how to deny ping from one direction but not the other using Access-list

Question

Hello everyone.

What I'm trying to do is to deny ping access from the 12.12.12.0 network to reach the 10.10.10.0 network but not deny ping access to go from 10.10.10.0 network and reach the 12.12.12.0 network. So basically PC2 and PC3 can't ping PC0 and PC1 but PC0 and PC1 can or the other way around.

this is what I tried to do so far with no success. It either blocks ping from both sides or allow it.

Router#show run
Building configuration...

Current configuration : 1328 bytes
!
version 12.4
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Router
!
!
!
!
!
!
!
!
no ip cef
no ipv6 cef
!
!
!
!
!
!
!
!
!
!
!
!
spanning-tree mode pvst
!
!
!
!
!
!
interface FastEthernet0/0
 ip address 10.10.10.1 255.255.255.0
 ip access-group 101 out
 duplex auto
 speed auto
!
interface FastEthernet0/1
 no ip address
 duplex auto
 speed auto
 shutdown
!
interface Serial1/0
 ip address 11.11.11.1 255.255.255.0
 ip access-group 101 in
!
interface Serial1/1
 no ip address
 clock rate 2000000
 shutdown
!
interface Serial1/2
 no ip address
 clock rate 2000000
 shutdown
!
interface Serial1/3
 no ip address
 clock rate 2000000
 shutdown
!
interface Serial1/4
 no ip address
 clock rate 2000000
 shutdown
!
interface Serial1/5
 no ip address
 clock rate 2000000
 shutdown
!
interface Serial1/6
 no ip address
 clock rate 2000000
 shutdown
!
interface Serial1/7
 no ip address
 clock rate 2000000
 shutdown
!
interface Vlan1
 no ip address
 shutdown
!
router rip
 network 10.0.0.0
 network 11.0.0.0
 network 12.0.0.0
!
ip classless
!
ip flow-export version 9
!
!
access-list 101 permit icmp host 12.12.12.3 10.10.10.0 0.0.0.255
access-list 101 permit icmp 10.10.10.0 0.0.0.255 any
!
!
!
!
!
line con 0
!
line aux 0
!
line vty 0 4
 login
!
!
!
end

Answer 1

You are completely permitting ICMP, and only ICMP (there is an implicit deny all at the end of an ACL). Ping uses an ICMP echo request, and an ICMP echo reply. You can deny the ICMP echo request from 12.12.12.0/24 to 10.10.10.0/24 from entering the router:

interface FastEthernet0/0
 no ip access-group 101 out
!
interface Serial1/0
 ip access-group 101 in
!
no access-list 101
!
access-list 101 deny icmp 12.12.12.0 0.0.0.255 10.10.10.0 0.0.0.255 echo
access-list 101 permit ip any any
!

You do not need an ACL on the 10.10.10.0/24 interface because you are not restricting that network. You restrict ICMP echo requests from entering the 12.12.12.0/24 network from entering the router. In fact, that ACL should be placed on the other router on the interface from the 12.12.12.0/24 network because extended ACLs are usually placed as close to the source as possible in order to prevent traffic that is destined to be dropped from being routed in the first place, but it will work on either router.