ACL extended not working

[mangsto32]

We are experiencing an issue where cisco router is pinging some servers with his wan ip.

we didn't find the reason so we tried to block the ping,
Despite applying ACL, I still see logs of the ping in the firewall, it's really weird because when I try to ping the servers with the wan IP I can't:

ROUTER#ping 172.24.133.124
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.24.133.124, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
ROUTER#ping 172.24.133.124 so
ROUTER#ping 172.24.133.124 source 198.18.100.9
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.24.133.124, timeout is 2 seconds:
Packet sent with a source address of 198.18.100.9
.....
Success rate is 0 percent (0/5)

cisco config:

ip access-list extended Block-Ping
10 deny icmp host 198.18.100.9 any echo
20 deny icmp host 198.18.100.9 any echo-replySwitching
30 permit ip any any

!

interface GigabitEthernet0/0/1.60
description p2p_to_customer
encapsulation dot1Q 60
ip address 172.24.60.249 255.255.255.0
ip access-group Block-Ping out

[Karan Belani]

As per the network topology, 
The router's gi0/0/1.60 ip address is 172.16.1.1
And in your ACL configuration, you have created the ACE 30 permit ip any any that's why you can ping.
What is your WAN IP? 172.16.1.1 or 172.24.60.249

[mangsto32]

the wan ip is: 198.18.100.9
as you can see it seems like the acl is working because when I try to ping from the router with this source no ping:
ROUTER#ping 172.24.133.124 source 198.18.100.9
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.24.133.124, timeout is 2 seconds:
Packet sent with a source address of 198.18.100.9
.....
Success rate is 0 percent (0/5)

[mangsto32]

the toplogy was wrong, I just updated the photo

[Karan Belani]

Hello, 
So do you want to block the ping to servers from WAN IP or allow the ping?

[mangsto32]

Hi 
I want to block and it seems like it block, but when I open my firewall I still see the icmp

[Karan Belani]

Hello, 
Yes got it, in firewall check the source IP of the ping, 
Is there any destination NAT configured on your router? As the public IP won't get translated to Private IP and get routed to the servers unless NAT is configured.

[mangsto32]

There is no NAT on the router, I have a static route to the servers.

in the firewall, I see the source IP that I blocked 198.18.100.9.

How can I add log to the access list? when I do show access-list I don't see matches on the block statement.

[MHM Cisco World]

Can you add log to ACL you apply and see if it block traffic or not

MHM

[etienne-buxin]

An ACL never applies to traffic generated by the router itself

https://www.ciscopress.com/articles/article.asp?p=174313&seqNum=4

"...ACLs never apply to traffic generated by the router"

[mangsto32]

Thanks

I will try to use CoPP 
maybe this will work.

[ianbirchall]

Just wanting to check, you say you see the pings in the firewall. 
Are they they pings with source IP 198.18.100.9? 
And are you able to see the hit count on your Block-Ping rule? 
Also just to confirm that the Block-Ping rule is named and referenced correctly? not "BLOCK-PING" all caps for example?

[mangsto32]

Are they they pings with source IP 198.18.100.9?  YES
And are you able to see the hit count on your Block-Ping rule? no hit count but when I try to ping with the source I can't:
ROUTER#ping 172.24.133.124 source 198.18.100.9
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.24.133.124, timeout is 2 seconds:
Packet sent with a source address of 198.18.100.9
.....
Success rate is 0 percent (0/5)

Also just to confirm that the Block-Ping rule is named and referenced correctly? not "BLOCK-PING" all caps for example? YES

[MHM Cisco World]

I run lab ACL not work for me I will try CoPP and share code here 

MHM

[mangsto32]

YES 
but I am not familiar with that , do I need to see a log in the CLI?