3

I'm making a little practice in packet tracer and I'm configuring ACL. I want that the network call "Free WiFi Clientes" can not access to IT but when I deny that network in Router 3 I try to ping from one PC in IT network to one PC in Free WiFi network but it doesn't let me.

I did it with ACL standard:

10 deny 192.168.10.0 0.0.0.7
20 deny 192.168.30.0 0.0.0.7
30 deny 192.168.60.0 0.0.0.31
40 deny 172.16.10.0 0.0.0.31 (4 match(es))
50 permit any

enter image description here

1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 14 '19 at 18:38
3

You are blocking all traffic from that network to the IT network. Ping is an application that uses ICMP echo requests and echo replies. but you are blocking the replies. If you want to block the requests, but not the replies, then you need to use an extended access list that does that.

For example:

permit icmp 192.168.10.0.0 0.0.0.31 172.16.0.0 0.0.0.15 echo-reply

Standard access lists are placed outbound as close to the destination as possible so as to not block too much traffic, but extended access lists should be placed inbound as close to the source as possible so as to not route traffic that is destined to be dropped. You can do that with extended access lists because they have both the source and destination, while standard access lists do not.


Also, notice that your wildcard masks are wrong for the mask length in the diagram, and the diagram does not have a Router 3 as your question says.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.