The Cisco "deny" ACL seems to quietly drop TCP/IP packets. Is it possible for it to send either ICMP responses or TCP RST's in response to a denied request?


Short answer: no. Cisco IP Access Lists can only "permit" or "deny" (drop) packets.

Edit: I stand corrected. Configuring IP Unreachables on the interface results in an ICMP-unreachable message when the packet is dropped.

interface FastEthernet0/1
 ip address
 ip access-group 101 in
 ip unreachables
  • Thank you! Even after I accepted the answer. You are a scholar and a gentleperson.
    – Pablo
    Feb 2 '15 at 12:44
  • 3
    Take care with the ip unreachables as this will increase CPU utilization. ACLs are processed in hardware, but unreachable messages are CPU processed. See Cisco docs like this one for more information.
    – YLearn
    Feb 2 '15 at 14:47
  • 1
    FYI Cisco rate limits icmp unreachables by default in ios Feb 2 '15 at 15:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.