Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

Bronze

how to make a reflexive access-list work for router traffic

I have three rtrs like rtrA<>rtrB<>rtrC. I want to use a reflexive access list on B between A<>B. I build it as an external list like:

rtrB

Int x/x

ip access-group inbound in

ip access-group outbound out

ip access-list ext inbound

evaluate reflst1

ip access-list ext outbound

permit tcp any any eq bgp reflect reflst1

permit icmp any any reflect reflst1

The bgp connection never comes up (works without the list) and pings dont work. If I hard code routes to each other in A and C pings work from C to A and B has an entry in reflst1 for the two addresses talking to each other.

If I ping from B to A debug shows traffic going out but responses get denied because the reflexive entry is not created.

I tried policy routing and IP local policy but that is building the reflexive entry from input not output.

Whats the trick for making reflexive entries from traffic generated by the router?

1 REPLY
Bronze

Re: how to make a reflexive access-list work for router traffic

Generally access-lists are not effective for packets generated by the router. I guess that is the reason you are encountering this problem. On the inbound direction, you can configure regular ACL commands that permit what you want apart from the 'evaluate' command to allow traffic that is not permitted by the reflexive ACL.

116
Views
0
Helpful
1
Replies
CreatePlease login to create content