Network Engineering Stack Exchange is a question and answer site for network engineers. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to block Host 192.168.1.1 from reaching 192.168.2.0/24 network and in order to implement that I've applied Extended ACL "ACL_FOR_R2" on R2's serial2/0 interface. Now as we all know that at the end of every access list is an implied "deny all traffic" criteria statement. Therefore, if a packet does not match any of your criteria statements, the packet will be blocked. So I didn't mention any statement in the ACL "ACL_FOR_R2" assuming we only have one statement in that ACL as "deny all" but the problem is when I ping from R1 to 192.168.2.2, R2 doesn't block the traffic and ping reaches to R3. WHY?

Here are the configurations:

- R1's configurations:

    R1#show running-config
    Building configuration...

    Current configuration : 1557 bytes
    !
    version 12.4
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    !
    hostname R1
    !
    boot-start-marker
    boot-end-marker
    !
    !
    no aaa new-model
    memory-size iomem 5
    no ip icmp rate-limit unreachable
    ip cef
    !
    !
    !
    !
    no ip domain lookup
    !
    multilink bundle-name authenticated
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    archive
     log config
      hidekeys
    !
    !
    !
    !
    ip tcp synwait-time 5
    ip ssh version 1
    !
    !
    !
    !
    interface FastEthernet0/0
     no ip address
     shutdown
     duplex auto
     speed auto
    !
    interface FastEthernet0/1
     no ip address
     shutdown
     duplex auto
     speed auto
    !
    interface FastEthernet1/0
     no ip address
     shutdown
     duplex auto
     speed auto
    !
    interface Serial2/0
     ip address 192.168.1.1 255.255.255.0
     ip access-group ACL_FOR_R1 out
     serial restart-delay 0
    !
    interface Serial2/1
     no ip address
     shutdown
     serial restart-delay 0
    !
    interface Serial2/2
     no ip address
     shutdown
     serial restart-delay 0
    !
    interface Serial2/3
     no ip address
     shutdown
     serial restart-delay 0
    !
    router eigrp 1
     network 192.168.1.0
     auto-summary
    !
    ip forward-protocol nd
    !
    !
    no ip http server
    no ip http secure-server
    !
    no cdp log mismatch duplex
    !
    !
    !
    !
    !
    !
    control-plane
    !
    !
    !
    !
    !
    !
    !
    !
    !
    banner motd ^C
    **********************************
    This is a Cisco .
    **********************************^C
    !
    line con 0
     exec-timeout 0 0
     privilege level 15
     password cisco
     logging synchronous
     login
    line aux 0
     exec-timeout 0 0
     privilege level 15
     logging synchronous
    line vty 0 4
     password cisco
     login
    line vty 5 15
     password cisco
     login
    !
    !
    end

    R1#un all
    All possible debugging has been turned off
    R1#

    R1#show run
    R1#show running-config
    Building configuration...

    Current configuration : 1557 bytes
    !
    version 12.4
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    !
    hostname R1
    !
    boot-start-marker
    boot-end-marker
    !
    !
    no aaa new-model
    memory-size iomem 5
    no ip icmp rate-limit unreachable
    ip cef
    !
    !
    !
    !
    no ip domain lookup
    !
    multilink bundle-name authenticated
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    archive
     log config
      hidekeys
    !
    !
    !
    !
    ip tcp synwait-time 5
    ip ssh version 1
    !
    !
    !
    !
    interface FastEthernet0/0
     no ip address
     shutdown
     duplex auto
     speed auto
    !
    interface FastEthernet0/1
     no ip address
     shutdown
     duplex auto
     speed auto
    !
    interface FastEthernet1/0
     no ip address
     shutdown
     duplex auto
     speed auto
    !
    interface Serial2/0
     ip address 192.168.1.1 255.255.255.0
     ip access-group ACL_FOR_R1 out
     serial restart-delay 0
    !
    interface Serial2/1
     no ip address
     shutdown
     serial restart-delay 0
    !
    interface Serial2/2
     no ip address
     shutdown
     serial restart-delay 0
    !
    interface Serial2/3
     no ip address
     shutdown
     serial restart-delay 0
    !
    router eigrp 1
     network 192.168.1.0
     auto-summary
    !
    ip forward-protocol nd
    !
    !
    no ip http server
    no ip http secure-server
    !
    no cdp log mismatch duplex
    !
    !
    !
    !
    !
    !
    control-plane
    !
    !
    !
    !
    !
    !
    !
    !
    !
    banner motd ^C
    **********************************
    This is a Cisco .
    **********************************^C
    !
    line con 0
     exec-timeout 0 0
     privilege level 15
     password cisco
     logging synchronous
     login
    line aux 0
     exec-timeout 0 0
     privilege level 15
     logging synchronous
    line vty 0 4
     password cisco
     login
    line vty 5 15
     password cisco
     login
    !
    !
    end

 - R2's configurations:

R2#show running-config
Building configuration...

