Why my simple standard ACL outbound doesn't block the gateway's traffic/ping of the VLAN's SVI?

Question

I am using a router/switch Cisco C1111-8p with IOS XE 16.8.

I have 3 VLANs:

• 1: native/management
• 20: dev
• 50: Guests

I'd like to block Guests/VLAN50 to communicate with anybody else but Internet.

For that, I created an access-list standard with the subnet of the VLAN50. And I apply this ACL to the SVI of VLAN1/native/management and VLAN20/dev outbound (point of view of the router).

conf t
access-list 10 deny 192.168.50.0 0.0.0.255
access-list 10 permit any
end

# VLAN 1 DEFAULT NATIVE
conf t
vlan 1
interface vlan 1
ip address 192.168.0.1 255.255.255.0
ip nat inside
ip access-group 10 out
end

# VLAN 20
conf t
vlan 20
name Dev
interface vlan 20
ip address 192.168.20.1 255.255.255.0
ip nat inside
ip access-group 10 out
end

Ping of a device connected to the VLAN1 native is filtered:

$ ping 192.168.0.200
PING 192.168.0.200 (192.168.0.200) 56(84) bytes of data.
From 192.168.50.1 icmp_seq=1 Packet filtered
From 192.168.50.1 icmp_seq=2 Packet filtered
From 192.168.50.1 icmp_seq=3 Packet filtered

Nevertheless, I still can ping the VLAN1 and VLAN20 gateway 192.168.0.1 and 192.168.20.1.

$ ping 192.168.0.1
PING 192.168.0.1 (192.168.0.1) 56(84) bytes of data.
64 bytes from 192.168.0.1: icmp_seq=1 ttl=255 time=17.9 ms
64 bytes from 192.168.0.1: icmp_seq=2 ttl=255 time=30.4 ms

$ ping 192.168.20.1
PING 192.168.20.1 (192.168.20.1) 56(84) bytes of data.
64 bytes from 192.168.20.1: icmp_seq=1 ttl=255 time=2.73 ms
64 bytes from 192.168.20.1: icmp_seq=2 ttl=255 time=23.7 ms

Why?

I'm using a Wireless Access Point to make my test with a SSID for each different VLAN and VLAN1 as native VLAN. I'd like to first test with an ACL standard before using extended.

Full config for reference (I don't write the DHCP part):

vlan internal allocation policy ascending
!         
!         
!         
!         
!         
!         
interface Loopback0
 ip address 1.1.1.1 255.255.255.255
!         
interface GigabitEthernet0/0/0
 description WAN
 ip address x.x.x.x 255.255.255.252
 ip nat outside
 negotiation auto
!         
interface GigabitEthernet0/0/1
 no ip address
 shutdown 
 negotiation auto
!         
interface GigabitEthernet0/1/0
 switchport mode trunk
 switchport nonegotiate
!         
interface GigabitEthernet0/1/1
 shutdown 
!         
interface GigabitEthernet0/1/2
 switchport access vlan 10
 switchport mode access
!         
interface GigabitEthernet0/1/3
 switchport access vlan 20
 switchport mode access
!         
interface GigabitEthernet0/1/4
 shutdown 
!         
interface GigabitEthernet0/1/5
 shutdown 
!         
interface GigabitEthernet0/1/6
 switchport mode access
!         
interface GigabitEthernet0/1/7
 switchport mode access
!         
interface Vlan1
 ip address 192.168.0.1 255.255.255.0
 ip nat inside
 ip access-group 10 in
!         
interface Vlan10
 ip address 192.168.10.1 255.255.255.0
 ip nat inside
 ip access-group 10 out
!         
interface Vlan20
 ip address 192.168.20.1 255.255.255.0
 ip nat inside
 ip access-group 10 out
!         
interface Vlan50
 ip address 192.168.50.1 255.255.255.0
 ip nat inside
!         
ip nat inside source list NAT interface GigabitEthernet0/0/0 overload
ip forward-protocol nd
no ip http server
ip http secure-server
ip dns server
ip route 0.0.0.0 0.0.0.0 x.x.x.x
!         
!         
ip access-list standard NAT
 permit 192.168.10.0 0.0.0.255
 permit 192.168.0.0 0.0.0.255
 permit 192.168.20.0 0.0.0.255
 permit 192.168.50.0 0.0.0.255
!         
access-list 10 deny   192.168.50.0 0.0.0.255
access-list 10 permit any
!         
!         
!         
!         
control-plane
!         
!         
line con 0
 transport input none
 stopbits 1
line vty 0 4
 login local
 transport input ssh
!         
wsma agent exec
!         
wsma agent config
!         
wsma agent filesys
!         
wsma agent notify
!         
!         
end

Answer 1

You can still ping the router IP because the ACL is only applied to traffic passing through the interface and not to the interface itself.

Well if you want to make it as described, you'll have to do it like this:

vlan 1 - 192.168.0.0/24

vlan 10 - 192.168.10.0/24

vlan 20 - 192.168.20.0/24

vlan 50 - 192.168.50.0/24

access-list 10 deny 192.168.50.0 0.0.0.255
access-list 10 permit any

access-list 20 deny 192.168.0.0 0.0.0.255
access-list 20 deny 192.168.10.0 0.0.0.255
access-list 20 deny 192.168.20.0 0.0.0.255
access-list 20 permit any

interface Vlan1
 ip address 192.168.0.1 255.255.255.0
 ip nat inside
 ip access-group 10 out

interface Vlan10
 ip address 192.168.10.1 255.255.255.0
 ip nat inside
 ip access-group 10 out

interface Vlan20
 ip address 192.168.20.1 255.255.255.0
 ip nat inside
 ip access-group 10 out

interface Vlan50
 ip address 192.168.50.1 255.255.255.0
 ip nat inside
 ip access-group 20 out

Answer 2

From what user56700 said, an ACL rule is applied on the traffic going through not to the interface itself and thus not to the interface's gateway. Also, since I'm using VLAN with SVI, SVIs are internal components of a router, there is no way to block what's produced internally with an outbound rule. We need to block traffic before it gets routed.

To isolate the whole GUESTS VLAN but allowing Internet, standard ACLs aren't enough. We need to use an INBOUND rule.

By using a name extended ACL to the VLAN50 interface, I could stop all the traffic to other VLANs because the rule is applied in INBOUND, basically the traffic is rejected before reaching anything.

conf t
ip access-list extended GUESTSACL
deny ip any 192.168.0.0 0.0.0.255
deny ip any 192.168.10.0 0.0.0.255
deny ip any 192.168.20.0 0.0.0.255
permit ip any any
end
conf t
int vlan 50
ip access-group GUESTSACL in
end

The VLAN50's gateway will reply to each ICMP echo with a Communication administratively filtered ICMP message. This can lead to high CPU usage and gives hint what is blocked in the network.

To stop sending this message, we need to add no ip unreachables to the interface:

conf t
interface vlan 50
no ip unreachables
end