I have created an access-list on my router. I denied one network, then permitted any. Denied network cannot ping my network. It is OK. But I also cannot ping that network. Why? Who can explain me? There is no access-list on that network.
Add a comment
|
1 Answer
That is because ping is bi-directional, and hosts on the network cannot reply.
Instead of a standard access list (outbound from the router to your network), if you use an extended access list, you can deny only an ICMP Echo Request request (inbound to the router from the network you want to restrict). That should allow an ICMP Echo Reply back to your network.
Something like:
access-list 101 permit icmp any <your network address> <your network mask> echo-reply
access-list 101 deny icmp any <your network address> <your network mask> echo
access-list 101 permit ip any any
interface g0/1 !*** the interface for the restricted network ***
ip access-group 101 in
answered Nov 11, 2016 at 4:52
-
Thanks, that is clear. In my case, I denied that network with standard acl. If that network will permit my network on its interface, will ping go from my network to that network? Commented Nov 11, 2016 at 4:58
-
What I described is an inbound ACL. There is no outbound ACL, so your network can send anything it wants to the other network.– Ron Maupin ♦Commented Nov 11, 2016 at 5:00
-
-
That is what most people call an access list. ACL (Access Control List)– Ron Maupin ♦Commented Nov 11, 2016 at 5:03