created using named access lists. This ACL is pretty straightforward, except for the addition of reflect GAD at the end of the permit line. This will be the name of the temporary access list created by the router when this permit entry is matched. The entry deny ip any any is not necessary, as all access lists include this by default, but I've included it here for clarity, and to show the counters incrementing as traffic is denied later. Next, we'll create a named access list called TelnetIn: ip access-list extended TelnetIn evaluate GAD deny ip any any This access list has no permit statements, but it has the statement evaluate GAD. This line references the reflect line in the TelnetOut access list. GAD will be the name of the new access list created by the router. To make these access lists take effect, we need to apply them to the router. We'll apply TelnetOut to interface E1 outbound, and TelnetIn to interface E1 inbound. Figure 23-6 illustrates. Inside Outside 10.0.0.0/24 20.0.0.0/24 TelnetOut ACL applied here Telnet] In ACL applied here Figure 23-6. Application of reflexive access lists Reflexive access lists are applied with the access-group interface command: interface Ethernet1 ip access-group TelnetIn in ip access-group TelnetOut out The entire relevant configuration for the router is as follows: interface Etherneto ip address 10.0.0.1 255.255.255.0 interface Ethernet1 ip address 20.0.0.1 255.255.255.0 ip access-group TelnetIn in ip access-group TelnetOut out Reflexive Access Lists ip access-list extended TelnetIn evaluate GAD deny ip any any ip access-list extended TelnetOut permit tcp host 10.0.0.10 host 20.0.0.20 eq telnet reflect GAD deny ip any any Looking at the access lists with the show access-list command, we see them both exactly as we've configured them: Router# sho access-list Reflexive IP access list GAD Extended IP access list TelnetIn evaluate GAD deny ip any any Extended IP access list TelnetOut permit tcp host 10.0.0.10 host 20.0.0.20 eq telnet reflect GAD deny ip any any (155 matches) 