02-19-2015 09:54 AM - last edited on 03-25-2019 05:55 PM by ciscomoderator
when i
no access-list 100 permit ip any any
in inside, inside can not ping outside
then
i no access-list 100 extended permit icmp any any echo-reply log
inside can ping outside due to access-list 100 permit ip any any
now, below code, can make inside can ping outside and outside can not ping inside, it is correct.
is "permit icmp any any echo-reply log" mainly used for outside in direction, not inside in direction in real practice?
but, i do not understand that
why "permit icmp any any echo-reply" in inside in direction is useless ?
why must need "permit ip any any" in inside in direction in order to ping outside?
(Essential, with permit ip inside can ping outside)
conf t
no access-list 100 extended permit icmp any any echo-reply log
access-list 100 extended permit tcp any any log
access-list 100 permit ip any any
access-group 100 in interface inside
end
(Essential, without permit ip, outside can not ping to inside)
conf t
access-list 200 extended permit icmp any any echo-reply log
access-list 200 extended permit tcp any any log
access-group 200 in interface outside
end
Solved! Go to Solution.
02-19-2015 11:02 AM
why "permit icmp any any echo-reply" in inside in direction is useless ?
why must need "permit ip any any" in inside in direction in order to ping outside?
It all depends on the direction of the ping and from where it was initiated.
The following assumes your acls are applied inbound on the interfaces and you do not have ICMP inspection enabled.
If you have an acl applied to the inside interface (which you don't necessarily need by the way) and the ping was started from the outside then you would need an echo-reply entry in your inside acl assuming you did not have a permit ip any any.
You don't need a permit ip any any to start the ping from inside but you would need an echo entry if you had an acl applied to inside interface.
Note that is echo not echo-reply.
You have to think of it in terms of the direction of the packet as to what you need to match.
If you want to be able to start the ping from both sides without using permit ip any any in either of your acls then you need an echo and an echo-reply entry in each acl.
Jon
02-19-2015 11:02 AM
why "permit icmp any any echo-reply" in inside in direction is useless ?
why must need "permit ip any any" in inside in direction in order to ping outside?
It all depends on the direction of the ping and from where it was initiated.
The following assumes your acls are applied inbound on the interfaces and you do not have ICMP inspection enabled.
If you have an acl applied to the inside interface (which you don't necessarily need by the way) and the ping was started from the outside then you would need an echo-reply entry in your inside acl assuming you did not have a permit ip any any.
You don't need a permit ip any any to start the ping from inside but you would need an echo entry if you had an acl applied to inside interface.
Note that is echo not echo-reply.
You have to think of it in terms of the direction of the packet as to what you need to match.
If you want to be able to start the ping from both sides without using permit ip any any in either of your acls then you need an echo and an echo-reply entry in each acl.
Jon
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide