need help with extended ACLs

[dolanduck.]

hello i need help with extended acls. here is the thing i want to make pc a and b be able to ping outside and receive replies. but at the the same time i want to deny icmp traffic from coming into R1 and R2. what about implicit deny will that affect other ip stuff ?

here is the access list i made.

i want to put them on both R1 and R2 on g0/1 in

access-list 101 permit icmp 38.159.118.104 0.0.0.3 any echo-reply
access-list 101 permit icmp 38.159.118.108 0.0.0.3 any echo-reply
access-list 101 deny icmp any any

[Deepak Kumar]

Hi,

Your Acl Configuration can be like:

IP access-list extended 100

5 access-list 100 permit icmp any any echo-reply
10 access-list 100 deny icmp any any
50 access-list 100 permit ip any any

And apply the same ACL on WAN interface in Inside direction:

interface Gig1/0
ip access-group 100 in

Regards,

Deepak Kumar

[dolanduck.]

why do i need access-list 100 permit ip any any

is it because of the implicit acl ?

and is it possible to  get a ACL alert every-time a ACL is met.

[Deepak Kumar · Accepted solution]

Hi,

why do i need access-list 100 permit ip any any
is it because of the implicit acl ?

Yes, By default, An ACL is having Deny IP any any command which is hidden. So you have to permit IP any any otherwise all other traffic will be blocked by the Hidden line of ACL( that's called implicit ACL) 

and is it possible to  get a ACL alert every-time a ACL is met.

Yes, But in certain cases, It is possible as you will get details in Logs/Syslog/trap etc. You can add "LOG" keyboard at the end of ACL line as below:

5 access-list 100 permit icmp any any echo-reply log
10 access-list 100 deny icmp any any log
50 access-list 100 permit ip any any

Note: Don't try to add "log" keyboard on  "access-list 100 permit ip any any" because there will hit more traffic so CPU, Memory resources will go high and you will face many issues. 

Regards,

Deepak Kumar

[dolanduck.]

hey i need your help again i cant ping router 2 or 1 ports. for some reason deny icmp any any keeps me from pinging.

[Georg Pauwen]

Hello,

if you just want the hosts to send and receice ICMP, deny all other ICMP traffic, but still want to allow all other traffic, the access list should look like this:

access-list 101 permit icmp 38.159.118.104 0.0.0.3 any echo
access-list 101 permit icmp 38.159.118.104 0.0.0.3 any echo-reply
access-list 101 permit icmp 38.159.118.108 0.0.0.3 any echo
access-list 101 permit icmp 38.159.118.108 0.0.0.3 any echo-reply
access-list 101 deny icmp any any
access-list 101 permit ip any any