Ruijie Community

Title: How to configure Reflexive ACL on Ruijie series EG? [Print this page]

Author: GTAC-Sophia Time: 2023-12-19 16:15
Title: How to configure Reflexive ACL on Ruijie series EG?
1. Topology

<span style=""">2. Requirements
</span>

in a small enterprise network, PC1 represents the employee, and PC2 represents the company's important internal server. The requirements are that
(1) The company's employees can access the external network and company's internal server.
(2) The internal server cannot access the employee network segment but can access the Internet.
3. Configuration tips
Reflexive ACLs allow reply traffic from the destination of the most recent outbound packet to return to the source address of that outbound packet, giving you tighter control over what traffic enters your network and improving the ability to extend access lists.
The ultimate goal of reflexive ACL configuration is to achieve a single pass, that is, Party A can communicate with Party B when initiated by Party A, but Party B cannot communicate with Party A when initiated by Party B.
4. Configuration steps
4.1 How to configure via web
How to configure ACL on the Ruijie Gateway? - Mesh Wi-Fi - ruijienetworks

You can refer to the link above to configure the ACL. In the final step, "apply on interface," select enable Reflexive ACL

</span>

4.2 How to configure via cli
A. Employees can access all Intranet and extranet networks based on user requirements. Therefore, configure ACL99 permit any to enable the server to access the Internet automatically. Configure ACL101 to allow Internet access but deny all traffic to the employee network segment.

ip access-list standard 99

10 permit any

ip access-list extended 101

10 deny ip 10.100.1.0 0.0.0.255 10.200.10.00.0.0.255

20 permit ip any any

B. The employee network segment allows access toall networks

interface g0/0

ip access-group 99 in reflect

C. Server port G0/1 ACL101 is configured in reflexive mode. The internal server cannot access the employee network segment and can access the Internet

interface g0/1

ip access-group 101 in reflect

Welcome to Ruijie Community (https://community.ruijienetworks.com/)