Current configuration : 1627 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
no ip icmp rate-limit unreachable
ip cef
!
!
!
!
no ip domain lookup
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
archive
 log config
  hidekeys
!
!
!
!
ip tcp synwait-time 5
ip ssh version 1
!
!
!
!
interface FastEthernet0/0
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface FastEthernet0/1
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface FastEthernet1/0
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface Serial2/0
 ip address 192.168.1.2 255.255.255.0
 ip access-group ACL_FOR_R2 in
 serial restart-delay 0
!
interface Serial2/1
 ip address 192.168.2.1 255.255.255.0
 serial restart-delay 0
!
interface Serial2/2
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial2/3
 no ip address
 shutdown
 serial restart-delay 0
!
router eigrp 1
 network 192.168.1.0
 network 192.168.2.0
 auto-summary
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
!
ip access-list extended ACL_FOR_R2
!
no cdp log mismatch duplex
!
!
!
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
banner motd ^C
**********************************
This is a Cisco .
**********************************^C
!
line con 0
 exec-timeout 0 0
 privilege level 15
 password cisco
 logging synchronous
 login
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line vty 0 4
 password cisco
 login
line vty 5 15
 password cisco
 login
!
!
end

 - R3's configurations:

R3#show running-config
Building configuration...

Current configuration : 1525 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R3
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
no ip icmp rate-limit unreachable
ip cef
!
!
!
!
no ip domain lookup
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
archive
 log config
  hidekeys
!
!
!
!
ip tcp synwait-time 5
ip ssh version 1
!
!
!
!
interface FastEthernet0/0
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface FastEthernet0/1
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface FastEthernet1/0
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface Serial2/0
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial2/1
 ip address 192.168.2.2 255.255.255.0
 serial restart-delay 0
!
interface Serial2/2
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial2/3
 no ip address
 shutdown
 serial restart-delay 0
!
router eigrp 1
 network 192.168.2.0
 auto-summary
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
!
no cdp log mismatch duplex
!
!
!
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
banner motd ^C
**********************************
This is a Cisco .
**********************************^C
!
line con 0
 exec-timeout 0 0
 privilege level 15
 password cisco
 logging synchronous
 login
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line vty 0 4
 password cisco
 login
line vty 5 15
 password cisco
 login
!
!
end

R1#ping 192.168.2.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 28/46/88 ms
R1#ping 192.168.2.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/46/104 ms
share|improve this question
up vote 4 down vote accepted

Normally you would be right, there is an implied "deny" at the end of every access list. You have found the exception however, because you use an empty access list:

interface Serial2/0
 ip address 192.168.1.2 255.255.255.0
 ip access-group ACL_FOR_R2 in
 serial restart-delay 0
!
<snip>
!
ip access-list extended ACL_FOR_R2
!

According to the documentation:

"An interface or command with an empty access list applied to it permits all traffic into the network."

So as soon as you add any term to the ACL, it will start blocking all other traffic.

share|improve this answer

Your configurations are really messed up; you don't even have an ACL defined on R1, but you are applying one to the interface. The proper ways to deny the host (rather than all traffic except what you want to specifically permit) 192.168.1.1 from reaching the 192.168.2.0/24 network are:

Apply a standard access list to R2 Serail2/1 to prevent traffic from that host out the interface with that network, while allowing any other traffic out that interface and allowing any traffic from that host out any other interface:

interface Serial2/1
 ip address 192.168.2.1 255.255.255.0
 ip access-group DENY_HOST in
!
ip access-list standard DENY_HOST
 deny host 192.168.1.1
 permit any
!

You could explicitly permit a different address and use the implicit deny all to block everything else (it doesn't matter that the network doesn't even exit on your network):

interface Serial2/1
 ip address 192.168.2.1 255.255.255.0
 ip access-group PERMIT_BOGUS in
!
ip access-list standard PERMIT_BOGUS
 permit 192.168.0.0 0.0.0.255
!

Apply an extended access list to R2 Serail2/0 to drop any traffic in from that host destined to that network, while allowing traffic in from that host, or any other traffic, to anywhere else:

interface Serial2/0
 ip address 192.168.1.2 255.255.255.0
 ip access-group DENY_HOST out
!
ip access-list extended DENY_HOST
 deny ip host 192.168.1.1 192.168.2.0 0.0.0.255
 permit ip any any
!

You could explicitly permit a different address and use the implicit deny all to block everything else (it doesn't matter that the network doesn't even exit on your network):

interface Serial2/0
 ip address 192.168.1.2 255.255.255.0
 ip access-group PERMIT_BOGUS out
!
ip access-list extended PERMIT_BOGUS
 permit ip 192.168.0.0 0.0.0.255 any
!

I think you are confusing things since the implicit deny at the end will deny all traffic from any host, not just the one host, except what you explicitly permit, and that is not what your question wants to do. In any case, you need to have something in your access list.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.