2

I have an output ACL applied on a WAN interface that permits only 1 IP from going out.

interface Cellular0
 ip address negotiate
 ip access-group allow100.98.170.25 out
 ip nat outside
 no ip unreachables
!
ip access-list extended allow100.98.170.25
 permit ip host 100.98.170.25 any
 deny   ip any any log
!

However, when the ACL drops the packet, it makes a loud drop and generates an ICMP unreachable. And because the packet is generated by the control plane, it is not blocked by the ACL.

And even though I have no ip unreachable, it does not work. It appears that I must apply it to the interface which originally received the packet, which could be coming from any LAN. If I do that, my LAN users will not get their ICMP unreachables for legitimate cases.

Is there a way to make ACL drop packets quietly?

If not, is there a way to blackhole post-NAT traffic not matching an ACL?

  • Did you apply the no ip unreachables command to the interface where the traffic enters the router? – Ron Maupin Sep 28 '17 at 22:22
  • I guess I did not mentioned it clearly, I did not and it is not practical for me to do that. – some user Sep 28 '17 at 22:25
  • 1
    ACL drops do not generate ip unreachables. – Ron Trunk Sep 28 '17 at 22:31
  • I believe the router generates the (rate limited) ICMP unreachables after an ACL drop. Is that what you are trying to say? – some user Sep 28 '17 at 22:49
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Feb 21 '18 at 17:41
1

The ICMP unreachable message is generated by the router and sent back through the interface where the original traffic entered the router. Placing the no ip unreachables command on the outside interface does nothing for traffic entering the router on an inside interface. You will need to apply the command on the inside interface for traffic being blocked to the outside interface.

You place the command on the outside interface to block the ICMP message going out for traffic originated outside. You need to place the command on the interface to which the ICMP message would be sent back toward the traffic source. In your case, that appears to be the inside interface.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.