Reflexive Access Control List on Cisco router

External Interface Configuration

interface FastEthernet0/0
desc external
ip address 10.0.1.1 255.255.255.0
ip access-group reflect_in in
ip access-group reflect_out out
!
interface FastEthernet2/0
desc internal
ip address 10.0.2.1 255.255.255.0
!
ip access-list extended reflect_out
permit tcp any any reflect tcptraffic
ip access-list extended reflect_in
permit tcp any any eq telnet
evaluate tcptraffic
!

Internal Interface Configuration (with DMZ)

interface FastEthernet0/0
desc external
ip address 10.0.1.1 255.255.255.0
!
interface FastEthernet2/0
desc internal
ip address 10.0.2.1 255.255.255.0
ip access-group reflect_in in
ip access-group reflect_out out
!
ip access-list extended reflect_in
permit tcp any any reflect tcptraffic
ip access-list extended reflect_out
permit tcp any any eq telnet
evaluate tcptraffic
!

See also