about reflexive access-list

[g.rodegari]

Hi,

I'd like to restrict tcp traffic on one simple IOS router.

I think that if I use a refelexive ACL, either two simmetrical standard ACL with the established keyword on one side, is the same thing... It's correct?

The reflexive ACL don't provide stateful inspection but only create a simmetrical ACL without a traffic understanding?

Thanks,

Graz.

[gfullage]

A reflexive ACL is a little better than just simply putting the TCP established keyword on a normal ACL. For one thing, reflexive ACL's handle UDP traffic, whereas the "established" keyword is only for TCP.

You're correct though, it doesn't actually keep track of sessions or anything like that, it just looks at outgoing traffic and allows it to come back in for a short period. Certainly better than nothing though.

[g.rodegari]

Thanks a lot,

Bye

Graz.