why permit icmp any any echo-reply apply to inside in direction is useless

martlee2 — Tue, 26 Mar 2019 00:55:00 GMT

when i

no access-list 100 permit ip any any

in inside, inside can not ping outside

then

i no access-list 100 extended permit icmp any any echo-reply log

inside can ping outside due to access-list 100 permit ip any any

now, below code, can make inside can ping outside and outside can not ping inside, it is correct.

is "permit icmp any any echo-reply log" mainly used for outside in direction, not inside in direction in real practice?

but, i do not understand that

why "permit icmp any any echo-reply" in inside in direction is useless ?

why must need "permit ip any any" in inside in direction in order to ping outside?

(Essential, with permit ip inside can ping outside)
conf t
no access-list 100 extended permit icmp any any echo-reply log
access-list 100 extended permit tcp any any log
access-list 100 permit ip any any
access-group 100 in interface inside
end

(Essential, without permit ip, outside can not ping to inside)
conf t
access-list 200 extended permit icmp any any echo-reply log
access-list 200 extended permit tcp any any log
access-group 200 in interface outside
end

why "permit icmp any any echo

Jon Marshall — Thu, 19 Feb 2015 19:02:38 GMT

why "permit icmp any any echo-reply" in inside in direction is useless ?

why must need "permit ip any any" in inside in direction in order to ping outside?

It all depends on the direction of the ping and from where it was initiated.

The following assumes your acls are applied inbound on the interfaces and you do not have ICMP inspection enabled.

If you have an acl applied to the inside interface (which you don't necessarily need by the way) and the ping was started from the outside then you would need an echo-reply entry in your inside acl assuming you did not have a permit ip any any.

You don't need a permit ip any any to start the ping from inside but you would need an echo entry if you had an acl applied to inside interface.

Note that is echo not echo-reply.

You have to think of it in terms of the direction of the packet as to what you need to match.

If you want to be able to start the ping from both sides without using permit ip any any in either of your acls then you need an echo and an echo-reply entry in each acl.

Jon

topic why "permit icmp any any echo in Network Security

why permit icmp any any echo-reply apply to inside in direction is useless

why "permit icmp any any echo