Reflexive ACL on 3750

Is it possible to configure reflexive ACL (reflect, evaluate) on catalyst 3750 ? on EMI and on SMI ? version IOS ?

Could you post an example ?

Thanks in advance


Reply to
Loading thread data ...

What does the feature navigator say about the feature availability on that platform?

formatting link

Reply to
Walter Roberson

My 3750 running will do it. * 1 24 WS-C3750G-24T

12.1(19)EA1c C3750-I5-M

Here is a *very* simple example from my 6500. The syntax is the same:

interface Vlan10 ip address ip access-group vlan10_in in ip access-group vlan10_out out

ip access-list extended vlan10_in evaluate vlan10_reflect permit icmp any packet-too-big permit icmp any time-exceeded ip access-list extended vlan10_out permit tcp any any reflect vlan10_reflect permit udp any any reflect vlan10_reflect permit icmp any any reflect vlan10_reflect

Hope it helps.

Reply to

Thing is, you may want to find out if it does it in hardware, since if it does not you may find that the performance does not meet your requirements.

I would guess that 3750 may do a few 10s of thousands of packets per second in software as opposed to 'whatever it says on the tin' in hardware. Lots and lots of millions I would guess.


formatting link

The switch does not support these IOS router ACL-related features: - Reflexive ACLs or dynamic ACLs (except for some specialized dynamic ACLs used by the switch clustering feature)

formatting link
The switch does not support these Cisco IOS router ACL-related features: - Reflexive ACLs .......

Cisco seem to be putting (leaving?) commands in IOS that are not always suported. This to me seems a bizarre practise. Maybe this is one of those cases?

Anyway, unless it's a toy installation, I would take cisco's advice.

If you want a firewall, buy one:-)

Reply to
anybody43 Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.