A packet is matched against the rule base only when a new connection is established. Like Ray said, keeping all connections after changing the policy will not enforce the new policy on existing connections. For some, this can be a security issue.
Regards, Neil Delacruz On 7/11/06, Ray <[EMAIL PROTECTED]> wrote:
Odd. I use "rematch" and do not have this issue, running R55 HFA17 on IPSO 3.9, no VRRP. Bear in mind that "keep" will keep all existing connections even if the new security policy does not allow them. They will persist until they end themselves. Ray >From: Peter Addy <[EMAIL PROTECTED]> >Reply-To: Mailing list for discussion of Firewall-1 ><[email protected]> >To: [email protected] >Subject: Re: [FW-1] Policy Push >Date: Tue, 11 Jul 2006 14:11:15 -0700 > >Excellent sorted, many thanks > >cisco4ng <[EMAIL PROTECTED]> wrote: You should stick with "keep all >connections". that way your vpn will not go > down after a policy is pushed. > > > >Peter Addy <[EMAIL PROTECTED]> wrote: > Hi > >Does anyone know why vpn connections would break each time a policy was >pushed to a piar of firewalls running NGAI R55 ipso 3.9 running vrrp nokia >IP740 > >Vpn connectrions are only restored after another policy push, not seen this >one before ?? > >We have rematch connections set for each policy install >Thanks again > > >--------------------------------- >Talk is cheap. Use Yahoo! Messenger to make PC-to-Phone calls. Great rates >starting at 1¢/min. > >================================================= >To set vacation, Out-Of-Office, or away messages, >send an email to [EMAIL PROTECTED] >in the BODY of the email add: >set fw-1-mailinglist nomail >================================================= >To unsubscribe from this mailing list, >please see the instructions at >http://www.checkpoint.com/services/mailing.html >================================================= >If you have any questions on how to change your >subscription options, email >[EMAIL PROTECTED] >================================================= > > >--------------------------------- > Yahoo! Messenger with Voice. Make PC-to-Phone Calls to the US (and 30+ >countries) for 2¢/min or less. > > >--------------------------------- >Want to be your own boss? Learn how on Yahoo! Small Business. > >================================================= >To set vacation, Out-Of-Office, or away messages, >send an email to [EMAIL PROTECTED] >in the BODY of the email add: >set fw-1-mailinglist nomail >================================================= >To unsubscribe from this mailing list, >please see the instructions at >http://www.checkpoint.com/services/mailing.html >================================================= >If you have any questions on how to change your >subscription options, email >[EMAIL PROTECTED] >================================================= ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
