ACL requirement on Cisco 3750

[gmail2]

Hi All

Sorry, I know this is a layer 3 switch, but I figured it was probably more appropriate to the routing forum. If I configure an access list on a 3750 to allow TCP 3389 IN int VLAN99 (for example) - do I then need to allow TCP 1024->65535 out for the reply to get through ? Or is the device session aware and therefore will allow the reply to come back because it's in response to a packet that just came in ?

I know that PIX doesn't require me to open 1024->65535, but that's a firewall, not a router/L3 switch.

I've tried to google this but I'm not even 100% sure what to google ! If anybody has any pointers, that'd be great

Thanks in advance

Irish Poetry - Karen O'Connor
Irish Poetry and Short Stories - Doghouse Books
Garten und Landschaftsbau

 

[vipergg]

If you do not apply an out ACL to the SVI then it is wide open to all return traffic and everything is passed.