需求：
在公司的邊界上，要求只允許內(nèi)網(wǎng)用戶主動訪問外網(wǎng)的流量，外網(wǎng)主動訪問內(nèi)網(wǎng)的所有流量都拒絕，注意：在邊界路由器外口的入方向上要拒絕掉所有外網(wǎng)主動發(fā)起的流量，但是要能夠允許內(nèi)網(wǎng)發(fā)起而由外網(wǎng)返回的流量，否則內(nèi)網(wǎng)發(fā)起的流量也不能正常通訊.
—————————————————————–
企業(yè)邊界路由器：
interface FastEthernet0/0
ip address 23.0.0.1 255.255.255.0
ip access-group ZIFAN-2 in
duplex auto
speed auto
!
interface FastEthernet1/0
ip address 12.0.0.2 255.255.255.0
ip access-group ZIFAN in
duplex auto
speed auto
!
ip http server
no ip http-server
!
!
!
!
ip access-list extended ZIFAN
permit ip host 12.0.0.1 any reflect LINK_IN //指定該條語句執(zhí)行自反，自反列表的名字為LINK_IN
ip access-list extended ZIFAN-2
evaluate LINK_IN //計算并生成自反列表
deny ip any any
—————————————————————–
說明1：reflect和evalute后面的對應(yīng)名應(yīng)該相同，此例中為LINK_IN
說明2：自反ACL只能在命名的擴展ACL里定義
—————————————————————–
試驗結(jié)果：
router#sh access-lists
Reflexive IP access list LINK_IN
permit icmp host 23.0.0.2 host 12.0.0.1 (39 matches) (time left 289)
Extended IP access list ZIFAN
10 permit ip host 12.0.0.1 any reflect LINK_IN (188 matches)
Extended IP access list ZIFAN-2
10 evaluate LINK_IN
20 deny ip any any (52 matches)