2

Good evening!

Recently i've got some problem in configuring cisco router (IOS 12.x). There is an virtual interface for a vlan:

interface GigabitEthernet0/1.203
 description Department XXX
 encapsulation dot1Q 203
 ip address 10.0.0.193 255.255.255.192
 ip helper-address 192.168.0.3
 ip access-group v203in in
 no ip proxy-arp
 ip flow ingress
 ip flow egress
 ip virtual-reassembly
end

and there is an extended access-list:

ip access-list extended v203in
 deny ip any any log

And all is brilliant. Computer connected to some trunc port via cisco switch can't get it's ip-address from dhcp server and can't access the network.

Now we will do some magic:

no ip access-list extended v203in
ip access-list extended v203in
 permit udp any any eq 67
 permit udp any any eq 68
 deny ip any any log

Oh, good, our computer have got it's IP-address... but... wait, what the hell?!
(sorry for cyrillic output, it's trivial to understand):

C:\>ping ya.ru
Обмен пакетами с ya.ru [93.158.134.3] с 32 байтами данных:
Ответ от 93.158.134.3: число байт=32 время=2мс TTL=55     
Ответ от 93.158.134.3: число байт=32 время=2мс TTL=55    

tracert ya.ru says reply from 10.0.0.193: host is unreachable.

Can please any one explain to me this 'magic' or how the packets flows thru ACL?


Workstation's ip is 10.0.0.194/26, gateway is 10.0.0.193.

  • I don't understand the problem. The only thing you are allowing on the interface is DHCP, so a traceroute should fail. – Ron Maupin Mar 22 '17 at 19:51
  • Yes, but should not ping fail too? It's working. And the websites are also available. – Alekcvp Mar 22 '17 at 20:05
  • In other words: the only thing that have been blocked is a traceroute. – Alekcvp Mar 22 '17 at 20:11
  • Ping uses ICMP, and you could block ICMP, too. Traceroute uses UDP, and the only UDP you are allowing is DHCP. – Ron Maupin Mar 22 '17 at 20:13
  • Does deny ip any any log block tcp, udp and icmp, doesn't it? Should it block web site access from browser? – Alekcvp Mar 22 '17 at 20:16
1

Your ACL is only allowing DHCP (ports 67 and 68). ICMP, which is what ping uses, doesn't operate at layer 4 therefore it doesn't have a port number. Traceroute uses a port in 30,000's range (I forget the exact number). The ACL statement you have is blocking all ports except port 67 and 68. Hope this helps.

| improve this answer | |
1

That was a bug in iOS 12.4. Other device with 15.x doesn't have that problems.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.