Reflexive access lists

[yuri.volkov]

I would like to prevent a web server from initiating any IP traffic from inside it's VLAN. The server must be only able to respond to TCP connections from other VLANs to port 80 only. This looks like the opposite from traditional use of reflexive ACL. So, is it possible to use command reflect in inbound IOS ACL (ip access-group ... out) and command evaluate in outbound ACL (ip access-group ... in), or these commands can only be used in inbound and outbound ACLs respectively? For some reason my configuration doesn't work. Please look at the attached picture.

[yuri.volkov]

The problem was not in the access-lists at all. Last year we were experimenting with MAC ACL and didn't remove command mac packet-classify from interface VLAN 20 (see the attached picture). I have no idea why, but after removing this command from interface VLAN 20, reflexive ACL applied to interface VLAN 10 began working.