Access list affect

[elliot_adlerson]

I have the following concerns regarding access lists on ASA:

We've permitted the computer below to access the file server and from the computer, we've opened a doc file and made some changes.

Computer (192.168.1.10) > ASA > File Server (192.168.2.3)

while the doc file is still open on the computer, on the ASA I've changed the access list to deny but the interesting thing is the computer can still make changes to the document and save it on the file server.

Unless I run "clear conn address 192.168.1.10" then the access list change takes effect and block the traffic.

Why the ASA won't drop the traffic immediately? Is it by design? Is there any official document about this?

[Rob Ingram · Accepted solution]

@elliot_adlerson yes that is correct and by design.

Reference here

https://www.cisco.com/c/en/us/td/docs/security/asa/asa-cli-reference/A-H/asa-command-ref-A-H/clear-a-to-clear-k-commands.html#wp7335946330

"When you make security policy changes to the configuration, all new connections use the new security policy. Existing connections continue to use the policy that was configured at the time of the connection establishment. To ensure that all connections use the new policy, you need to disconnect the current connections so they can reconnect using the new policy using the clear conn command."

[elliot_adlerson]

@Rob Ingram 

many thanks for your reply I really appreciate it.