Application of reverse access list in practice

Reverse access list

There are five VLANs: Management (63), office (48), business (49), finance (50), and home (51 ).
Requirement: management can access others, while others cannot access management, and other VLANs cannot access each other!
Other applications are not affected, for example, accessing the INTERNET through the connection.

Method 1: only the interface for VLAN management is configured, and other VLAN interfaces are not configured.

Place reflect in the Inbound direction
Ip access-list extended infilter
Permit ip any reflect cciepass
!
Place evaluate in the outbound direction
Ip access-list extended outfilter
Evaluate cciepass
Deny ip 10.54.48.0 0.0.255 any
Deny ip 10.54.49.0.0.0.0.255 any
Deny ip 10.54.50.0 0.0.255 any
Deny ip 10.54.51.0 0.0.0.255 any
Permit ip any
! Application to Management Interface
Int vlan 63
Ip access-group infilter in
Ip access-group outfilter out

Method 2: do not place any access lists on the Management VLAN interface, but place them on other VLAN interfaces.
Take office VLAN as an example:
Place reflect in the outbound direction
Ip access-list extended outfilter
Permit ip any reflect cciepass
!
Place evaluate in the Inbound direction
Ip access-list extended infilter
Deny ip 10.54.48.0 0.0.0.255 10.54.49.0 0.0.0.255
Deny ip 10.54.48.0 0.0.0.255 10.54.50.0 0.0.0.255
Deny ip 10.54.48.0 0.0.0.255 10.54.51.0 0.0.0.255
Deny ip 10.54.48.0 0.0.0.255 10.54.63.0 0.0.0.255
Evaluate cciepass
Permit ip any
!
Application to office VLAN interface:
Int vlan 48
Ip access-group infilter in
Ip access-group outfilter out
Summary:
1) Reflect is placed in the allowed direction and can be pushed in and out)
2) The configuration on the Management VLAN is simple, but it is better to put it directly on all other VLANs.
3) if placed on the internal network port: Set Reflect on the inbound
If you place Reflect at the outer network port: place Reflect at the exit

LAN WAN
-
Inbound outbound

4) reflect does not track data packets on the local router. Therefore, you must allow some data streams to access the incoming data packets.