Reflexive ACLs

• Adds simple state tracking to ACLs
– Outbound ACL triggers “mirror” entry in state table
– Inbound ACL checks state table first before denying
• Entries expire after 5 minutes of inactivity
– Modified via ip reflexive-list timeout
• No application level inspection
– Only works with “standard” TCP/UDP applications.

Reflexive ACL Configuration
• Reflect outbound traffic
• ip access-list extended OUTBOUND
• permit tcp any any reflect STATEFUL
• Check state table in opposite direction
• ip access-list extended INBOUND
• evaluate STATEFUL
• deny ip any any (implicit)

Dynamic ACLs

• “Lock and key” ACLs
– Used to open a hole in the ACL based on authentication
• Potential Applications
– From inside to outside
• User must first authenticate to send traffic to the Internet
– From outside to inside
• User must first authenticate to access internal web server
• Replaced by Authentication Proxy
– Per-user ACLs downloaded from AAA server

Dynamic ACL Configuration
• ACL entry is defined as dynamic
– access-list 100 dynamic TEST permit ip
any any
• Entry is activated by access-enable command
– Can be per user or per line
• username… autocommand access-enable [host]
• line vty 0 4
– autocommand access-enable [host].