| 3.2 |  | Types of IP ACLs |
| 3.2.7 |  | TIme-based ACLs using time ranges |

| While similar to extended ACLs in function, time-based ACLs allow for access control based on time. To implement time-based ACLs, a time range is created that defines specific times of the day and week. The time range is identified by a name and then referenced by a function. Therefore, the time restrictions are imposed on the function itself. The time range relies on the router system clock. The router clock can be used, but the feature works best with Network Time Protocol (NTP) synchronization.

Time-based ACLs can be applied to the interface to block specific traffic during specified times. They may also be applied to NAT, which can control Internet access to internal hosts.

Time of Day guidelines:

- If both the absolute and periodic commands are specified for a range, then the periodic items are evaluated only after the absolute start time is reached. The items are not further evaluated after the absolute end time is reached.
- Only one absolute entry is allowed per time-range command.
- If no start time is specified, then the range is in effect right away, if no end time is specified then the range goes on forever.
- Earliest Date is January 1st 1993
- If no days are specified for the days-of-the-week, then all days are used

In Figure , a Telnet connection is permitted from inside to the outside network on Monday, Wednesday, and Friday during business hours.

| Media Activity Demonstration Activity: Time-Based ACLs In this activity, students will learn how to implement time-based ACLs.

| Lab Activity Lab Exercise : Time-Based ACLs In this lab, students will learn how to accomplish the following objectives:

- Apply time ranges to ACLs
- Apply ACLs to interfaces
- Define a time range
- Verify a time range