I'm making a little practice in packet tracer and I'm configuring ACL. I want that the network call "Free WiFi Clientes" can not access to IT but when I deny that network in Router 3 I try to ping from one PC in IT network to one PC in Free WiFi network but it doesn't let me.

I did it with ACL standard:

10 deny
20 deny
30 deny
40 deny (4 match(es))
50 permit any

enter image description here

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Commented Dec 14, 2019 at 18:38

1 Answer 1


You are blocking all traffic from that network to the IT network. Ping is an application that uses ICMP echo requests and echo replies. but you are blocking the replies. If you want to block the requests, but not the replies, then you need to use an extended access list that does that.

For example:

permit icmp echo-reply

Standard access lists are placed outbound as close to the destination as possible so as to not block too much traffic, but extended access lists should be placed inbound as close to the source as possible so as to not route traffic that is destined to be dropped. You can do that with extended access lists because they have both the source and destination, while standard access lists do not.

Also, notice that your wildcard masks are wrong for the mask length in the diagram, and the diagram does not have a Router 3 as your question says.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.