we're marking packets and treating various packets
differently at routers, that can be referred
to as differentiated services.
We're differentiating between one protocol or one set
of markings and another.
Differentiated services is what that's implying.
We can also do marking of traffic and prioritization
of traffic at layer 2 in switching.
And when that's done, that's often
referred to as paying attention or working with COS,
which is class of service.
So if we see someone referring to class of service,
we can think to ourselves, OK, that's dealing
with the preferential treatment based on layer 2 frame
markings.
And if we hear of the concept of diffserv or QoS,
quality of service that's going to be higher up in the protocol
stack, primarily focused on markings in the IP header
at layer 3.
I hope this has been informative for you.
And I'd like to thank you for viewing.