Configure self-anti-ACL

Self-anti-ACL Configuration requirement: RA is the company's border router. Only Intranet users are allowed to actively access the TCP traffic of the Internet. All traffic of the Internet to access the Intranet is rejected: in the Inbound direction of the RA Outer Port, you must reject all traffic actively initiated by the Internet, but you must be able to allow traffic initiated by the Intranet and returned by the Internet, otherwise, the traffic initiated by the Intranet cannot communicate properly. <interface and route configuration omitted> Step 1: Define the ACLRA (config) for Intranet access to the Internet) # ip access-list extended REFINRA (config-ext-nacl) # permit tcp 192.168.1.0 0.0.255 any reflect TCP // specify to execute self-inversion on this statement, step 2: Define ACLRA (config) for Internet access to the Intranet # ip access-list extended REFOUTRA (config-ext-nacl) # evaluate TCP // calculate and generate the self-counter list (perform self-counter calculation on the entries defined in step 1 with the name of TCP and generate corresponding entries) RA (config-ext-nacl) # deny ip any step 3: Apply the self-counter list created to the corresponding interface RA (config) # int f0/0 // intranet interface RA (config-if) # ip access-group REFIN in // ACLRA (config) of the Internet accessed by the intranet user of the application # int s0/0 // RA (config-if) of the Internet interface) # ip access-group REFOUT in // apply the ACL for Internet access to the Intranet. Note: The self-reverse ACL can only be defined in the named extended ACL. 1. view the configured anti-ACLRA # sh ip access-listsReflexive IP access list TCP Extended IP access list REFIN10 evaluate TCP20 deny ip any anyExtended IP access list REFOUT 10 permit tcp 192.168.1.0 0.0.255 any reflect TCP 2. intranet user 192.168.1.2 telnet 202.155.144.2telnet 202.155.144.2Trying 202.155.144.2... open 3. view the configured self-reverse ACLRA # sh ip access-listsReflexive IP access list TCP permit tcp host 202.155.144.2 eq telnet host 192.168.1.2 eq 47361 (36 matches) (time left 285) // The self-counter list item that is triggered, extended IP access list REFIN10 evaluate TCP20 deny ip any anyExtended IP access list REFOUT 10 permit tcp 192.168.1.0 0.0.255 any reflect TCP (21 matches) 4 is automatically generated after the ing. in this case, any traffic that actively accesses the Intranet from the Internet is not allowed.