time acls on ASA ios 7.0

[shaila_rox]

hi in lab i have ASA 5510 with 7.0,,,

the clock set on my ASA was 22:15:23

i defined a time range

time-range abc

absolute end 22:18 24 jan 2007

now i m using inside ( 10.0.0.0) and outside (20.0.0.0)interfaces. my access list is

access-list 1 permit ip host 20.0.0.1 host 10.0.0.1 time-range abc

access-group 1 in interface outside

now at outside interface i have a pc attached with ip 20.0.0.1, i issued a ping command ping 10.0.0.1 -t and my ping was going successful but when my time expires so ping should also be stopped automatically right ?? but it didnt !! wats the problem is it a bug in ios or i m doing something wrong becoz as far as i know time based acls deny access after defined time but it was not happening in my case plz tell me how to use time acls

[scheikhnajib]

Have you tried to stop the ping and start it again just outside your ALLOW time ???

[shaila_rox]

yes it stopped after my allowed time !!! but i think acl should have done it not me, or else wats the use of time acl ??

[Fernando_Meza]

Hi .. access list checks traffic flow .. meaning that if a connections has been succesfully established .. then the rest of the packets belonging to the already established session will also be allowed. even if you modify the access list to deny a previously allowed connection, will not take effect until that connection has finished or it has been forced to re-established.

In your situation the time range will take effect for NEW attempts after the time range abc has expired.

I hope it helps .. please rate it if it does !!

[shaila_rox]

then i think that purpose of time acls is failed becoz if it cannot deny the existing connections itself then wats the use ??? wat u think ???

[alanajjar]

Hi,

please try to change the access list number to be in the extended range (100-199), you use the standard access list number 1 to define extended access list, hope it will benefit.

[shaila_rox]

i dont think that really matters but still i will try lets hope it works

[scheikhnajib]

Mate,

technically speaking it should be OK for you since PING is a special case traffic. I don't think that you are after stopping PING using a time ACL. If you want to stop HTTP or SMTP for istance, your ACL will be OK and the last connections to be allowed are the ones that are already opened; any new connection will be denied.

Cheers.

[shaila_rox]

so wats the use then ??? time acl should take action when the time expires right ? wats the use if there are any existing connections remained opened.