01-08-2009 12:26 AM - edited 03-06-2019 03:18 AM
Why do I need below on the ACL if implicit deny i.e. 'deny ip any any' exists.
deny tcp any any fragments
deny udp any any fragments
deny icmp any any fragments
deny ip any any fragments
Solved! Go to Solution.
01-08-2009 01:24 AM
Hello Cisco_Lite,
two possible reasons:
A) you want to be sure the router is never involved with fragmented traffic it will drop it if it sees the more fragment set in ip header (this requires these lines to be before permitted traffic lines)
b) the reason for multiple lines is to be able to trace fragments received and dropped per protocol type
( deny ip any any fragments would be enough to drop all fragments but no info if the fragments are UDP rather then TCP can be seen)
when you do sh ip access-list xxx you get counters for each line in the ACL
Hope to help
Giuseppe
01-08-2009 01:24 AM
Hello Cisco_Lite,
two possible reasons:
A) you want to be sure the router is never involved with fragmented traffic it will drop it if it sees the more fragment set in ip header (this requires these lines to be before permitted traffic lines)
b) the reason for multiple lines is to be able to trace fragments received and dropped per protocol type
( deny ip any any fragments would be enough to drop all fragments but no info if the fragments are UDP rather then TCP can be seen)
when you do sh ip access-list xxx you get counters for each line in the ACL
Hope to help
Giuseppe
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide