Policy rematch

When a security policy associated with an active session is changed, renamed, deactivated, or deleted, the session can remain active if it matches another policy that would allow the session. If a match occurs, the new policy is applied to the session, along with the new scheduler (if any), but the session retains the timeout value of the old policy. Use the following CLI command to enable the global setting for the policy rematch capability: set security policies policy-rematch extensive By default, an active session is closed if its associated security policy is renamed, deactivated, or deleted. If policy-rematch is specified without extensive, a rematch is attempted only for changed policies, and a session is closed if it no longer matches the modified policy.