Good evening!

Recently i've got some problem in configuring cisco router (IOS 12.x). There is an virtual interface for a vlan:

interface GigabitEthernet0/1.203
 description Department XXX
 encapsulation dot1Q 203
 ip address
 ip helper-address
 ip access-group v203in in
 no ip proxy-arp
 ip flow ingress
 ip flow egress
 ip virtual-reassembly

and there is an extended access-list:

ip access-list extended v203in
 deny ip any any log

And all is brilliant. Computer connected to some trunc port via cisco switch can't get it's ip-address from dhcp server and can't access the network.

Now we will do some magic:

no ip access-list extended v203in
ip access-list extended v203in
 permit udp any any eq 67
 permit udp any any eq 68
 deny ip any any log

Oh, good, our computer have got it's IP-address... but... wait, what the hell?!
(sorry for cyrillic output, it's trivial to understand):

C:\>ping ya.ru
Обмен пакетами с ya.ru [] с 32 байтами данных:
Ответ от число байт=32 время=2мс TTL=55     
Ответ от число байт=32 время=2мс TTL=55    

tracert ya.ru says reply from host is unreachable.

Can please any one explain to me this 'magic' or how the packets flows thru ACL?

Workstation's ip is, gateway is

  • I don't understand the problem. The only thing you are allowing on the interface is DHCP, so a traceroute should fail.
    – Ron Maupin
    Commented Mar 22, 2017 at 19:51
  • Yes, but should not ping fail too? It's working. And the websites are also available.
    – Alekcvp
    Commented Mar 22, 2017 at 20:05
  • In other words: the only thing that have been blocked is a traceroute.
    – Alekcvp
    Commented Mar 22, 2017 at 20:11
  • Ping uses ICMP, and you could block ICMP, too. Traceroute uses UDP, and the only UDP you are allowing is DHCP.
    – Ron Maupin
    Commented Mar 22, 2017 at 20:13
  • Does deny ip any any log block tcp, udp and icmp, doesn't it? Should it block web site access from browser?
    – Alekcvp
    Commented Mar 22, 2017 at 20:16

2 Answers 2


Your ACL is only allowing DHCP (ports 67 and 68). ICMP, which is what ping uses, doesn't operate at layer 4 therefore it doesn't have a port number. Traceroute uses a port in 30,000's range (I forget the exact number). The ACL statement you have is blocking all ports except port 67 and 68. Hope this helps.


That was a bug in iOS 12.4. Other device with 15.x doesn't have that problems.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.