04-08-2009 07:37 PM - edited 03-06-2019 05:05 AM
Hi,
I have following design, please see attached diagram.
I applied access-list in R1 interface facing GGSN. I want to block icmp and ip between GGSN pulbic IP pool and the private IP in the internal network..between R1 & R2.
But i got problem when trace route from client (ip pool), the 192.168.196.65 gateway is always show up in trace route.
I want to hide the private from the client user.
How to block icmp echo reply from this 192.168.196.65 interface ?
interface Vlan1619
description Gi-diginet-A
ip vrf forwarding V502:Gi-diginet
ip address 192.168.196.65 255.255.255.248
ip access-group block-apn2private_hwdiginet in
ip access-group block-private2apn_hwdiginet out
no ip redirects
no ip unreachables
no ip proxy-arp
h ip access-lists
Extended IP access list block-apn2private_hwdiginet
10 deny ip 115.164.0.0 0.0.255.255 192.168.0.0 0.0.255.255 (6 estimate matches)
20 deny ip 115.164.0.0 0.0.255.255 172.16.0.0 0.0.31.255
30 deny ip 115.164.0.0 0.0.255.255 10.0.0.0 0.255.255.255 (23 estimate matches)
40 deny icmp 115.164.0.0 0.0.255.255 192.168.0.0 0.0.255.255
50 deny icmp 115.164.0.0 0.0.255.255 172.16.0.0 0.0.31.255
60 deny icmp 115.164.0.0 0.0.255.255 10.0.0.0 0.255.255.255
70 permit ip any any (23299 estimate matches)
Extended IP access list block-private2apn_hwdiginet
10 deny ip 192.168.0.0 0.0.255.255 115.164.0.0 0.0.255.255
20 deny ip 172.16.0.0 0.0.31.255 115.164.0.0 0.0.255.255
30 deny ip 10.0.0.0 0.255.255.255 115.164.0.0 0.0.255.255
40 deny icmp 192.168.0.0 0.0.255.255 115.164.0.0 0.0.255.255
50 deny icmp 172.16.0.0 0.0.31.255 115.164.0.0 0.0.255.255
60 deny icmp 10.0.0.0 0.255.255.255 115.164.0.0 0.0.255.255
70 permit ip any any (64114 estimate matches)
Solved! Go to Solution.
04-09-2009 08:30 AM
Not sure what platform you are using but it should be something like this.
access-list 100 permit icmp any [client-IP-range] echo-r
route-map LOCAL permit 10
match ip address 100
set interface null0
ip local policy route-map LOCAL
04-09-2009 05:17 AM
If client does a trace route to a public IP, your inbound ACL won't block it. If I remember correctly, outbound ACL won't apply to the packet generated locally.
You can use a local policy map to drop the icmp reply to the client.
04-09-2009 08:14 AM
Hi ,
thanks for reply.
How can I use local policy in this case ?
Any sample config.
thanks
04-09-2009 08:30 AM
Not sure what platform you are using but it should be something like this.
access-list 100 permit icmp any [client-IP-range] echo-r
route-map LOCAL permit 10
match ip address 100
set interface null0
ip local policy route-map LOCAL
03-16-2018 10:47 PM
Hai Team,
Is it possible for stop the ICMP echo packet flow by core switch/ router to all connected network device?
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: