Mid-Session Firewall Policy Update - Cisco ASR 5000 series Product Overview

▀ How Personal Stateful Firewall Works
If the AAA/OCS sends the SN-Firewall-Policy AVP with the string ―disable‖, the locally configured firewall
policy does not get applied.
If the SN-Firewall-Policy AVP is received with the string ―NULL‖, the existing policy will continue.
If the SN-Firewall-Policy AVP is received with a name that is not configured locally, the subscriber session is
terminated.

Mid-session Firewall Policy Update

The Firewall-and-NAT policy can be updated mid-session provided firewall policy was enabled during call setup.
Important:
no action taken as the Firewall-and-NAT policy cannot be disabled dynamically. The policy currently applied will
continue.
Important:
is disabled, also ECS sessions for the subscribers are dropped. In case of session recovery, the calls are recovered but
with Stateful Firewall disabled.
How it Works
The following figures illustrate packet flow in Stateful Firewall processing for a subscriber.
▄ Cisco ASR 5000 Series Product Overview
When the firewall AVP contains ―disable‖ during mid-session firewall policy change, there will be
When a Firewall-and-NAT policy is deleted, for all subscribers using the policy, Firewall processing
Personal Stateful Firewall Overview
OL-22938-02