I created this network to do some general practice. Every host on the network can ping every other host. The routers are just using a basic RIPv2 configuration. All of the interfaces can ping all the other interfaces.

I created a basic ACL on Router 3 on the right. As you can see by my picture, the ACL is configured for blocking both IP and ICMP packets destined for I place this ACL on FA1/0 out of Router 3 and it is still not filtering out the packets when I ping.

Any thoughts as to why packets destined for this host are still getting through when the ACL is clearly configured to filter these packets?


Router(config)#ip access-list extended Divide

Router(config-ext-nacl)#deny ip any host

Router(config-ext-nacl)#deny icmp an host 

Router(config-ext-nacl)#permit ip any any


Router(config)#interface fastEthernet 1/0

Router(config-if)#ip access-group Divide out


enter image description here

  • Please add your configurations to question
    – infra
    Commented Jun 4, 2019 at 4:33
  • @infra for every router and host ?
    – Bearing
    Commented Jun 4, 2019 at 4:37
  • I can't see, your configurations on interface.
    – infra
    Commented Jun 4, 2019 at 4:39
  • No R3 is enough
    – infra
    Commented Jun 4, 2019 at 4:39
  • @infra Done. Sorry about that.
    – Bearing
    Commented Jun 4, 2019 at 4:47

1 Answer 1


It is not possible in your situation, because You are going to block IP address which is not connected in interface. If you apply this configuration on Router which is having (Router which next to will be worked.

ACL needs to implement in most closet interface.

  • Ok. I'll try that but let me ask you this: Why can't I used an extended ACL on R3 if I am specifying the destination address of Server 2?
    – Bearing
    Commented Jun 4, 2019 at 4:58
  • It is a prerequisite to implement acl
    – infra
    Commented Jun 4, 2019 at 5:01
  • I just did what you said and Im still able to ping. deny ip host
    – Bearing
    Commented Jun 4, 2019 at 5:04
  • I did this on the router next to server 2 to and implemented in on Fa0/0
    – Bearing
    Commented Jun 4, 2019 at 5:05
  • change to your ACL deny icmp x.x.x. host y.y.y.y echo And make sure that direction is out
    – infra
    Commented Jun 4, 2019 at 5:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.