Reflexive ACLs can monitor outbound traffic and create a temporary ACL that mirrors this traffic by swapping the source/destination addresses and port #s:

OUTBOUND:     ->

Reflexive ACLs have the limitation of not supporting protocols that change their port numbers after the first packet is sent. The common example of this is FTP, which uses a separate control channel to configure the data channel.

What other common protocols do not play nice with reflexive ACLs?

Aside from this limitation, are there reasons to steer clear of reflexive ACLs?

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 8 '17 at 20:55

Reflexive ACLs were the first way to define directional traffic initiation and dynamically open up security for return traffic.

Router logic on this below

FTP inside --> outside 

then I must allow 

FTP outside --> inside

Now we use Zone-Based firewalls (or whatever other catchphrase you want to use for the same technology) that pretty much do the same thing, but they can also adapt based on traffic inspection

  • Unfortunately we have many older routers that do not support ZBF. And, on the newer installations, the lack of support for stateful firewall failover of ZBFs is a big negative. Jan 23 '14 at 15:50
  • 1
    If you want stateful failover for a firewall i would suggest looking at the ASA line rather than "older routers that do not support ZBF" Jan 23 '14 at 16:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.