The entire relevant configuration for the router is as follows: interface Etherneto ip address 10.0.0.1 255.255.255.0 interface Ethernet1 ip address 20.0.0.1 255.255.255.0 ip access-group TelnetIn in Chapter 25: Access Lists ip access-group TelnetOut out ip access-list extended TelnetIn evaluate GAD deny ip any any ip access-list extended TelnetOut permit tcp host 10.0.0.10 host 20.0.0.20 eq telnet reflect GAD deny ip any any Looking at the access lists with the show access-list command, we see them both exactly as we've configured them: Router#sho access-list Reflexive IP access list GAD Extended IP access list TelnetIn evaluate GAD deny ip any any Extended IP access list TelnetOut permit tcp host 10.0.0.10 host 20.0.0.20 eq telnet reflect GAD deny ip any any (155 matches) Here, we can see that all non- Telnet traffic is being denied outbound. There really aren't any entries to permit anything inbound, but that will change when we trigger the re- flexive access list. After we initiate a Telnet request from host A to host B, the output changes. There is now an additional access list named GAD: Router#sho access-list Reflexive IP access list GAD permit tcp host 20.0.0.20 eq telnet host 10.0.0.10 eq 11002 (12 matches) Extended IP access list TelnetIn evaluate GAD deny ip any any Extended IP access list TelnetOut permit tcp host 10.0.0.10 host 20.0.0.20 eq telnet reflect GAD deny ip any any (155 matches) This temporary access list has been created in response to outbound traffic matching the permit entry containing the reflect GAD statement. The destination port number is 11002; this was the source port number for the outbound Telnet request. When the session has ended, or there is no activity matching the new access list, the reflexive access list is removed. You can configure the required inactivity period using the global ip reflexive-list timeout seconds command. This command affects all reflexive access lists on the router. The default timeout value is five seconds. Reflexive Access Lists CHAPTER 26 Authenticat