Reflect-acl Configuration Guide

introduction introduction reflective acl is a state based dynamic access control technology primarily used for network security protection its core principle involves monitoring outbound sessions initiated from the internal network to automatically generate temporary reverse rules these rules permit response traffic to return while blocking unauthorized access initiated from external sources reflect acl configuration reflect acl configuration create reflect acl table create reflect acl table operation command description enter the system configuration view configure terminal create and enter the system configuration view access list {reflect l3|reflect l3v6} string {ingress|egress} \[des crip string ] l3/l3v6 matching filter l3/l3v6 matching filter keywords description ip protocol ip protocol type, can be configured using either the numeric value or protocol name src ip source ip address (with subnet mask), e g , "10 1 1 1/24" dst ip destination ip address (with subnet mask), e g , "10 1 1 1/24" src port protocol source port number dst port protocol destination port number dst dns group dns field, see chapter 14 for details geosite geosite field, see chapter 15 for details geoip geoip field, see chapter 15 for details example of reflect acl configuration example of reflect acl configuration network requirements interface 1 of the router connects to internal network users, while interface 2 connects to the internet configure a reflexive acl on the outbound direction of interface 2 internal network hosts must first access servers on the internet before internet servers are permitted to access internal network hosts procedure sonic(config)# access list reflect l3 test egress sonic(config reflect l3 acl test)# rule 1 src ip 80 0 0 100 packet action permit sonic(config reflect l3 acl test)# exit sonic(config)# interface ethernet 2 sonic(config if 2)# acl test