Grzegorz Janoszka wrote:
Matlock, Kenneth L wrote:
So from then on, I've always removed the ACL from the interface,
removed the ACL, rebuilt it, and re-applied it to the interface. If
you have the lines copied into a clipboard, you can paste the stuff in
fairly quickly, and not really allow much 'bad' traffic in.
The simplest thing is to prepare a file containing "no acl XXX" and then
redefinition of the acl, put it of tftp server and load it using:
copy tftp://I.P.I.P/acl running-config
You do not need any extra tricks to do it, like temporary acl's and do on.
I don't believe that this is instantaneous. This still has the problem
of blocking at least some traffic while the lines of config are loaded.
While this may not be perceived as a big problem for some networks and
some traffic patterns, this will kill TCP sessions when the either end
receives a TCP reset. I suspect that it will also jack with SIP and
MGCP sessions when an ICMP port unreachable is sent in response to
reject RTP datagrams. That wouldn't be good.
What's needed is to not reject any packets. The only ways I can see
that happening is to either switch ACLs or remove the ACL from interface
before you add the first line to it. That is until Cisco adds a way to
let us make ACL changes and control when they are committed and
compiled. It seems like I read something about something added to the
later 12.4T code to make ACL updates easier. I'll have to dig out the
release notes to read up on it.
Justin
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
