Hi,
I have following design, please see attached diagram.
I applied access-list in R1 interface facing GGSN. I want to block icmp and ip between GGSN pulbic IP pool and the private IP in the internal network..between R1 & R2.
But i got problem when trace route from client (ip pool), the 192.168.196.65 gateway is always show up in trace route.
I want to hide the private from the client user.
How to block icmp echo reply from this 192.168.196.65 interface ?
interface Vlan1619
description Gi-diginet-A
ip vrf forwarding V502:Gi-diginet
ip address 192.168.196.65 255.255.255.248
ip access-group block-apn2private_hwdiginet in
ip access-group block-private2apn_hwdiginet out
no ip redirects
no ip unreachables
no ip proxy-arp
h ip access-lists
Extended IP access list block-apn2private_hwdiginet
10 deny ip 115.164.0.0 0.0.255.255 192.168.0.0 0.0.255.255 (6 estimate matches)
20 deny ip 115.164.0.0 0.0.255.255 172.16.0.0 0.0.31.255
30 deny ip 115.164.0.0 0.0.255.255 10.0.0.0 0.255.255.255 (23 estimate matches)
40 deny icmp 115.164.0.0 0.0.255.255 192.168.0.0 0.0.255.255
50 deny icmp 115.164.0.0 0.0.255.255 172.16.0.0 0.0.31.255
60 deny icmp 115.164.0.0 0.0.255.255 10.0.0.0 0.255.255.255
70 permit ip any any (23299 estimate matches)
Extended IP access list block-private2apn_hwdiginet
10 deny ip 192.168.0.0 0.0.255.255 115.164.0.0 0.0.255.255
20 deny ip 172.16.0.0 0.0.31.255 115.164.0.0 0.0.255.255
30 deny ip 10.0.0.0 0.255.255.255 115.164.0.0 0.0.255.255
40 deny icmp 192.168.0.0 0.0.255.255 115.164.0.0 0.0.255.255
50 deny icmp 172.16.0.0 0.0.31.255 115.164.0.0 0.0.255.255
60 deny icmp 10.0.0.0 0.255.255.255 115.164.0.0 0.0.255.255
70 permit ip any any (64114 estimate matches)
