Default action for access list Deny

[ampowell]

Hello,

Is it possible to change the default action for an access list deny?  Can the ASA be configured to send an icmp unreachable rather than just dropping the packet if an access list denies the request?  I have a situation where I would like to restrict access to a specific server for a select number of users.  The problem is that the restricted workstations attempt to connect to the server at log in.  Since I cannot control the log in script for those users, I was hoping to use the ASA firewall instead.  However, using a deny statement causes the workstation to repeatedly send SYN requests for 60 seconds.   The restricted users experience an unacceptably long delay at log in.  I was hoping to be able to configure the ASA to send an icmp unreachable message for those users and avoid the wait.

Thanks,

Ann

[Julio Carvajal]

Hello,

As the firewall it's supposed to be invisible there is no way the ASA could send this particular messages, sorry to inform you that but you could request this particular feature with your Cisco account Team.

Regards,

Julio