cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
569
Views
5
Helpful
1
Replies

Extended ACL for ICMP blocking DHCP requests

bstevenson11
Level 1
Level 1

Greetings,

I setup the network in the image attached with Netsim 11. I am having issues with Extended access lists. At the moment I have the current config on Router4. For some reason once I enabled that on int fa0/1.100 as an inbound access list dhcp requests are not being received on the pc's connected to Switch2. If I turn off the access list they function fine and receive DHCP info. Can you tell me what I am doing wrong? My goal was to block pings by denying ICMP packets heading to the 10.0.0.64 0.0.0.63 network from the source 192.168.0.34. That worked great, but then DHCP stopped working. 

hostname Router4
!
!
!
!
ip subnet-zero
!
ip cef
no ip domain-lookup
!
ip domain-name boson.com
!
!
!
!
!
!
!
!
interface Ethernet0/0
ip address 192.168.0.2 255.255.255.240
no ip directed-broadcast
!
interface Ethernet0/1
no ip address
no ip directed-broadcast
!
interface Ethernet0/1.100
encapsulation dot1q 100
ip address 192.168.0.33 255.255.255.240
ip helper-address 192.168.0.1
ip access-group 101 in
!
!
interface Ethernet0/2
no ip address
no ip directed-broadcast
shutdown
!
interface Ethernet0/3
no ip address
no ip directed-broadcast
shutdown
!
!
router eigrp router4
!
!
!
ip classless
no ip http server
!
ip route 10.0.0.64 255.255.255.192 Ethernet0/0
ip route 10.0.0.0 255.255.255.192 Ethernet0/0
access-list 101 deny icmp host 192.168.0.34 10.0.0.64 0.0.0.63
access-list 101 permit icmp any any
access-list 101 permit udp any any
!
!
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
login
!
!
no scheduler allocate
end

1 Reply 1

Mark Malone
VIP Alumni
VIP Alumni

Theres an implicit deny at then end of every acl by default , you should have below too

access-list 101 permit ip any any