Dear @Alex789,

Alex789 wrote

I have two networks/subnets, network1 and network2.

 

If I create two ACLs:

• A LAN-LAN rule which blocks traffic from network2 to !network2
• An ALL rule that allows traffic from IP2 on network2 to an IP1 on network1 using IP Groups

 

The allow rule is above the block rule on the list.

 

In this case, traffic does not flow from IP2 to IP1 and back. 

 

However, if I add the reflexive rule to allow traffic from IP1 to IP2, it works.  However, why would that be needed?  I don't have an ACL which blocks *any* traffic from network1 to network2.  If ALL traffic is already allowed, why would a need an allow rule for one IP explicitly?

When we select Direction as ALL, the rule will only apply to one-way traffic which is from the source to the destination.

When we select Direction as LAN-LAN, the rule will apply to two-way traffic.

So we'll need to add the reflexive rule to make it to allow communication between IP2 and IP1.

Dear @Alex789,

Alex789 wrote

Since this behavior is both atypical and unintuitive, would it be possible to add some hint in the UI that indicates this?

Thank you for your valuable feedback. I'll forward this to the engineer for further evaluation.