How to use a reflexive ACL to restrict extranet access

ACL can limit network traffic, improve network performance, in order to protect intranet security, can only allow intranet access to extranet, not allow extranet access intranet, here using the Cisco router's reflexive ACL to achieve. Users need to configure routing protocols, and the following are configured with Rip Version1, or they can be configured with other, such as EIGRP or OSPF.

Reflexive ACL for intranet access to extranet

r1>en

R1#conf T

Enter configuration commands, one per line. End With cntl/z.

R1 (config) #ip access-list extended aclout Create an ACL

R1 (CONFIG-EXT-NACL) #permit TCP Any any reflect TCP customizations the entry is reflexive, and the name is TCP

Reflexive ACL of extranet access intranet

R1 (config) #ip Access-list extended Aclin

R1 (CONFIG-EXT-NACL) #evaluate TCP generates a reflexive list (the first step to generate a reflexive ACL is TCP, so the corresponding name is TCP)

R1 (CONFIG-EXT-NACL) #permit UDP any any

Apply a reflexive ALC to the appropriate interface

R1 (config) #int FA0/1 extranet interface

R1 (config-if) #ip Access-group aclout out

R1 (config-if) #ip Access-group Aclin in

After the PC can only ping through the net, but can not ping the intranet.

ACL restrictions on the configuration of external access to the introduction of the end, I hope you have mastered.