I was configuring deny icmp any any traffic when I realized it was not in the config.

I verified it with do sh run | i deny icmp command as follows:

R1#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.

R1(config)#ip access-list extended 100 
R1(config-ext-nacl)#deny icmp any any 

For unknown reason, there are 3 spaces between deny and icmp and caused do sh run | i deny icmp command to fail.

R1(config)#do sh run | i deny icmp

It turns out the config is actually there with 3 spaces between deny and icmp.

R1(config)#do sh run | i deny
access-list 100 deny   icmp any any

What was the reason for this behavior?

Is this normal?

  • I feel I should point out, blocking all ICMP will subtly break IPv4. I've seen firewall admins do this and then they're stumped when oddities start surfacing.
    – Ricky
    Commented Oct 9, 2020 at 21:20

1 Answer 1


Yes it's normal. It's just a "quirk" of how the configuration is formatted for display.

  • 1
    show access-lists doesn't exhibit this oddity.
    – Ricky
    Commented Oct 9, 2020 at 21:29
  • 1
    Looking at the actual code (binary), for some odd reason it's "permit[space]" and "deny[space][space][space]" when the configuration is generated. They don't make any attempt to align the output anywhere else, 'tho. (It would be an interesting bit of trivia for someone in Cisco to search the src repo to see who originally committed that decades ago.)
    – Ricky
    Commented Oct 9, 2020 at 22:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.