Chapter 19: Access Control List Configuration Guide264 SmartSwitch Router User Reference Manualyou would have to create an ACL to allow responses from each specific outside host. If thenumber of outside hosts that internal users need to access is large or changes frequently,this can be difficult to maintain.To address this problem, the SSR can be configured to accept outside TCP responses intothe internal network, provided that the TCP connection was initiated internally.Otherwise, it will be rejected. To do this, enter the following command in ConfigureMode:Note: The ports that are associated with the interface to which the ACL is applied mustreside on updated SSR hardware. Please refer to Appendix A for details.The following ACL illustrates this feature:Any incoming TCP packet on interface int1 is examined, and if the packet is in response toan internal request, it is permitted; otherwise, it is rejected. Note that the ACL contains norestriction for outgoing packets on interface int1, since internal hosts are allowed to accessthe outside world.Creating and Modifying ACLsThe SSR provides two mechanisms for creating and modifying ACLs:• Editing ACLs on a remote host and uploading them to to the SSR using TFTP or RCP• Using the SSR’s ACL EditorThe following sections describe these methods.Editing ACLs OfflineYou can create and edit ACLs on a remote host and then upload them to the SSR withTFTP or RCP. With this method, you use a text editor on a remote host to edit, delete,replace, or reorder ACL rules in a file. Once the changes are made, you can then uploadthe ACLs to the SSR using TFTP or RCP and make them take effect on the running system.The following example describes how you can use TFTP to help maintain ACLs on theSSR.Allow TCP responses from external hosts,provided the connection was establishedinternally.acl permit tcp establishedacl 101 permit tcp establishedacl 101 apply interface int1 input
