Denying ICMP from one specific host

[dimensijus]

Hi,

The result I am trying to achieve is blocking the ICMP traffic from 192.168.100.101 pc (inside traffic) to 192.168.101.00/24 (outside) trafic.

I've configured an ACL, but for some reason the ICMP still travel through ASA:
access-list outside line 1 extended permit icmp any any
access-list outside line 2 extended deny icmp host 192.168.100.101 192.168.101.0 255.255.255.0 echo
access-list outside line 2 extended deny icmp host 192.168.100.101 192.168.101.0 255.255.255.0 echo-reply
access-list outside line 2 extended deny icmp host 192.168.100.101 192.168.101.0 255.255.255.0 unreachable

access-group outside in interface outside

Any thoughts why ICMP is still traveling from 192.168.100.101 to 192.168.101.100?

Thanks in advance.

[Octavian Szolga]

Hi,

You applied the ACL on the wrong interface. Also, the first line allows all ICMP traffic making the rest of lines useless.

You want to apply the ACL inbound on inside. Based on your description, 192.168.100.101 belongs to inside.

BR,

Octavian

[MHM Cisco World]

access-list outside line 1 extended permit icmp any any

This make all icmp allow

You need to delete this acl line and add it again with line number make it in tail of acl not in top