Study of Network Optimization Method Based on ACL

Transcription

1 Available online at Proceia Engineering 5 (20) Avance in Control Engineering an Information Science Stuy of Network Optimization Metho Base on ACL Liu Zhian * Department of Information engineering an management of Baoing Electric Power VOC.&TECH. College,0705, Lekai Street NO 278, Baoing, China, 0705 Abstract ACL acts as an important role in network access control, network traffic flow ientify an network strategy implement, ACL esigning an application will eviently affect on network performance. To ecreasing packet access control elay an improving the efficiency of packet transformation this paper stuy two methos of ACL esigning an application on comparison. By mathematic analyzing the packet transferring they make ifferent effect on network performance with variable network loa, an can optimize network performance with appropriate application. The experiment with result analysis valiates the methos, an is provie as the reference to network optimization. 20 Publishe by Elsevier Lt. Selection an/or peer-review uner responsibility of [CEIS 20] Open access uner CC BY-NC-ND license. Keywors: Type your keywors here, separate by semicolons ;. Introuction ACL(Access Control List) is a set of instructions applie on the network evice interface, which is use to inicate whether or not enable the ata package go through[] an plays an important role in the implement of network eploy. ACL can control ata stream s pass through, allocate inter host machine to fulfill network aress transition, ientify or classify ata flow to realize some avance applications such as QoS an lining, an limit router s upate[2]. ACL s working principle is that: first, ACL compares the flow an instruction in the list one by one, once a matche instruction is foun, then execute operation as the instruction shows(permit or eny); if no matche instruction is foun, then act as efault[3]. In the implement of network eploy, ACL may also brings some ill effect to the network performance, for example, the check of every ata package on the network evices will increase the propagation elay, * aress: yubing2000@63.com Publishe by Elsevier Lt. oi:0.06/j.proeng Open access uner CC BY-NC-ND license.

2 3960 Liu Zhian / Proceia Engineering 5 (20) an the ACL with esign flaws may heavy the network evices buren, an so on[2]. This all will irectly ecrease the network overall performance, so to get optimize network we must esign highefficiency ACL. [4] stuy ACL instruction s crossing, covering or incluing etc. logic relation an present an optimization metho base on these logic relation, but it oesn t optimize the ACL eploy. This paper analyze the ACL eploy optimize on the evice an present two optimize methos. 2. Optimize algorithm 2.. Algorithm moel Base on the network esign moel[2], we implement flow control an optimize eploy on the istribution layer. To escribe the optimization algorithm clearly, this paper abstract the actual network environment an buil the moel topological showe as in Figure. Internet Core Layer I out Distribution Layer I in I in2 I in3 I c Access Layer Figure Network Abstract Moel Topological Grapy Explanations: I out : the total out interface of ata package collecting, generally only has one I out interface (expect the backup interface an loa balancing interface);

3 Liu Zhian / Proceia Engineering 5 (20) I in : the ata package inflow interface from the input layer, always has multi-i in interfaces, now assume the interface number is I c (I c >); p i : the spee of the interface sening ata packages, means how many ata packages the interface i sen into the evice in one secon; P: the spee of the evice receipt the ata package, means the total number of the ata packages receive in one secon, the relation of those items is shown in Equation : I = c p i P () This paper put the ACL on the two positions of the istribution network evices: I out or each I in. When the ata traffic changes, ACL on ifferent position may bring ifferent influence: Metho : ACL applie on each I in. Here every ACL running will consume network evice resource, more ACL, consuming more resource, which reucing the evice efficiency. Metho 2: All the ACL applie on the Iout. When one ACL instruction use to impact a ata package, it brings time elay; an if here is large number of ata package an ACL instructions, the time elay is grievous, the network efficiency is reuce too Optimization algorithm ) Aime at metho, we take quantitative analysis, an present the network optimization algorithm. First, we efine our network optimization target is the network total efficiency s improve, the main content is that: a) Cut own the average time elay of the ata package transmitting in the network, we name it ; b) Improve network evice ata package transmit spee P. So is: a = (2) n c n= I For n = p i Δt rn / 2 (3) From Equation, the Equation 2 can be change into Equation 4 a = P Δt ri /( I c * 2) (4) Here, r n (r n >=) is the ACL instruction number applie on the port n; Δ t ( Δ t >0)is the time elay cause by matching one ACL instruction to a ata package. 2) Aime at metho 2, in which all ACL are applie on one interface, we nee to combine the ACLs which have equivalent function. After combination the parameter is: I c b = P Δt ri ( s) / 2 (5) Here s(0<=s<=) is the ACL instruction s repetition frequency. 3) Contrast the two methos:

4 3962 Liu Zhian / Proceia Engineering 5 (20) C = a b P Δt = P Δt ri (/ 2) = ( s) r ( s) / 2 i Equation 6 shows the two methos efficiency is concerne with interface number an instruction s repetition frequency. An we fin the following regular pattern: 3. Experiment s (6) a) When I c >, that is Equation 5 s value is below, metho is superior to metho 2. b) When I c < that is Equation 5 s value is above, metho 2 is superior to metho. s Accoring the above two methos, following [5], this paper test in the campus network. The test s topological graph is shown in Figure. The access layer employ D-link Smarty link with 24 interfaces, which ivie 24 VLAN. The istribution layer use CISCO TS-E, an use optical fiber join into kernel layer switchboar. The test aopts fixe interface, through altering the instruction eploy an instruction s repetition frequency, an looking into the IP ata package s average throughout use the comman show ip interface, then figure out the time elay of every ata package in the network evices, which is shown in Figure 2. Figure 2 Test contrast of the metho an metho 2 The test result entirely show the feature of metho an metho 2, but the efficiency o not proportional change with C, the major reason is that: the whole network ata package average throughout is irregular

5 Liu Zhian / Proceia Engineering 5 (20) an can t be precisely controlle, an here is too many confouning factors, so the peak values are too ifferent; The selecte network evice processing ability is strong, an the network loa is small, so that time elay cause by each ACL instruction is small; each iniviual ACL process consume ifferent network equipment resources an so on. 4. Conclusion In this paper, network optimization base on two methos of ACL are analyze an stuie by quantitative analysis, an conucte the corresponing experiment, the experimental results are analyze. However ACL aoption an eployment s influence to the network performance are complex, the paper o not consier the network throughput, network equipment resource occupation an other factors, these will be the next step of the research work. References [] Wikipeia. Access control list [2] Allan Rei,Jim Lorenz,Cheryl Schmit. Introucing Routing an Switching in the Enterprise.. Beijing: Posts & Telecom Press.2008:20. [3] TANG Zi-jiao LI Hong-chan. Application of Network Security Management Base on ACL. Journal of Sichuan University of Science & Engineeing (Natural Sicence Eition) :48-5. [4] ZENG Kuang-Yi+;YANG Jia-Hai. Towars the Optimization of Access Control List.Journal of Software : [5] SHEN Zhong-cheng. The Application of ACL in Campus Network. COMPUTER KNOWLEDGE AND TECHNOLOGY :