layer 2 Switch ACL or Router ACL

[will75136]

Hi experts, what is the best practice to perform above requirement by using ACL?

I was thinking about using Routers but it won`t drop the ping in same network.

Also, somehow my switch (2960) doesn`t support access-group mode. 

Could you give me some advises?

Thanks a lot

Will

[Martin L]

L2 switch does not support ACLs; only Routers and L3 switches. L3 switch in PT may not support ACL as it is just simulator.
what is your ACL and where did u place it?

[will75136]

I placed my ACL on R5 and R6.
Maybe R1 and R2 could be an alternative options too?

[luis_cordova]

Hi @will75136 

When the request includes source, destination, and a protocol, an extended ACL should be used.
It is always recommended to configure and apply this type of ACL as close to the origin as possible.

In your case, it would be advisable to create and apply the ACL on the R5 and R6 routers.

Regards

[will75136]

Thanks, sir.

But what about the end device in same network?
How do we avoid ICMP traffic in same network?

[luis_cordova · Accepted solution]

Hi @will75136 

Pinging within the same network cannot be filtered with the methods proposed in your exercise.
However, there is no indication that pinging the other host should be denied.

The only ping denial must be between host 192.168.3.2 and host 192.168.1.2

I also remind you that at the end of all the lines of every ACL there is an implicit denial.
Therefore, to avoid that all other connectivity is denied, you must enter the permit ip any any line at the end of your ACL

Regards