1

I created this network to do some general practice. Every host on the network can ping every other host. The routers are just using a basic RIPv2 configuration. All of the interfaces can ping all the other interfaces.

I created a basic ACL on Router 3 on the right. As you can see by my picture, the ACL is configured for blocking both IP and ICMP packets destined for 10.10.2.2. I place this ACL on FA1/0 out of Router 3 and it is still not filtering out the packets when I ping.

Any thoughts as to why packets destined for this host are still getting through when the ACL is clearly configured to filter these packets?

Config:

Router(config)#ip access-list extended Divide

Router(config-ext-nacl)#deny ip any host 10.10.2.2

Router(config-ext-nacl)#deny icmp an host 10.10.2.2 

Router(config-ext-nacl)#permit ip any any

Router(config-ext-nacl)#exit

Router(config)#interface fastEthernet 1/0

Router(config-if)#ip access-group Divide out

Router(config-if)#exit

enter image description here

5
  • Please add your configurations to question
    – infra
    Jun 4 '19 at 4:33
  • @infra for every router and host ?
    – Bearing
    Jun 4 '19 at 4:37
  • I can't see, your configurations on interface.
    – infra
    Jun 4 '19 at 4:39
  • No R3 is enough
    – infra
    Jun 4 '19 at 4:39
  • @infra Done. Sorry about that.
    – Bearing
    Jun 4 '19 at 4:47
0

It is not possible in your situation, because You are going to block IP address which is not connected in interface. If you apply this configuration on Router which is having 10.10.2.1 (Router which next to 10.10.2.2) will be worked.

ACL needs to implement in most closet interface.

8
  • Ok. I'll try that but let me ask you this: Why can't I used an extended ACL on R3 if I am specifying the destination address of Server 2?
    – Bearing
    Jun 4 '19 at 4:58
  • It is a prerequisite to implement acl
    – infra
    Jun 4 '19 at 5:01
  • I just did what you said and Im still able to ping. deny ip 172.168.1.0 0.0.0.255 host 10.10.2.2
    – Bearing
    Jun 4 '19 at 5:04
  • I did this on the router next to server 2 to and implemented in on Fa0/0
    – Bearing
    Jun 4 '19 at 5:05
  • change to your ACL deny icmp x.x.x. host y.y.y.y echo And make sure that direction is out
    – infra
    Jun 4 '19 at 5:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.