Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
New Member

stateful connections ???

hi guys, i got some prob in ASA plz help me out,,

pc1-----------ASA----------pc2

outside inside

now see nat is disabled and i have given an accesslist to allow pc1

to ping pc2. till here it is working fine. now suppose i have issued a

continuous ping from pc1 to pc 2 it goes well but meantime from CLI i removed the access list ! but the ping is still going !!!! if i stop it n

then issue ping again it is not going as expected, but my question is

why didnt it stopped when i removed the accesslist ???

heres my own guess, because the connection was formed already in ASA

stateful table so it was allowing it to go, so is it possible that if i

changed or modify an access list it takes the action immediately ? is

there any command for that ??? becoz i m having a lot of problem in testing

time

based acls they r simply not at all working with ASA, i m using 7.0 ios

so

any help plz ???

3 REPLIES

Re: stateful connections ???

You're right. It will still pinging because the connection table for the existing ping session is still active. It will only gone if you manually stop the ping or issue 'cle xlate' command.

Use the 'clear xlate' everytime you want to clear the connection

http://www.cisco.com/en/US/customer/products/ps6120/products_command_reference_chapter09186a008063f0de.html#wp2029296

HTH

AK

New Member

Re: stateful connections ???

but dont u think this is inconvenient ?? like if there are 2 outside users connected to my webserver n i want to block 1 of them so i designed an acl but if i clear xlate then both of the connections will be reset !!! is there any other way

Re: stateful connections ???

Another way is to use "clear local-host " command.

FWALL#clear local-host 10.1.1.15

This will clear the network state of a local host stops all network connections and xlates that are associated ONLY with the local hosts.

AK

191
Views
0
Helpful
3
Replies
CreatePlease to create content