1

I created this network to do some general practice. Every host on the network can ping every other host. The routers are just using a basic RIPv2 configuration. All of the interfaces can ping all the other interfaces.

I created a basic ACL on Router 3 on the right. As you can see by my picture, the ACL is configured for blocking both IP and ICMP packets destined for 10.10.2.2. I place this ACL on FA1/0 out of Router 3 and it is still not filtering out the packets when I ping.

Any thoughts as to why packets destined for this host are still getting through when the ACL is clearly configured to filter these packets?

Config:

Router(config)#ip access-list extended Divide

Router(config-ext-nacl)#deny ip any host 10.10.2.2

Router(config-ext-nacl)#deny icmp an host 10.10.2.2 

Router(config-ext-nacl)#permit ip any any

Router(config-ext-nacl)#exit

Router(config)#interface fastEthernet 1/0

Router(config-if)#ip access-group Divide out

Router(config-if)#exit

enter image description here

Improve this question
5
  • Please add your configurations to question
    – infra
    Commented Jun 4, 2019 at 4:33
  • @infra for every router and host ?
    – Bearing
    Commented Jun 4, 2019 at 4:37
  • I can't see, your configurations on interface.
    – infra
    Commented Jun 4, 2019 at 4:39
  • No R3 is enough
    – infra
    Commented Jun 4, 2019 at 4:39
  • @infra Done. Sorry about that.
    – Bearing
    Commented Jun 4, 2019 at 4:47

1 Answer 1

Reset to default
1

It is not possible in your situation, because You are going to block IP address which is not connected in interface. If you apply this configuration on Router which is having 10.10.2.1 (Router which next to 10.10.2.2) will be worked.

ACL needs to implement in most closet interface.

Improve this answer
7
  • Ok. I'll try that but let me ask you this: Why can't I used an extended ACL on R3 if I am specifying the destination address of Server 2?
    – Bearing
    Commented Jun 4, 2019 at 4:58
  • It is a prerequisite to implement acl
    – infra
    Commented Jun 4, 2019 at 5:01
  • I just did what you said and Im still able to ping. deny ip 172.168.1.0 0.0.0.255 host 10.10.2.2
    – Bearing
    Commented Jun 4, 2019 at 5:04
  • I did this on the router next to server 2 to and implemented in on Fa0/0
    – Bearing
    Commented Jun 4, 2019 at 5:05
  • change to your ACL deny icmp x.x.x. host y.y.y.y echo And make sure that direction is out
    – infra
    Commented Jun 4, 2019 at 5:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.