Solved: command access-list 102 deny icmp any any echo

mahesh18 · ‎10-03-2010

Hi all,

i have applied ---

access-list 102 deny icmp any any echo

access-list 102 permit ip any any

on my wan int of router.now when i ping my network from outside i get result

ping 96.51.x.x

Pinging 96.51.x.x with 32 bytes of data:

Reply from 96.51.x.x: Destination net unreachable.
Reply from 96.51.x.x: Destination net unreachable.
Reply from 96.51.x.x: Destination net unreachable.
Reply from 96.51.x.x: Destination net unreachable.

Ping statistics for 96.51.x.x:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

My question is when we ping some device we send echo request to that device and if we can reach that device then we get echo reply back from that

device to us.

as per my understanding here when i send 4 packets to router ip 96.51.x.x. then router reply me by Reply from 96.51.x.x: Destination net unreachable.

saying that it received my packet but as i have done the config access-list 102 deny icmp any any echo it do not send !!.

i have zero packet loss.

let me know please if i am wrong here or not?

thanks

mahesh

Mahesh Gohil · ‎10-03-2010

Hi mahesh:

also what is difference between receiving reply from a gateway and host?

It means if you are pinging some host behind router and assume that host is not reachable from router then your router will reply

that destination unreachable. here the IP in your ping command and the reply IP will be different.

if both IP is same then this reply is from end host.

hope this is clear to you

Regards

Mahesh

View solution in original post

Mahesh Gohil · ