---
title: Time Restriction Policy Creation
slug: kronpam-reference-guide-3-9-0/time-restriction-policy-creation
docTags: 
createdAt: 2024-11-28T10:35:45.056Z
---

Time-based restrictions help regulate the CLI connections to network elements via Kron PAM. Time and command-based restrictions can be used together to best fit your security needs. The example below reflects a scenario that a service provider may experience often.

| **Time Interval**                            | **Authorization**                                                                   | **Explanation**                                                                                              |
| -------------------------------------------- | ----------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ |
| **Weekdays&#xD;**<br />**06:00-22:00**&#xD;  | Only monitoring commands.                                                           | Configuration commands are restricted due to potential effects on service.                                   |
| **Weekdays&#xD;**<br />**22:00 -02:00**&#xD; | All configuration commands except the service-uptime-affecting commands may be run. | Operators may run all configuration commands except commands such as “reboot”, “restart”, or “BGP shutdown”  |
| **Weekdays&#xD;**<br />**02:00-06:00**&#xD;  | All commands.<br />                                                                 | No restrictions on running commands                                                                          |
| **Weekend**                                  | Only monitoring commands.                                                           | Configuration commands are restricted due to potential effects on service.                                   |

There must be four time-based policies and three command-based policies covering all the alternatives from the table above.
*Time-Based Policies:*&#x20;
TBP 1: 06:00 – 22:00, Mon, Tue, Wed, Thu, Fri
TBP 2: 22:00 – 02:00, Mon, Tue, Wed, Thu, Fri
TBP 3: 02:00 – 06:00, Mon, Tue, Wed, Thu, Fri
TBP 4: Sat, Sun
*Command Based Policies*
Whitelist 1: .\*sh.\*
Blacklist 1: .\*rebo.\* , .\*resta.\* , .\*bgp.\*/s.\*shut.\*
Whitelist 2: .\*

The regular expression, “.\*” covers all of the command subsets. By using command and time-based policies together the scenario above would look like this:

-
  Weekdays 06:00 – 22:00: TBP 1 & Whitelist 1
-
  Weekdays 22:00 – 02:00: TBP 2 & Blacklist 1
-
  Weekdays 02:00 – 06:00: TBP 3 & Whitelist 2
-
  Weekend TBP 4 & Whitelist 1