# Reflexive ACL's on 3com



## Wim Marien (May 3, 2011)

Hello,

For my internship I'm setting up 2 3com L3 switches. The model of these switches is 4800G (from HP, they fused to H3C) and I'm using the latest firmware.

I'm trying to get reflexive ACL's working. What I'm trying to do is to limit users to internet traffic. They may not be able to access other network resources (it's a Guest LAN).
However, to offer them internet access, I also have to offer them DNS and DHCP. These protocols work using UDP.

My clients can contact the servers and the servers respond correctly (tested using wireshark). Sadly enough, my ACL's block the answers from the clients.

I know I could just allow traffic from the servers to the clients and it doesn't bother me to do so. However, I'm using a simular setup to create a DMZ where I need to do the same.

In the next ACL, tcp connections are working as they should (when they are estabilished, they are allowed).
UDP and ICMP traffic does not work.
I've read many things about reflexive ACL's and I thought this should do the trick. Sadly enough it does not :-(

My manual doesn't mention reflective ACL's.

My ACL (with fake IP's) for my guest VLAN is:


> acl number 3000 name internet_only
> description Internet access + dhcp + dns for guests
> step 20
> rule 10 permit tcp estabilished
> ...


I hope anyone can help my out


----------

