Strange behavior of PIX 515 after changes to ACL's

[Scorpizz]

Hi

Just had a strange problem with Cisco pix 515.
I made a lot of changes to the Access-lists, some was removed, a lot was modified and some new was added.
I did it in the CLI with cut&paste of all the access-lists within. First removed all the acl's with "no" in front and then added them again with the changes.
But after some time the firewall stopped working......
(30-60 min. after last change / "write mem")
When looking at the running config and the stored config, everything was in place, but it blocked all traffic in both directions. When looking in the web interface, all acl's was gone.... but still visible in the CLI !!!????
After reload and even a power off/on the problem was still there. Then I cleared the NVram and put in a backup of the configuration and then it was working again.
But - isn’t there an easier way ??? A cache or a buffer to clear instead ?
Just like the "clear xlate" when modification is done to the static NAT entries.....

Thank you in advance

 

[308win]

Did your access-group commands get deleted also? If you delete an entire access-list the corresponding access group command will be deleted also. That sort of sounds like what happened except you say it took 30-60 min for it to happen. Is it possible that it took 30-60 for it to be noticed?

Did you compare your archive copy with what was in production? (Have you checked out Cattools

http://www.kiwisyslog.com

to automate that process?)

 

[Scorpizz]

Thanks for your reply.
It could be the case... regarding the group commands as well as the late response.
Just that I'm pretty sure that I tested some of the issues solved with the new ACL.
Any way - I did a new restore of the NVram and this time with all the new changes included, and this time it seems to be working as expected.
I think that your point regarding group commands are right !

Thanks for your help
Best regards,-