| 3.2 |  | Types of IP ACLs |
| 3.2.6 |  | Reflexive ACLs |

| Reflexive ACLs allow IP packets to be filtered based on upper-layer session information. A common requirement for filtering is to permit IP traffic for sessions originating from within the network but to deny IP traffic for sessions originating from outside the network. Using basic extended ACLs, administrators can approximate session filtering by using the established keyword with the permit command. The established keyword filters TCP packets based on whether the ACK or RST bits are set. This method of using the established keyword is available only for the TCP upper-layer protocol. For the other upper-layer protocols, such as UDP and ICMP, administrators would have to either permit all incoming traffic or define all possible permissible source/destination host/port address pairs for each protocol.

Reflexive ACLs are much more suitable for true session filtering. After it is configured, a reflexive ACL is triggered when a new IP upper-layer session such as TCP or UDP is initiated from inside the network, with a packet traveling to the external network . When triggered, the reflexive ACL generates a new, temporary entry. This entry permits traffic to enter the network if the traffic is part of the session, but will not permit traffic to enter the network if the traffic is not part of the session. The filter criterion is based on the ACK and RST bits as well as the source and destination addresses and port numbers. Session filtering uses temporary filters that are removed when a session is over. This limits the hacker's attack opportunity to a smaller time frame .

Temporary reflexive ACL entries are removed at the end of the session. For TCP sessions, the entry is removed five seconds after two set FIN bits are detected, or immediately after matching a TCP packet with the RST bit set. Two set FIN bits in a session indicate that the session is about to end. The five-second window allows the session to close gracefully. A set RST bit indicates an abrupt session close. Alternatively, the temporary entry is removed after no packets of the session have been detected for a configurable length of time. This is called the timeout period.

For UDP and other connectionless protocols, the end of a UDP session is determined differently than it is from the end of a TCP session. Because UDP is considered to be connectionless, there is no session tracking information embedded in the packets. Therefore, the end of a session is considered to occur when no packets of the session have been detected for a configurable length of time. This is referred to as the timeout period.

There are two restrictions on using the reflexive access list feature:

1. Reflexive access lists can be defined with extended named IP access lists only. Administrators cannot define reflexive access lists with numbered or standard named IP access lists or with other protocol access lists.
2. Reflexive access lists do not work with some applications that use port numbers that change during a session. If the port numbers for a return packet are different than those of the originating packet, the return packet will be denied, even if the packet is actually part of the same session. The TCP-based application, FTP, is an example of an application with changing port numbers.

With reflexive access lists, if an FTP request is started from within a network, the request will not complete. Instead, the network must use passive FTP when originating requests from within. If active FTP is required, then CBAC should be used. CBAC supports both active and passive FTP.

| Web Links Active and Passive FTP http://www.cisco.com/warp/public/ 759/ipj_2-3/ipj_2-3_oneb.html