How to configure a list of reflexive access controls on a router

The reflexive access list automatically creates a control list in the opposite direction based on the access control list in one direction and reverses the source and destination addresses of the original control list-ip, and a list of the exact opposite of the source port number and destination port number. So how do you complete the configuration of the reflexive access control list on the router? Let's start with the following steps:

Note must be internally initiated! Done with a named ACL.

Not very well understood, look for an example.

First look at the following:

IP access-list extended ABC deny ICMP any 192.168.1.0 0.0.0.255 permit IP "any" exit int s0/0 IP access-group ABC in

This ACL is to prohibit the extranet to ping intranet 192.168.1.0/24 this network segment, but if I from 192.168.1.1 to ping the extranet can ping pass?

It's not through!! Remember, communication is two-way! The traffic that restricts one side is not going to make sense!!

Let's look at the reflexive ACL again;

IP Access-list Extended Refin

permit OSPF any

Eva luate ABC ' NOTE this statement!

Exit

IP Access-list Extended refout

Permit IP any any reflect ABC ' and this one!

Exit

int s0/0

IP Access-group Refin in

IP Access-group rofut out

Exit

IP reflexive-list Timeout 60

Take a closer look first, in the interface in the direction of only one OSPF protocol, other access is prohibited, that is, do not allow extranet access to the intranet. Eva Luate ABC is nested with a reflection ACL named ABC.

In the out direction of the interface, allow all access, remember just mentioned; can go out but not come back!!! So add a reflect ABC after permit IP any, that is, any traffic originating from the intranet if it matches the permit IP any any reflect ABC statement, A dynamic permit statement is automatically created in the Refin list! You can see with show access-lists! It's not easy to transfer the source destination address in this entry! It's a detailed entry!

Remember, the reflexive ACL is always permit, do an experiment to understand it well!

IP reflexive-list Timeout 60 sets the valid time for the reflected entry!

More Wonderful content: http://www.bianceng.cnhttp://www.bianceng.cn/Network/lyjs/