deny icmp on adsl interface

[rpalacio]

hi,

how can i deny icmp on my adsl interface?

thanks a lot.

[Richard Burts]

First let me say that denying ICMP is pretty extreme and may have some detrimental effect on your network. Things like ICMP Fragmentation Required but DF Set, which is necessary for Path MTU Discovery to work, or ICMP TTL exceeded, ICMP Network Unreachable, ICMP Port unreachable, and many other ICMP messages are good. Why would you want to deny them?

But your question was how to deny them and I will give an answer. Create an extended access list which at a minimum includes these lines:

deny icmp any any

permite ip any any

and apply that access list to the interface with the access-group command.

HTH

Rick

[rpalacio]

i did that but it did not work. pls see the below command and tell me where did i go wrong

access-list 110 deny icmp any any

access-list 110 permit icmp any any

interface atm 0/0/0

ip access-group 110 in

[ovieira]

Hi!

Is your ADSL configuration on the physical ATM? I think you must also have a Dialer Profile created on wich you must apply tha 110 ACL.

Regards.

[rpalacio]

hi

i just did that on the dialer and it works

thanks a lot