2

I was configuring deny icmp any any traffic when I realized it was not in the config.

I verified it with do sh run | i deny icmp command as follows:

R1#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
R1(config)#

R1(config)#ip access-list extended 100 
R1(config-ext-nacl)#deny icmp any any 
R1(config-ext-nacl)#exit 
R1(config)#

For unknown reason, there are 3 spaces between deny and icmp and caused do sh run | i deny icmp command to fail.

R1(config)#do sh run | i deny icmp
R1(config)#

It turns out the config is actually there with 3 spaces between deny and icmp.

R1(config)#do sh run | i deny
access-list 100 deny   icmp any any
R1(config)#

What was the reason for this behavior?

Is this normal?

Improve this question
1
  • I feel I should point out, blocking all ICMP will subtly break IPv4. I've seen firewall admins do this and then they're stumped when oddities start surfacing.
    – Ricky
    Oct 9, 2020 at 21:20

1 Answer 1

Reset to default
5

Yes it's normal. It's just a "quirk" of how the configuration is formatted for display.

Improve this answer
2
  • 1
    show access-lists doesn't exhibit this oddity.
    – Ricky
    Oct 9, 2020 at 21:29
  • 1
    Looking at the actual code (binary), for some odd reason it's "permit[space]" and "deny[space][space][space]" when the configuration is generated. They don't make any attempt to align the output anywhere else, 'tho. (It would be an interesting bit of trivia for someone in Cisco to search the src repo to see who originally committed that decades ago.)
    – Ricky
    Oct 9, 2020 at 22:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.