rip 224.0.0.9 suppression not working

[B@B@r]

hi all i am working on rip

i want to break rip updates by denying 224.0.0.9

which is not working

my configurion

access-list 1 deny 224.0.0.9 0.0.0.0a

access-list 1 permit any 

int fa0/0

ip access-group 1 in 

ip access-group 1 out

but still, have rip route and ip debug rip is showing packet send with multicast address.

why shouldn't it blocked?

thanks

regard

babar

[Georg Pauwen]

Hello,

you need to use an extended IP access list:

access-list 101 deny ip any host 224.0.0.9

access-list 101 permit ip any any

[B@B@r]

Thankyou for your reply,

i tried it but still it is not working .
rip is still learning route from neighbor
i also did clear ip route *
show access-list 101
10 deny ip any host 224.0.0.9 (312 matches)
20 permit ip any any ( 12 matches)

inter fa0/0
ip access-group 101 in

[Yogi-Bear]

That multicast is a destination address and you are using standard access-list which only targrt source IP.

If you're interested there a functionality that achieve your purpose and it's used with the command passive-interface.

[B@B@r]

Dear bobby,
yeah i used standard access-list, but after guidance of first reply i tried for extended access list still it is not working.
i know about passive interface ,it stop sending routing updates i tried it is working perfactly...
But i want to block its multi-cast address using extended control list ...
it is not working

[Yogi-Bear]

Alrigth can you please share the access-list, the port and RIP config ?

[Georg Pauwen]

Did you apply the access list outbound as well ?

access-list 101 deny ip any host 224.0.0.9
access-list 101 permit ip any any
!
inter fa0/0
ip access-group 101 in
ip access-group 101 out

[Yogi-Bear]

That should be it. Well done Georg!

[B@B@r]

Rip routes are still there

if it is not working could i block at udp layer 520....

[Georg Pauwen]

Hello,

what does your topology look like ? Do you have back to back routers with only one connection ?

[Yogi-Bear]

You can't use an ACL to block outgoing RIP messages originated locally. ACL simply doesn't filter locally originated traffic. Thats why there's a "passive-interface" command.

You can however block inbound traffic. Make sure you create the ACL before trying to apply it to the interface otherwise it won't work. So give it a try agagain and recreate it.