Extended ACL options: the established keyword and time-based ACLs
In short: The established keyword matches TCP packets with the ACK or RST flag set, which approximates return traffic for sessions started from inside, but it is not stateful and does not cover UDP. Time-based ACLs link lines to a time range so rules apply only during set hours; they depend on an accurate clock.
The problem with return traffic
Suppose you put an inbound ACL on a router's internet-facing interface to block connections from outside. Your users still need replies to their own connections to come back in. Those replies have random high destination ports, so you cannot list them. Plain extended ACLs have no memory of who started a conversation. The established keyword is the oldest, simplest workaround.
The established keyword
When a TCP client opens a connection, its first packet (SYN) has no ACK flag. Every later packet in both directions has ACK set, and a reset has RST set. The established keyword matches any TCP packet with ACK or RST set. Permitting established TCP traffic inbound therefore allows replies to connections that started inside, while blocking new connection attempts from outside.
ip access-list extended INTERNET-IN
10 permit tcp any 192.168.1.0 0.0.0.255 established
20 permit icmp any 192.168.1.0 0.0.0.255 echo-reply
30 permit icmp any 192.168.1.0 0.0.0.255 unreachable
40 deny ip any any log
!
interface GigabitEthernet0/0
ip access-group INTERNET-IN inKnow its limits:
- It only looks at flags, so a packet crafted with ACK set is allowed in, even though no session exists. Hosts will usually reject it, but it can still be used for scanning.
- It does nothing for UDP (DNS, NTP, video calls) or ICMP, which have no flags; you need separate lines for those.
Reflexive ACLs were an IOS step up, creating temporary entries for each outbound session. Today the right tool on a router is the zone-based firewall or a dedicated firewall, which track sessions properly. Treat established as a lightweight extra filter, for example on internal links, not as your internet security.
Time-based ACLs
A time-based ACL uses a named time-range to make individual lines active only at certain times. A time range can be periodic (repeating, such as weekdays from 08:00 to 17:30) or absolute (from one date and time to another, for example a contractor's access during a project).
time-range SCHOOL-DAY
periodic weekdays 8:00 to 15:30
!
time-range CONTRACTOR
absolute start 08:00 01 November 2026 end 18:00 30 November 2026
!
ip access-list extended STUDENT-IN
10 deny tcp 10.40.0.0 0.0.255.255 any eq 443 time-range SCHOOL-DAY log
20 permit ip 10.40.0.0 0.0.255.255 any
!
ip access-list extended VENDOR-IN
10 permit tcp host 198.51.100.44 host 10.10.5.20 eq 22 time-range CONTRACTOR
20 deny ip any any logIn the first example a school network blocks HTTPS from a student gaming lab subnet during lessons; in the second a vendor may only reach one server over SSH during November. show time-range shows whether each range is active now, and show access-lists marks lines as active or inactive.
Tip: a time-based ACL is only as good as the router's clock. Configure NTP and the correct time zone (including summer time) before relying on one, and check the clock after any reload.
Real-world example: an after-hours backup window
A small accountancy firm backed up its file server to an offsite provider overnight. During the day, the backup software sometimes started catch-up jobs that saturated the office's broadband line. The IT contractor added a time-range for 19:00 to 06:00 every day and linked it to the ACL line that permitted the backup traffic, with the general permit below excluding the backup provider. Daytime backup attempts were then dropped and logged, the overnight jobs ran as normal, and staff stopped noticing slow internet in the afternoons. Because the router synchronised with NTP, the window stayed correct when the clocks changed in October.
Practice
Which TCP flags does the established keyword match?
Why does permit tcp any any established not help users whose DNS lookups fail?
A time-based ACL blocks traffic one hour late every day after the clocks change. What is likely wrong?
Key takeaways
- Established matches TCP packets with ACK or RST set, approximating return traffic.
- It is not stateful and does nothing for UDP or ICMP; use a firewall for real inspection.
- Time-based ACLs link lines to periodic or absolute time ranges.
- show time-range and show access-lists show which lines are active.
- Time-based ACLs depend on an accurate clock, so configure NTP.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.