企业边界路由器:
interface FastEthernet0/0
ip address 23.0.0.1 255.255.255.0
ip access-group ZIFAN-2 in
!
interface FastEthernet1/0
ip address 12.0.0.2 255.255.255.0
ip access-group ZIFAN in
!
ip access-list extended ZIFAN
permit ip host 12.0.0.1 any reflect LINK_IN //指定该条语句执行自反,自反列表的名字为LINK_IN
!
ip access-list extended ZIFAN-2
evaluate LINK_IN //计算并生成自反列表
deny ip any any
—————————————————————–
说明1:reflect和evalute后面的对应名应该相同,此例中为LINK_IN
说明2:自反ACL只能在命名的扩展ACL里定义
—————————————————————–
【实验验证】
router#sh access-lists
Reflexive IP access list LINK_IN
permit icmp host 23.0.0.2 host 12.0.0.1 (39 matches) (time left 289)
Extended IP access list ZIFAN
10 permit ip host 12.0.0.1 any reflect LINK_IN (188 matches)
Extended IP access list ZIFAN-2
10 evaluate LINK_IN
20 deny ip any any (52 matches)
本文转自zcm8483 51CTO博客,原文链接:http://blog.51cto.com/haolun/992199