2

Is there a work-around to apply an ACL to packet originated by the router itself? How do I block certain packets not forwarded but sent by the router matching the ACL? I do not want to solve this issue by configuring ICMP.

For example, three routers, connected by R02.

R0001#sh ip int Fa0/0 | inc Internet
  Internet address is 10.0.1.1/30
R0001#


R0002#sh ip int Fa0/0 | inc Internet
  Internet address is 10.0.1.2/30
R0002#
R0002#sh ip int Fa0/0 | inc access list
  Outgoing access list is ipv4_out
  Inbound  access list is ipv4_in
R0002#
R0002#
R0002#show ip int Fa0/1 | inc Internet
  Internet address is 10.0.2.1/30
R0002#
R0002#sh ip int Fa0/0 | inc access list
  Outgoing access list is ipv4_out
  Inbound  access list is ipv4_in
R0002#


R0003#sh ip int Fa0/1 | inc Internet
  Internet address is 10.0.2.2/30
R0003#

One ICMP Echo sent from R0001 to R0002:

R0001#ping 10.0.2.2 repeat 1

Type escape sequence to abort.
Sending 1, 100-byte ICMP Echos to 10.0.2.2, timeout is 2 seconds:
.
Success rate is 0 percent (0/1)
R0001#

R0002 informs R0003 that its Echo Reply has been blocked:

R0003#
02:41:48: ICMP: echo reply sent, src 10.0.2.2, dst 10.0.1.1
02:41:48: ICMP: dst (10.0.2.2) administratively prohibited unreachable rcv from 10.0.2.1
R0003#

The ICMP Echo did match the related rule. The Echo Reply did not match a rule of ipv4_out ACL:

R0002#show ip access-list ipv4_in 
Extended IP access list ipv4_in
    200 deny icmp 10.0.2.0 0.0.0.3 10.0.1.0 0.0.0.3 echo-reply (3 matches)
    998 permit ip any any (1 match)
    999 deny ip any any
R0002#
R0002#show ip access-list ipv4_out
Extended IP access list ipv4_out
    200 deny icmp host 10.0.2.1 10.0.2.0 0.0.0.3
    998 permit ip any any (1 match)
    999 deny ip any any
R0002#

Even if I try another approach, there is still no match:

R0001#ping 10.0.2.2 repeat 1

Type escape sequence to abort.
Sending 1, 100-byte ICMP Echos to 10.0.2.2, timeout is 2 seconds:
.
Success rate is 0 percent (0/1)
R0001#


R0003#
02:56:15: ICMP: echo reply sent, src 10.0.2.2, dst 10.0.1.1
02:56:15: ICMP: dst (10.0.2.2) administratively prohibited unreachable rcv from 10.0.2.1
R0003#


R0002#show ip access-list ipv4_in 
Extended IP access list ipv4_in
    998 permit ip any any (2 matches)
    999 deny ip any any
R0002#
R0002#
R0002#show ip access-list ipv4_out
Extended IP access list ipv4_out
    200 deny icmp host 10.0.2.1 10.0.2.0 0.0.0.3
    201 deny icmp host 10.0.2.2 10.0.1.0 0.0.0.3 (2 matches)
    998 permit ip any any (1 match)
    999 deny ip any any
R0002#

SOLUTION:

Here is the configuration as inspired by Everton:

ip access-list extended No_response_IPv4
 permit icmp host 10.0.2.1 10.0.2.0 0.0.0.3
 deny   ip any any

route-map No_response permit 10
 match ip address No_response_IPv4
 set interface Null0

ip local policy route-map No_response

This prevents R0002 from informing R0003 about having blocked its Echo Reply. Otherwise, R0003 would log this message: ICMP: dst (10.0.2.2) administratively prohibited unreachable rcv from 10.0.2.1. But by use of PBR, R0002 will silently discard an Echo Reply received from R0003. R0002 blocks an incoming Echo Reply from R0003 because R0002's interface has an ACL with deny icmp host 10.0.2.1 10.0.2.0 0.0.0.3 as a rule.

Improve this question

2 Answers 2

Reset to default
1

Try applying policy-based routing (PBR) to local traffic:

ip access-list extended DROP
 permit icmp host 10.0.2.1 10.0.2.0 0.0.0.3

route-map LOCAL_DROP permit 10
 match ip address DROP
 set interface null0

ip local policy route-map LOCAL_DROP

See also "Local PBR": http://www.cisco.com/c/en/us/td/docs/ios/12_2/qos/configuration/guide/fqos_c/qcfpbr.html

Improve this answer
3
  • I cannot use match for an ACL rule. Is that a special type of ACL? Skipping through Cisco's Security Configuration Guide: Access Control Lists didn't reveal an answer to me.
    – user2964971
    Feb 6, 2016 at 9:08
  • 1
    Please consider the appended section SOLUTION:. It describes the correct configuration.
    – user2964971
    Feb 6, 2016 at 18:56
  • @user2964971 Fixed.
    – Everton
    Feb 7, 2016 at 21:21
0

You could also use a QoS class-map to match the traffic (you'd have to match on source IP address) and then drop the traffic in that class with a policy-map. Clunky...

Improve this answer
3
  • I'm aware that it's clunky. I simply couldn't believe that there isn't a way to filter a router's own traffic.
    – user2964971
    Feb 6, 2016 at 9:28
  • 1
    Historic reasons - traffic generated by a router uses a different code path to get to the interface... and once someone big enough starts relying on that behavior you can't change it. Also, keep in mind that if you only use outbound ACL (yet again, the reasons might be 30 years old), you don't need to account for control-plane protocols like OSPF or BGP, they just work (another reason nobody wants to change the behavior ;)
    – ioshints
    Feb 7, 2016 at 10:06
  • +1. Thank you, I'm thinkg I'm getting it. So I've found an interesting artible by Cisco: Control Plane Policing Implementation Best Practices, cisco.com/c/en/us/about/security-center/…
    – user2964971
    Feb 7, 2016 at 12:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.