Understanding Cisco standard access lists (Packet Tracer example)

Question

Consider the following example: I have two networks (192.168.1.0 and 192.168.2.0) with one PC in each network (PC0 - 192.168.1.1 and PC1 - 192.168.2.1) and a router R0 with 2 interfaces connecting these networks:

Then I configure a standard access list on the R0's Fa0/1 interface to block traffic outcoming from PC0 to PC1 as:

R0(config)#access-list 1 deny host 192.168.1.1
R0(config)#access-list 1 permit any
R0(config)#interface fa0/1
R0(config-if)#ip access-group 1 out

When I ping PC1 from PC0 I'm getting this result as expected:

C:\>ping 192.168.2.1

Pinging 192.168.2.1 with 32 bytes of data:

Reply from 192.168.1.10: Destination host unreachable.
Reply from 192.168.1.10: Destination host unreachable.
Reply from 192.168.1.10: Destination host unreachable.
Reply from 192.168.1.10: Destination host unreachable.

But when I try to ping PC0 from PC1, I'm getting

C:\>ping 192.168.1.1

Pinging 192.168.1.1 with 32 bytes of data:

Request timed out.
Request timed out.
Request timed out.
Request timed out.

Since the, "access-group 1 out" is configured in R0's interface Fa0/1, it should just only filter traffic coming from the outside, right? So my Ping request should be permitted, but I'm getting the unreachable response.

Why so? I would really appreciate a help on this one.

Answer 1

Ping is an application that is bidirectional. It sends an ICMP request, and expects an ICMP reply. You have broken the traffic from one direction, so you cannot ping either direction (one way the request cannot go through, and the other direction the reply cannot go through).

What you need to do is to use an extended access list that blocks either the the ICMP echo request, or the ICMP echo reply, depending on how you want it to perform.

Answer 2

The keywords "IN" and "OUT" are from the perspective of the router interface. So IN refers to traffic received on the router interface (Into the router), and OUT refers to traffic sent from the router (out of the router interface).

Answer 3

getting to different answers might be confusing but to see the difference we should use simulation mode in packet tracer .

by blocking the way on pc0 to reach to pc1 when pinging from pc0 it will say destination host unreachable which means that i don't have any route that can take me to pc1 . but since pc1 isn't denied from access it will send the packet and the packet will reach to pc0 but when the icmp echo reply comes back from pc0 and doesn't come back within the required time it states " request time out ". Destination unreachable means no avaiable root whether its deny in an ACL or the pinged host is in another nework .