Here, we can see that all nontelnet traffic is being denied outbound. There really aren't any entries to permit anything inbound, but that will change when we trigger the reflexive access list. After we initiate a telnet request from host A to host B, the output changes. There is now an additional access list named GAD: Router# sho access-list Reflexive IP access list GAD permit tcp host 20.0.0.20 eq telnet host 10.0.0.10 eq 11002 (12 matches) Extended IP access list TelnetIn evaluate GAD deny ip any any Extended IP access list TelnetOut permit tcp host 10.0.0.10 host 20.0.0.20 eq telnet reflect GAD deny ip any any (155 matches) This temporary access list has been created in response to outbound traffic matching the permit entry containing the reflect GAD statement. The destination port number is 11002; this was the source port number for the outbound telnet request. When the session has ended, or there is no activity matching the new access list, the reflexive access list is removed. The required inactivity period can be configured using the global ip reflexive-list timeout seconds command. This command affects all reflexive access lists on the router. The default timeout value is five seconds. Chapter 23: Access Lists CHAPTER 24 Authentication in Cisco Devices Authentication refers to the process of verifying a user's identity. When a router challenges you for a login username and password, this is an example of authentication. Authentication in Cisco devices is divided into two major types: normal and AAA (Authentication, Authorization, and Auditing). Basic (Non-AAA) Authentication Non-AAA authentication is the basic authentication capability built into a router or other network device's operating system. Non-AAA authentication does not require access to an external server. It is very simple to set up and maintain, but lacks flexi- bility and scalability. Using locally defined usernames as an example, each username needs to be configured locally in the router. Imagine a scenario where a single user might conne