1

I have access-list on my router like this:

access-list 101 permit ip 10.1.130.0 0.0.0.255 host 10.1.1.25
access-list 101 deny ip any any log

And interface ip address is like this:

interface FastEthernet0/0
ip address 10.1.130.254 255.255.255.0
ip access-group 101 in

As I understand, only host 10.1.1.25 will be able to ping all my network from outside.

But, on other outside routers (branches), all IPs with full access can ping 10.1.130.254

Why IPs with full access can ping my router's interface ip address despite the deny ip any any in the end of ACL?


PS: All routers are cisco. They can ping only interface ip address, but not whole network.

  • Which IP ranges are considered "outside", what is "inside"? Is there more than one router interface involved? Remember that ACLs are unidirectional, and source/dest definitions in an ACL must be set the exact way the ip packet is seen in the given direction on the interface to which you bind the ACL. – Marc 'netztier' Luethi Aug 3 '18 at 13:04
  • there are 2 interfaces. Outside interface and insider interface on router. Outside ip addresses are: all ip addresses except 10.1.130.0/24 network. – it dev Aug 4 '18 at 3:57
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 25 '18 at 9:08
1

Your ACL direction is IN, this will filter traffic coming in from your Lan.

This will allow traffic from your Lan 10.1.130.0 255.255.255.0 to access 10.1.1.25

As Ron stated your direction is wrong, it would need to be

ip access-group 101 out

But, if that were the case you would also need to, change your source and destination around

access-list 101 permit ip host 10.1.1.25 10.1.130.0 0.0.0.255 

When considering the ACL direction, always think of standing in the middle of the router, and you are looking OUT an interface or the traffic is looking IN

Dont think of your traffic as OUT Wan and in Lan

| improve this answer | |
0

Your ACL is backwards. Swap the source and destination addresses (and masks).

| improve this answer | |
  • No, ACL is not backwards. It filters IN traffic to internal interface of router. LAN is 10.1.130.0/24. LAN is going in the IN direction to router interface. And then, after that, it goes to outside interface with OUT direction. – it dev Aug 4 '18 at 3:59
  • My question is still the same. Why ips with full access on other routers (branch network) can ping my router's interface ip address 10.1.130.254? – it dev Aug 4 '18 at 4:01
  • For example, in branch office, ip address with 10.1.1.45 can ping 10.1.130.254. In branch office's router there is ACL with "permit ip host 10.1.1.45 any" – it dev Aug 4 '18 at 4:02
  • It’s backwards. The first address is the source address and the second is the destination address of the packet – Ron Trunk Aug 4 '18 at 11:17
  • it is not backwards. Source is my network and destination is branch network. – it dev Aug 4 '18 at 11:20
0

The router is processing the ping request and replying to all devices because the in ACL doesn't apply to traffic sourced from the router.

Also Ron's answer is a best practice, but won't fix this issue. You want to drop all traffic that will be denied closest to the source, not after the source has reached your protected device and you are only dropping the reply packet.

| improve this answer | |
0

The extended access list syntax is described below.

Access-list <number 100-199> <permit | deny> <protocol> <source> < sourcemask> <operator source port> < destination> <destination-mask> < operator destination port> <options> < log>

So as per you access list the source and destination interface are inaccurate, they need to be swapped for it to work

| improve this answer | |
0

The solution is this:
Access list I provided filters only IN traffic, but it does not refer to router's interface ip address.
So, from outside, anyone with full access can ping only my router's ip address.
It means that router's interface ip address considered as OUT address.

The possible solutions:
1. Use both IN and OUT access-lists on the interface.
2. Use ACLs on vty (telnet, etc.) interfaces.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.