Reflexive access lists

Bascially, very similar to Cisco Zone Based Firewall.

1. define an access-list Egress to allow matched outbound traffic, apply it on to interface, once the traffic is matched, it will create a timed reflexive access-list - Mirror

Router(config)# ip access-list extended Egress
Router(config-ext-nacl)# permit ip any any reflect Mirror
Router(config-ext-nacl)# interface f0/1
Router(config-if)# ip access-group out Egress

2. defind an access-list Ingress (which will reference the reflexive access-list - Mirror) to allow match inbound traffic

Router(config)# ip access-list extended Ingress
Router(config-ext-nacl)# evaluate Mirror
Router(config-ext-nacl)# interface f0/1
Router(config-if)# ip access-group in Ingress

Very good reference of Cisco reflexive access lists, way way better than Cisco's own reference!
http://packetlife.net/blog/2008/nov/25/reflexive-access-lists/
Configuring IP Session Filtering (Reflexive Access Lists)

Reflexive Access Lists

What Are Reflexive Access Lists

They go on the filtering router connecting your network to the outside world. (I'm avoiding "firewall router", since we usually think of a firewall as a dedicated security box now). Reflexive access lists allow you to dynamically open up your filtering router to allow reply packets back through, in response to an outbound TCP connection or UDP session initiated from within your network. This mechanism reduces exposure to spoofing and denial-of-service, since desirable inbound flows are mostly in response to outbound traffic.

! create the named extended access list that "sees" the outbound packets
ip access-list extended outbound-packet-watch
  permit tcp any any reflect reflexive-temporary-list
  permit udp any any reflect reflexive-temporary-list
! create the named extended access list that evaluates the inbound packets
ip access-list extended inbound-packet-catcher
  ! allow BGP routing but deny ICMP from outside
  permit bgp any any
  deny icmp any any
  evaluate reflexive-temporary-list
interface serial 1/0
  ! apply the named access list to watch packets leaving the secure network
  ! as they go out serial 1/0
  ip access-group outbound-packet-watch out
  ip access-group inbound-packet-catcher in

Ref: http://www.netcraftsmen.net/resources/archived-articles/432.html