Reflexive ACLs can monitor outbound traffic and create a temporary ACL that mirrors this traffic by swapping the source/destination addresses and port #s:
OUTBOUND: 192.168.1.2:1234 -> 11.0.0.1:80
TEMPORARY RETURN ACL: permit 11.0.0.1:80 -> 192.168.1.2:1234
Reflexive ACLs have the limitation of not supporting protocols that change their port numbers after the first packet is sent. The common example of this is FTP, which uses a separate control channel to configure the data channel.
What other common protocols do not play nice with reflexive ACLs?
Aside from this limitation, are there reasons to steer clear of reflexive ACLs?