How to Block ICMP Echo Reply from Gateway IP

Answered Question

Hi,


I have following design, please see attached diagram.


I applied access-list in R1 interface facing GGSN. I want to block icmp and ip between GGSN pulbic IP pool and the private IP in the internal network..between R1 & R2.


But i got problem when trace route from client (ip pool), the 192.168.196.65 gateway is always show up in trace route.

I want to hide the private from the client user.

How to block icmp echo reply from this 192.168.196.65 interface ?


interface Vlan1619

description Gi-diginet-A

ip vrf forwarding V502:Gi-diginet

ip address 192.168.196.65 255.255.255.248

ip access-group block-apn2private_hwdiginet in

ip access-group block-private2apn_hwdiginet out

no ip redirects

no ip unreachables

no ip proxy-arp


h ip access-lists

Extended IP access list block-apn2private_hwdiginet

10 deny ip 115.164.0.0 0.0.255.255 192.168.0.0 0.0.255.255 (6 estimate matches)

20 deny ip 115.164.0.0 0.0.255.255 172.16.0.0 0.0.31.255

30 deny ip 115.164.0.0 0.0.255.255 10.0.0.0 0.255.255.255 (23 estimate matches)

40 deny icmp 115.164.0.0 0.0.255.255 192.168.0.0 0.0.255.255

50 deny icmp 115.164.0.0 0.0.255.255 172.16.0.0 0.0.31.255

60 deny icmp 115.164.0.0 0.0.255.255 10.0.0.0 0.255.255.255

70 permit ip any any (23299 estimate matches)


Extended IP access list block-private2apn_hwdiginet

10 deny ip 192.168.0.0 0.0.255.255 115.164.0.0 0.0.255.255

20 deny ip 172.16.0.0 0.0.31.255 115.164.0.0 0.0.255.255

30 deny ip 10.0.0.0 0.255.255.255 115.164.0.0 0.0.255.255

40 deny icmp 192.168.0.0 0.0.255.255 115.164.0.0 0.0.255.255

50 deny icmp 172.16.0.0 0.0.31.255 115.164.0.0 0.0.255.255

60 deny icmp 10.0.0.0 0.255.255.255 115.164.0.0 0.0.255.255

70 permit ip any any (64114 estimate matches)








Correct Answer by Yudong Wu about 8 years 1 month ago

Not sure what platform you are using but it should be something like this.


access-list 100 permit icmp any [client-IP-range] echo-r


route-map LOCAL permit 10

match ip address 100

set interface null0


ip local policy route-map LOCAL


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Yudong Wu Thu, 04/09/2009 - 05:17
User Badges:
  • Gold, 750 points or more

If client does a trace route to a public IP, your inbound ACL won't block it. If I remember correctly, outbound ACL won't apply to the packet generated locally.


You can use a local policy map to drop the icmp reply to the client.

Correct Answer
Yudong Wu Thu, 04/09/2009 - 08:30
User Badges:
  • Gold, 750 points or more

Not sure what platform you are using but it should be something like this.


access-list 100 permit icmp any [client-IP-range] echo-r


route-map LOCAL permit 10

match ip address 100

set interface null0


ip local policy route-map LOCAL


Actions

This Discussion