topic Use time range to activate rules in Network Security

Use time range to activate rules

paddy.d — Fri, 21 Feb 2020 15:38:33 GMT

Hello,

I am trying to use a timerange to setup a any any block on my inside interface. This appears to work pretty well as when the time starts it is not possible to start a new connection. However existing connections appear to not get dropped. For instance a secure connection to out netscalers at work (from my home) will stay functional. What am I missing? or what do I need to do to terminate these existing connections?

Thnks for your help!!

Re: Use time range to activate rules

Ajay Saini — Wed, 18 Apr 2018 05:48:29 GMT

Hello,

Adding a deny access rule only blocks the new connections that will be initiated, it does not drop any existing connections. Thats the way ASA is designed, for existing connections, interface acl check is bypassed. Only when you clear the connections, this new time based acl will come into effect for all the connections.

clear conn will do the needful but that is a manual step, maybe you can try a EEM script to add the clear conn command then followed by the time based acl addition. We have to make sure that there not much time difference between clear conn and acl addition else the connection initiated between this time will survive the acl.

Similar discussion:

https://supportforums.cisco.com/t5/firewalling/asa5520-acl-established-connections-problem/td-p/1874604

EEM script:

https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/117883-config-eem-00.html

Please rate helpful posts.

HTH

Re: Use time range to activate rules

paddy.d — Wed, 18 Apr 2018 08:57:56 GMT

Thanks for the explanation!

I guess it saves a lot of processing to do it this way and that is better for for the performance en throughput. I will have a go with eem. I have not used that before so should be interesting.

Thanks again

Patrick