Dynamic Access list

[jonk34567]

is there anything called Dynamic access list ? if yes ,for what purpose is it used ?

[mlund]

see link below for dynamic access-list

https://www.cisco.com/c/en/us/support/docs/security-vpn/lock-key/7604-13.html

there are also reflexive access-list that is dynamically populated, see link

https://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfreflx.html

/Mikael

[paul driver · Accepted solution]

Hello

---

@jonk34567 wrote:

is there anything called Dynamic access list ? if yes ,for what purpose is it used ?

---

You can use Dynamic Acl's to permit access to certain services based on authentication of a client prior to allowing access.

So it you have a rtr that borders between your own network and another, and you wish for the external clients to be allowed access into your company ONLY if they are authenticated first then a Dynamic acl could provide this.

Reflective Acl will automatically be created when specific defined traffic is initiated from within your company to a external client and as such return traffic from the external client will be allowed into your network.


res
Paul

[JozefButala]

Hi Paul, is there any other options for establishing connection than telnet if I use cisco router for authentication?

[Richard Burts]

I am puzzled about this question. It suggests that telnet is the only access. But I do not see anything in this discussion that deals with particular access protocols. Dynamic ACL should work for multiple access protocols. 

[JozefButala]

Hi Richard, if I have only option for authentication cisco router, is there another way how to authenticate user other than telnet?

[Richard Burts]

I am still puzzled. The OP was discussing dynamic access lists. I do not think that you are asking about dynamic access lists. If you are asking about authenticating access to cisco router then it can be configured to authenticate for telnet, or for SSH, or for HTTP/HTTPS.

[JozefButala]

If I want use dynamic Acl for permit host  from from Internet, but I don’t have any other option for authentication but router is there possibility to use something else than telnet?