Configure ACL ICMP to selected network

[nowak-kacper99]

Hey Im need to help and veryfication to my ACL.  In the picture is my topology and i want to make acl where all pc in vlan100 can ping all pc in vlan220 but the vlan220 cant ping vlan100, im add the vlan220 should can ping vlan120 and 20 networks 192.168.120.0 and 192.168.20.0 

could u veryfitacion my acl on vlan220 and try to help me write the acl for vlan100


ip access-list extended VLAN220_ACL
permit udp any eq bootpc any
permit icmp 192.168.100.0 0.0.0.255 192.168.220.0 0.0.0.255 echo
permit icmp 192.168.220.0 0.0.0.255 192.168.120.0 0.0.0.255 echo
permit icmp 192.168.120.0 0.0.0.255 192.168.220.0 0.0.0.255 echo
permit icmp 192.168.220.0 0.0.0.255 192.168.20.0 0.0.0.255 echo
permit icmp 192.168.20.0 0.0.0.255 192.168.220.0 0.0.0.255 echo
permit tcp any host 10.66.0.2 eq 443
permit tcp any host 10.66.0.4 eq smtp
permit tcp any host 10.66.0.4 eq pop3
permit tcp any host 10.66.0.4 eq 995
permit udp any host 10.66.0.5 eq domain
deny ip any any

[MHM Cisco World]

Where you want to add this ACL can you point that in your topology

MHM

[nowak-kacper99]

Iwant to add it on this two routers ip access-list extended VLAN220_ACL is now on upper router and it shout to stay there

[MHM Cisco World]

Direction of this vlan220 ACL? And in which interface you apply? 

MHM

[nowak-kacper99]

ACL is IN, and its int gig0/0.20

[MHM Cisco World]

Tcp/udp line keep it

For icmp lines all are wrong 

You want vlan100 to talk to vlan220 but vlan220 can not talk to vlan 100 then 

Permit icmp <vlan 220 subnet><vlan100 subnet> echo-reply<<<- only this need

MHM

[nowak-kacper99]

And if i want to vlan220 talk with 120 and 20 i should to write permit valn220 subnet vlan120 subnet do the same to vlan20 and the other way around do for router with vlan20 and 120 yes?

[nowak-kacper99]

I do this, but i can still ping vlan100 from vlan220

ip access-list extended VLAN220_ACL
permit udp any eq bootpc any
permit icmp 192.168.220.0 0.0.0.255 192.168.100.0 0.0.0.255 echo-reply
permit icmp 192.168.220.0 0.0.0.255 192.168.120.0 0.0.0.255 echo
permit icmp 192.168.120.0 0.0.0.255 192.168.220.0 0.0.0.255 echo
permit icmp 192.168.220.0 0.0.0.255 192.168.20.0 0.0.0.255 echo
permit icmp 192.168.20.0 0.0.0.255 192.168.220.0 0.0.0.255 echo
permit tcp any host 10.66.0.2 eq 443
permit tcp any host 10.66.0.4 eq smtp
permit tcp any host 10.66.0.4 eq pop3
permit tcp any host 10.66.0.4 eq 995
permit udp any host 10.66.0.5 eq domain
deny ip any any

[MHM Cisco World]

Wr config and close and open lab and check 

ACL is correct

MHM

[Devaa]

Hope VLAN220_ACL is configured (called) in VLAN 220 in inbound direction. 

If yes, then the below lines in your ACL is not required as the source will always be vlan 220 subnet. 

ip access-list extended VLAN220_ACL
 permit icmp 192.168.100.0 0.0.0.255 192.168.220.0 0.0.0.255 echo
 permit icmp 192.168.120.0 0.0.0.255 192.168.220.0 0.0.0.255 echo
 permit icmp 192.168.20.0 0.0.0.255 192.168.220.0 0.0.0.255 echo

 So, you can remove those lines and add the required lines to allow icmp reply from vlan 220 to vlan 100. 

ip access-list extended VLAN220_ACL
    10 permit udp any eq bootpc any
    20 permit icmp 192.168.100.0 0.0.0.255 192.168.220.0 0.0.0.255 echo   --> Remove and update here
    30 permit icmp 192.168.220.0 0.0.0.255 192.168.120.0 0.0.0.255 echo
    40 permit icmp 192.168.120.0 0.0.0.255 192.168.220.0 0.0.0.255 echo
    50 permit icmp 192.168.220.0 0.0.0.255 192.168.20.0 0.0.0.255 echo
    60 permit icmp 192.168.20.0 0.0.0.255 192.168.220.0 0.0.0.255 echo

conf t
ip access-list extended VLAN220_ACL
 no 20
 20 permit icmp 192.168.220.0 0.0.0.255 192.168.100.0 0.0.0.255 echo-reply
 end

 You can also remove seq no 40 and 60 if not needed. 

With this change, all PCs in vlan100 can ping all pc in vlan220 but the vlan220 can't ping vlan100. Hope this will help. 

[nowak-kacper99]

Okey its worked but ive got one more question,
My IPsec tunel is working but why im not got a access to NAT network.

Im add a packet tracer project