1

I have created an access-list on my router. I denied one network, then permitted any. Denied network cannot ping my network. It is OK. But I also cannot ping that network. Why? Who can explain me? There is no access-list on that network.

0

That is because ping is bi-directional, and hosts on the network cannot reply.

Instead of a standard access list (outbound from the router to your network), if you use an extended access list, you can deny only an ICMP Echo Request request (inbound to the router from the network you want to restrict). That should allow an ICMP Echo Reply back to your network.

Something like:

access-list 101 permit icmp any <your network address> <your network mask> echo-reply
access-list 101 deny icmp any <your network address> <your network mask> echo
access-list 101 permit ip any any

interface g0/1      !*** the interface for the restricted network ***
 ip access-group 101 in
4
  • Thanks, that is clear. In my case, I denied that network with standard acl. If that network will permit my network on its interface, will ping go from my network to that network? Nov 11 '16 at 4:58
  • What I described is an inbound ACL. There is no outbound ACL, so your network can send anything it wants to the other network.
    – Ron Maupin
    Nov 11 '16 at 5:00
  • what does it mean inbound ACL? Nov 11 '16 at 5:01
  • That is what most people call an access list. ACL (Access Control List)
    – Ron Maupin
    Nov 11 '16 at 5:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.