Cisco Catalyst ACL one-way initiated traffic

Question

i am trying to setup ACL on my core router, i have the following networks:

• Data (192.168.32.0/24)
• Voice (192.168.42.0/24)
• Guest (192.168.100.0/24)
• QA (192.168.101.0/24)

I would like the following traffic flow:

1. Voice to internet and data only
2. Guest to internet only (no possibility of any local network)
3. Data to voice, internet and initiate connections to QA
4. QA to internet and respond to initiated connections from data (no possibility of making new connections to any local network)

I have the following ACL:

ip access-list extended guest-in
 deny ip any 192.168.0.0 0.0.255.255
 deny ip any 10.0.0.0 0.255.255.255
 deny ip any 172.16.0.0 255.255.0.0
 permit ip any any

ip access-list extended guest-out
 deny ip any 192.168.0.0 0.0.255.255
 deny ip any 10.0.0.0 0.255.255.255
 deny ip any 172.16.0.0 255.255.0.0
 permit ip any any

ip access-list extended qa-in
 // how to please allow tracked connections initiated from user to QA?
 deny ip any 192.168.0.0 0.0.255.255
 deny ip any 10.0.0.0 0.255.255.255
 deny ip any 172.16.0.0 255.255.0.0
 permit ip any any

ip access-list extended user-out
 allow ip any 192.168.101.0 0.0.0.255
 deny ip any 192.168.100.0 0.0.255.255
 permit ip any any

Is there any simpler way to do the above, and how would i allow tracked connections to be initiated from data to QA allowed (but not QA to initiate connections to data)?

Answer 1

As a side note, on your Guest and QA ACLs, you're using wildcard masks for your first 2 ACEs but a subnet mask for your third (172.16.0.0 255.255.0.0). It's also wrong, as is. 172.16.0.0 (as is defined in RFC 1918) is a /12 network, so your mask should either be 255.240.0.0 (subnet mask) or 0.15.255.255 (wildcard mask). Whichever it's EXPECTING is what decided which you use. You need to use the ? command to see what it's expecting. None of the devices that I know of will stop you from entering whatever you want in an ACL, even if it's wrong. You could literally type a mask of 222.222.222.0 and it would accept it.

Answer 2

If you are using a newer Cisco router I would check out zone-based firewalling to solve your Data to QA problem. Traditional ACLs are stateless so they do not remember any connection states. With ZBF the zones are stateful so return traffic initiated from Data to QA are allowed, while blocking traffic initiated from QA to Data.

Here is Cisco's design guide on Zone based firewalling: https://www.cisco.com/c/en/us/support/docs/security/ios-firewall/98628-zone-design-guide.html