1

Do routers usually support static or dynamic filters or both? This probably is a vendor specific question, but what is in usual the case for routers? If they support only static packet filtering, why is this actually the case?

3

Cisco routers support a type of dynamic access list called a reflexive access list. It observes outbound traffic and will automatically add an entry to the inbound access-list permitting the return traffic.

What Is a Reflexive Access List? Reflexive access lists are similar in many ways to other access lists. Reflexive access lists contain condition statements (entries) that define criteria for permitting IP packets. These entries are evaluated in order, and when a match occurs, no more entries are evaluated.

However, reflexive access lists have significant differences from other types of access lists. Reflexive access lists contain only temporary entries; these entries are automatically created when a new IP session begins (for example, with an outbound packet), and the entries are removed when the session ends. Reflexive access lists are not themselves applied directly to an interface, but are “nested” within an extended named IP access list that is applied to the interface. (For more information about this, see the section “Reflexive Access Lists Configuration Task List” later in this chapter.) Also, reflexive access lists do not have the usual implicit “deny all traffic” statement at the end of the list, because of the nesting.

http://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfreflx.html

0

This really is vendor specific, and it depends on what you mean by traffic filters.

Most business-grade routers support some form of static access lists. Some have cloud-based support to get filter changes. Reflexive access lists, firewall features, NAT support, etc. may depend on both the vendor and the license level, and could be considered dynamic filters, allowing inbound traffic only for established outbound connections.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.