I have created an access-list on my router. I denied one network, then permitted any. Denied network cannot ping my network. It is OK. But I also cannot ping that network. Why? Who can explain me? There is no access-list on that network.

1 Answer 1


That is because ping is bi-directional, and hosts on the network cannot reply.

Instead of a standard access list (outbound from the router to your network), if you use an extended access list, you can deny only an ICMP Echo Request request (inbound to the router from the network you want to restrict). That should allow an ICMP Echo Reply back to your network.

Something like:

access-list 101 permit icmp any <your network address> <your network mask> echo-reply
access-list 101 deny icmp any <your network address> <your network mask> echo
access-list 101 permit ip any any

interface g0/1      !*** the interface for the restricted network ***
 ip access-group 101 in
  • Thanks, that is clear. In my case, I denied that network with standard acl. If that network will permit my network on its interface, will ping go from my network to that network? Commented Nov 11, 2016 at 4:58
  • What I described is an inbound ACL. There is no outbound ACL, so your network can send anything it wants to the other network.
    – Ron Maupin
    Commented Nov 11, 2016 at 5:00
  • what does it mean inbound ACL? Commented Nov 11, 2016 at 5:01
  • That is what most people call an access list. ACL (Access Control List)
    – Ron Maupin
    Commented Nov 11, 2016 at 5:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.