I've a client to which I want to deny access so that he cannot access my network host. There is this specified port that he scanned on my network host which I want to block (Port 137).
Using NMAP, the client is able to find my open port on my network host(137). So I implemented an ACL on my router using the command.
access-list 111 deny udp (insert client ip) any eq 137 access-list 111 permit udp any any
What I wanted to do is to make sure that the moment the client uses NMAP to scan my network host for the port, port 137 will be filtered instead of open because of the ACL configured, however, the client is unable to even ping my network host now unless I add another command,
permit ICMP any any, in the ACL.
Why is this so? Can any experts shed light about this?