topic Re: schedule security rules in General Topics

schedule security rules

TerryZhou — Thu, 21 Jul 2022 05:17:32 GMT

I have 2 security rules, one needs to run office hours and one needs to run non-office hours. If the tcp session remains (not closed) can the same traffic use different security rules based on time ? or because the tcp session remains and it will stick with the current rule and never use the other security rule even the time changes?

Re: schedule security rules

aleksandar.astardzhiev — Thu, 21 Jul 2022 16:28:42 GMT

Hi @TerryZhou

Unfortunately that is correct - if sessions are established during the business hours, they will continue to run even after the schedule expire and will not use the second rule with schedule active for out of business hours.

However you can force policy lookup and those existing sessions to match the "out of business hours" rule.

In order to do that you need to force a commit with "Rematch Session" setting enabled under Device -> Setup -> Session

A commit with "rematch session" will force new policy lookup for currently active sessions. And since the "business hours" rule has expired traffic will match the "out of business hours" rule.

Few ways to trigger commit:

- Manually you can use "commit force" - since no change between running and candidate config, you need to use force

- If you running Panorama 10.1 and above you can schedule push from Panorama -> Schedule Config Push

- Using scripting magic and API to automate commit force at specific time

Re: schedule security rules

BPry — Thu, 21 Jul 2022 22:16:50 GMT

@TerryZhou,

Rather than forcing a commit as @aleksandar.astardzhiev suggested (this 100% works), I personally recommend scripting a session drop for anything matching the scheduled entry instead. This has an added benefit of not triggering a commit on a schedule in the event someone hasn't completely finished a change on the firewall, along with not failing if someone holds a lock or the config is invalid when the auto commit attempts to run.

/api/?type=op&cmd=<clear><session><all><filter><rule>[MyRule]</rule></filter></all></session></clear>&key=[key] # Replace [key] with API Key # Replace [MyRule] with name of scheduled entry