2

I am testing following ACL on Cisco 3850 L3 switch :

C3850#show ip access-lists 101
Extended IP access list 101
    10 deny ip any any fragments
    20 permit ip any any (268 matches)

I applied access list on ISP side interface in:

interface TenGigabitEthernet1/1/1
 description ISP
 no switchport
 ip address 61.XX.XX.158 255.255.255.252
 ip access-group 101 in

From remote host, I am doing ping with -s 1500 big packet size so it will get fragments, and the ACL will drop them. It looks like it works, too; I am not getting ping reply back.

To make sure routing dropping packet or not, I ran tcpdump on one of HOST machines, and I can see ICMP packets coming in. It's strange why the router is not dropping them at inbound ?

The ACL hit count is zero for fragments:

C3850#show ip access-lists 101
Extended IP access list 101
    10 deny ip any any fragments
    20 permit ip any any (4006 matches)
  • Try to do a ping with something really large, like 20000. – Ron Maupin May 12 '16 at 16:34
  • i tried -s 20000 and still i am seeing on host packet coming in and on ACL no hitcount – Satish May 12 '16 at 16:36
  • I see. You are not denying ICMP fragments, Instead of deny ip any any fragments use deny icmp any any fragments. – Ron Maupin May 12 '16 at 16:39
  • Really? i think ip will include all L3 packets.. – Satish May 12 '16 at 16:42
  • IP and ICMP have a special relationship. Just try it to see if it works. – Ron Maupin May 12 '16 at 16:44
3

Apparently, this will treat an initial fragment the same as a non-fragment. The initial fragment will get through, but subsequent fragments in the same packet will be dropped.

See Access Control Lists and IP Fragments:

ACL Rules Flowchart

The following flowchart illustrates the ACL rules when non-fragments, initial fragments, and non-initial fragments are checked against the ACL.

Note: The non-initial fragments themselves contain only Layer 3, never Layer 4 information, although the ACL may contain both Layer 3 and Layer 4 information.

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.