UC520 - Dropping sessions

[Eivind Jonassen]

Hi,

I'm curious about a strange FW behavior. If i use the following command:

interface FastEthernet0/0

no ip access-group 108 in

make some adjustments to the acl, and the enable the access-list again with the command:

interface FastEthernet0/0

ip access-group 108 in

The FW drops any existing TCP sessions. WHY?

My test was that I did a SSH session to a remote server. I used the commands above without making changes to the ACL, but still the SSH session is dropped. If I unplug my network cable and reconnect it within 3 seconds, the session is not dropped (just had to test it).

Could anyone explain why the FW is dropping sessions when disabling and enabling the ACL??

Thanks,

Eivind

[Steven DiStefano · Accepted solution]

Just a thought...

I wonder if the application of the ACL on the interface after a TCP connection is established doesnt recognize the start of the session and maybe thinks its 'half open' and drops it?