Configure the self-reverse Access Control List on the vro

Self-CountermeasureThe access list willAccess Control List, Automatically create a list of Reverse control, which is a list that is reversed from the original control list-IP Source Address and destination address, and the source port number is exactly the opposite of the destination port number. So how do I configure the self-reverse Access Control List on the vro? Next we will start gradually:

Note that it must be initiated internally! Use the named ACL.

Not very understandable. Let's look at an example.

Let's take a look at the following:

 
 

  
  
ip access-list extended abc 
  
  
deny icmp any 192.168.1.0 0.0.0.255  
  
  
permit ip any any  
  
  
exit  
  
  
int s0/0  
  
  
ip access-group abc in 
 
 

This ACL prohibits the Internet from pinging the network segment 192.168.1.0/24 on the Intranet. But can I ping the Internet from 192.168.1.1?

No !! Remember, communication is bidirectional! The traffic on one side is blocked !!

Next let's look at the self-anti-ACL;

1. Ip access-list extended refin
2. Permit ospf any
3. Evaluate abc 'pay attention to this statement!
4. Exit
5. Ip access-list extended refout
6. Permit ip any reflect abc 'and this one!
7. Exit
8. Int s0/0
9. Ip access-group refin in
10. Ip access-group rofut out
11. Exit
12. Ip reflexive-list timeout 60

Take a closer look. First, only one ospf protocol is allowed in the in direction of the interface. Other accesses are forbidden, that is, the Internet is not allowed to access the Intranet. Evaluate abc is nested with a reflection ACL named abc.

In the out direction of the interface, allow all accesses. Remember what you just mentioned. You can go out, but you cannot return !!! Therefore, a reflect abc is added after the permit ip any, that is, if any traffic initiated from the Intranet matches the permit ip any reflect abc statement, A dynamic permit statement is automatically created in the refin list! Use show access-lists to view the results! It's not easy to call the source destination address in this entry! It's a detailed entry!

Remember, the self-reverse ACL is always permit. Let's take a good look at it!

Ip reflexive-list timeout 60 sets the effective time of the reflected entries!

1. Access Control List ACL Technology
2. Application of Cisco anti-DDoS Control List
3. Application of cisco Dynamic Access Control List
4. Change the ACL Access Control List of a public folder)
5. Access Control List ACL in typical Secpath configuration)