1

trying to deny ping from 12.12.12.0 network

Hello everyone.

What I'm trying to do is to deny ping access from the 12.12.12.0 network to reach the 10.10.10.0 network but not deny ping access to go from 10.10.10.0 network and reach the 12.12.12.0 network. So basically PC2 and PC3 can't ping PC0 and PC1 but PC0 and PC1 can or the other way around.

this is what I tried to do so far with no success. It either blocks ping from both sides or allow it.

Router#show run
Building configuration...

Current configuration : 1328 bytes
!
version 12.4
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Router
!
!
!
!
!
!
!
!
no ip cef
no ipv6 cef
!
!
!
!
!
!
!
!
!
!
!
!
spanning-tree mode pvst
!
!
!
!
!
!
interface FastEthernet0/0
 ip address 10.10.10.1 255.255.255.0
 ip access-group 101 out
 duplex auto
 speed auto
!
interface FastEthernet0/1
 no ip address
 duplex auto
 speed auto
 shutdown
!
interface Serial1/0
 ip address 11.11.11.1 255.255.255.0
 ip access-group 101 in
!
interface Serial1/1
 no ip address
 clock rate 2000000
 shutdown
!
interface Serial1/2
 no ip address
 clock rate 2000000
 shutdown
!
interface Serial1/3
 no ip address
 clock rate 2000000
 shutdown
!
interface Serial1/4
 no ip address
 clock rate 2000000
 shutdown
!
interface Serial1/5
 no ip address
 clock rate 2000000
 shutdown
!
interface Serial1/6
 no ip address
 clock rate 2000000
 shutdown
!
interface Serial1/7
 no ip address
 clock rate 2000000
 shutdown
!
interface Vlan1
 no ip address
 shutdown
!
router rip
 network 10.0.0.0
 network 11.0.0.0
 network 12.0.0.0
!
ip classless
!
ip flow-export version 9
!
!
access-list 101 permit icmp host 12.12.12.3 10.10.10.0 0.0.0.255
access-list 101 permit icmp 10.10.10.0 0.0.0.255 any
!
!
!
!
!
line con 0
!
line aux 0
!
line vty 0 4
 login
!
!
!
end
1

You are completely permitting ICMP, and only ICMP (there is an implicit deny all at the end of an ACL). Ping uses an ICMP echo request, and an ICMP echo reply. You can deny the ICMP echo request from 12.12.12.0/24 to 10.10.10.0/24 from entering the router:

interface FastEthernet0/0
 no ip access-group 101 out
!
interface Serial1/0
 ip access-group 101 in
!
no access-list 101
!
access-list 101 deny icmp 12.12.12.0 0.0.0.255 10.10.10.0 0.0.0.255 echo
access-list 101 permit ip any any
!

You do not need an ACL on the 10.10.10.0/24 interface because you are not restricting that network. You restrict ICMP echo requests from entering the 12.12.12.0/24 network from entering the router. In fact, that ACL should be placed on the other router on the interface from the 12.12.12.0/24 network because extended ACLs are usually placed as close to the source as possible in order to prevent traffic that is destined to be dropped from being routed in the first place, but it will work on either router.

  • I see but it solved my problem better with "ip access-group 101 out" on the serial interface rather than "in". I think with the "in", it blocks incoming ICMP echo requests from the 10.10.10.0 network too which we don't want – Blue Eagle Sep 20 '18 at 1:38
  • You should edit your question to say what you mean. If this ACL is on the router with the 10.10.10.0/24 network, then you want it in on the serial interface because you are blocking incoming echo requests from the other router with the 12.12.12.0/24 network that you explained. Otherwise, put it in on the ethernet interface for the 12.12.12.0/24 network to block echo requests from that network ever being routed. – Ron Maupin Sep 20 '18 at 1:44
  • I actually configured the ACL on the router with the 12.12.12.0 network with out on its serial interface. – Blue Eagle Sep 20 '18 at 1:56
  • 1
    That still routes the traffic through the router, wasting router resources. That is why I said you should put it in on the interface of the 12.12.12.0/24 network. – Ron Maupin Sep 20 '18 at 2:04
  • 1
    If you put it on the output interface, the router is routing the packets through the router before dropping them, wasting router resources. Placing it on the input interface drops the packets before routing them from the input to the output interfaces. That is why extended ACLs should be placed as close to the source as possible. – Ron Maupin Sep 20 '18 at 2:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.