. Reflexive Access Lists Inside ACL applied inbound Outside 10.0.0.0/24 20.0.0.0/24 Request Reply Request Figure 25-4. Simple access list applied inbound on E1 Inside Reflexive ACL applied Outside 10.0.0.0/24 20.0.0.0/24 Request Reply Request Figure 25-5. Reflexive access list applied to E1 Reflexive access lists create temporary permit statements that are reflections of the original statements. For example, if we permit Telnet outbound, a temporary permit statement will be created for Telnet inbound. Reflexive access lists are very useful, but they do have some limitations: The temporary entry is always a permit, never a deny. The temporary entry is always the same protocol as the original (TCP, UDP, etc.). The temporary entry will have the opposite source and destination IP addresses from the originating traffic. The temporary entry will have the same port numbers as the originating traffic, though the source and destination will be reversed (ICMP, which does not use port numbers, will use type numbers). The temporary entry will be removed after the last packet is seen (usually a FIN or RST). Chapter 25: Access Lists The temporary entry will expire if no traffic is seen for a configurable amount of time (the default is five seconds). You cannot create a reflexive access list that allows one protocol when another is de- tected. For example, you cannot allow HTTP inbound because a Telnet was initiated outbound. If you want to reflexively allow HTTP inbound, you must test for HTTP outbound. Because the port numbers in the temporary entries are always the reverse of the port numbers from the original traffic, they are not suitable for protocols such as RPC that change source port numbers. Reflexive ACLs are also not suitable for protocols that create new streams, such as FTP. FTP can still be used with reflexive access lists, provided passive mode is used. Configuring Reflexive Access Lists Reflexive access lists are a bit more complicated than regular access lists, because you must nest one ACL within another. Con