cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1444
Views
25
Helpful
10
Replies

how to solve this acl issue ?

jordan-jj
Level 1
Level 1

I want to block 192.168.3.0 network from reaching network 192.168.2.129  of Router 3

I tried below acl on R3 

access-list 51 deny 192.168.3.0 0.0.0.255

access-list 51 permit any

Interface eth1/1  =ip access-group 51 in

still  192.168.3.0 can reach my network. how to solve issue here  ?

1 Accepted Solution

Accepted Solutions

Hello,

that is the way IOS is designed: an ACL can never block packets generated by the router itself, it can only block packets which transit through the router, not packets generated by the router.

I have uploaded a working pkt (see attachment).

View solution in original post

10 Replies 10

Hello,

try:

access-list 101 deny ip 192.168.3.0 0.0.0.255 192.168.2.0 0.0.0.127
access-list 101 permit ip any any

and apply the access list 'out':

Interface eth1/1 =ip access-group 101 out

If that doesn't work, post the Packet Tracer file (ZIP it first, otherwise you cannot upload it).

Is it possible in a standard ACL,

Hello,

standard ACL should work, try and apply it out:

Interface eth1/1 =ip access-group 51 out

That said, it SHOULD work. Post the zipped .pkt file, there might be something in your configuration that causes problems.

Standard ACL seems working, but i can ping to the gateway  interface of of router R3, 

Hello,

with the standard access list applied out, you can ping from where to where ?

i can ping to the gateway of network 192.168.2.128 in R3 but not to that network. i thought that acl will block everything for that network

Hello,

where are you pinging from ?

Your access list blocks access from 192.168.3.0/24 to 192.168.2.128/25, since it is applied to Ethernet1/1.

Post the .pkt file, that will make it easier to explain.

Hello,

that is the way IOS is designed: an ACL can never block packets generated by the router itself, it can only block packets which transit through the router, not packets generated by the router.

I have uploaded a working pkt (see attachment).

If i want to block reaching to that interface here, Ethernet 1/1 of router R3  can i create another access list for reaching that interface in R3. does that make sense. 

Hello,

to block traffic to Ethernet1/1 on router 3, you would need to configure local policy routing. This would look as following:

ip local policy route-map LOCAL_TRAFFIC_TO_NULL
!
access-list 101 permit ip 192.168.2.128 0.0.0.127 192.168.3.0 0.0.0.255
!
route-map LOCAL_TRAFFIC_TO_NULL permit 10
 match ip address 101
 set interface Null0

However, Packet Tracer does not support the commands required, if you know and use GNS3, you can try and test it.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Review Cisco Networking products for a $25 gift card