topic Time based ACL issue in Network Security

Time based ACL issue

CSCO12059485 — Tue, 12 Mar 2019 02:45:02 GMT

In my office network i have a cisco asa 5510. I configured a time based acl to drop all connections for specific time range. I realize that the acl will only block new connections, and it will continue the connections that are already exist. for example if I do a countinus ping to a pc, it will countinue the icmp traffic flow even after the ACL applied to the interface. I can use "clear conn all" command to drop all connections, but its not practical. please tell me how to drop connections or the interface to a specific time range.

Thank you

Time based ACL issue

cadet alain — Tue, 01 Oct 2013 08:30:03 GMT

Hi,

from where are you doing this ping ? if it is from the ASA then the ACL will never get hit as ACLs are only for transit traffic on the ASA.

Regards

Alain

Don't forget to rate helpful posts.

Time based ACL issue

CSCO12059485 — Tue, 01 Oct 2013 09:26:40 GMT

Thank you for your time Dear Alain

Im sending ping from a host that is in the INSIDE network to a pc in OUTSIDE. The Acl is applied to OUTSIDE interface in inbound direction.

Time based ACL issue

cadet alain — Tue, 01 Oct 2013 09:43:25 GMT

Hi,

are you inspecting ICMP ?

Regards

Alain

Don't forget to rate helpful posts.

Time based ACL issue

CSCO12059485 — Tue, 01 Oct 2013 10:34:35 GMT

No, im not inspecting any traffic.

if I use "show conn" command when the acl applied to the interface, it will show the icmp connection on the asa. if I use "clear conn all" command the ping will be droped and will not be able to start a new ping.

thanks