Cisco ASR 5000 Series, Обзор продукта

Страница: 918 / 992

Personal Stateful Firewall Overview
▀ How Personal Stateful Firewall Works
▄ Cisco ASR 5000 Series Product Overview
OL-22938-02
If the AAA/OCS sends the SN-Firewall-Policy AVP with the string ―disable‖, the locally configured firewall
policy does not get applied.
If the SN-Firewall-Policy AVP is received with the string ―NULL‖, the existing policy will continue.
If the SN-Firewall-Policy AVP is received with a name that is not configured locally, the subscriber session is
terminated.
Mid-session Firewall Policy Update
The Firewall-and-NAT policy can be updated mid-session provided firewall policy was enabled during call setup.
Important:
When the firewall AVP contains ―disable‖ during mid-session firewall policy change, there will be
no action taken as the Firewall-and-NAT policy cannot be disabled dynamically. The policy currently applied will
continue.
Important:
When a Firewall-and-NAT policy is deleted, for all subscribers using the policy, Firewall processing
is disabled, also ECS sessions for the subscribers are dropped. In case of session recovery, the calls are recovered but
with Stateful Firewall disabled.
How it Works
The following figures illustrate packet flow in Stateful Firewall processing for a subscriber.