[c-nsp] CBAC and fragmented packets

[Victor Sudakov]

Victor Sudakov wrote:
> As soon as I enable CBAC on the outside interface:
> 
> interface Serial0/0
>  ip access-group DENY_ALL in
>  ip inspect FOO out
> 
> those non-initial fragments stop arriving. I think CBAC does not
> create dynamic ACL entries for the fragments for some reason. 

This must be CSCdu30492 and CSCdx17419. 

-- 
Victor Sudakov,  VAS4-RIPE, VAS47-RIPN
sip:sudakov at sibptus.tomsk.ru