The Cisco "deny" ACL seems to quietly drop TCP/IP packets. Is it possible for it to send either ICMP responses or TCP RST's in response to a denied request?


1 Answer 1


Short answer: no. Cisco IP Access Lists can only "permit" or "deny" (drop) packets.

Edit: I stand corrected. Configuring IP Unreachables on the interface results in an ICMP-unreachable message when the packet is dropped.

interface FastEthernet0/1
 ip address
 ip access-group 101 in
 ip unreachables
  • 3
    Take care with the ip unreachables as this will increase CPU utilization. ACLs are processed in hardware, but unreachable messages are CPU processed. See Cisco docs like this one for more information.
    – YLearn
    Feb 2, 2015 at 14:47
  • 1
    FYI Cisco rate limits icmp unreachables by default in ios Feb 2, 2015 at 15:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.