Re: Network Access Control Changes - Firewall and ACL policy changes

[David LaPorte <david_laporte () HARVARD EDU>]

You should be able to get around this issue on the FWSM with the
"access-list mode manual" and "access-list commit".  This link has a bit
more info (requires a CCO login):

http://www.cisco.com/en/US/customer/docs/security/fwsm/fwsm22/configuration/guide/mngacl.html#wp1227762

Dave

Luke Sheppard wrote:
> I have found that the Cisco FWSM needs a manual shutdown/no-shut of the interface if making acl changes via the 
> command-line IOS. But if you use the web browser GUI you can add interstitial acl changes on-the-fly with no down 
> time. This is very convenient for quick one-off changes, but irritating if you are used to scripting everything.
>
> I have also heard, anecdotally, that the Junipers can have problems (brain dead) if the acls get too big. Sorry, I 
> have to actual metrics for this.
>
> Luke