stateful connections ???

[shahidrox]

hi guys, i got some prob in ASA plz help me out,,

pc1-----------ASA----------pc2

outside inside

now see nat is disabled and i have given an accesslist to allow pc1

to ping pc2. till here it is working fine. now suppose i have issued a

continuous ping from pc1 to pc 2 it goes well but meantime from CLI i removed the access list ! but the ping is still going !!!! if i stop it n

then issue ping again it is not going as expected, but my question is

why didnt it stopped when i removed the accesslist ???

heres my own guess, because the connection was formed already in ASA

stateful table so it was allowing it to go, so is it possible that if i

changed or modify an access list it takes the action immediately ? is

there any command for that ??? becoz i m having a lot of problem in testing

time

based acls they r simply not at all working with ASA, i m using 7.0 ios

so

any help plz ???

[drolemc]

If you remove the access-list and save it the action will be taken immediately

[jgervia_2]

You are correct.

Access list changes only apply to new connections initiated through the firewall. Existing connections (prior to your changes) keep going through the firewall unless you clear them.

You can do a 'show conn' to see what the connections are through your firewall.

--Jason

Please rate this message if it solved some/all of your question/issue.