4

The Cisco "deny" ACL seems to quietly drop TCP/IP packets. Is it possible for it to send either ICMP responses or TCP RST's in response to a denied request?

0

1 Answer 1

3

Short answer: no. Cisco IP Access Lists can only "permit" or "deny" (drop) packets.

Edit: I stand corrected. Configuring IP Unreachables on the interface results in an ICMP-unreachable message when the packet is dropped.

interface FastEthernet0/1
 ip address 10.1.1.2 255.255.255.0
 ip access-group 101 in
 ip unreachables
end
2
  • 3
    Take care with the ip unreachables as this will increase CPU utilization. ACLs are processed in hardware, but unreachable messages are CPU processed. See Cisco docs like this one for more information.
    – YLearn
    Feb 2, 2015 at 14:47
  • 1
    FYI Cisco rate limits icmp unreachables by default in ios Feb 2, 2015 at 15:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.