topic Re: Time based rules and resetting connections that are active once the time based rule ends in General Topics

Time based rules and resetting connections that are active once the time based rule ends

Andrew_Tindall — Thu, 18 Mar 2021 13:32:10 GMT

We have a requirement to allow outbound SSH access, but only at certain times of the day as part of a new solution to be implemented.

From my understanding we can create a time based rule to allow this, and during this time frame new SSH connections would be allowed as per the rule.And not outside of the allowed timeframe.

However the connection would not torn down that had already been established that matched this rule during the time it was active once the rule was past it's time to allow the traffic?

Is there a simple way to achive this?

Thanks,

Andy.

Re: Time based rules and resetting connections that are active once the time based rule ends

PhoneBoy — Thu, 18 Mar 2021 14:30:35 GMT

We only check the time component when the connection is established.
Its not something we check on an ongoing basis.

An “easy” way to do this would be an RFE.
That said, with a little scripting, you could probably achieve what you’re after.
Ultimately, you can kill in-progress connections with fw sam, sam erdos, or similar using a cron job.
I believe you can just kill all ssh connections to the Internet with a single command, the exact nature of which depends on where the gateway sits in the network (it has to be done by IP).

Re: Time based rules and resetting connections that are active once the time based rule ends

Timothy_Hall — Thu, 18 Mar 2021 16:04:55 GMT

Assuming you have Connection Persistence set to "Rematch all connections", I suppose you could execute a fw fetchlocal on the gateway via cron right at the start of the timeframe where SSH is no longer allowed. This will invoke a rematch operation, which I believe will close the expired SSH connections. There does not seem to be a way to kick off only a rematch operation without doing a full policy reinstall that I can find. For more info about the rematch operation see Scenario 1 here: sk103598: Connectivity Issues after Policy Install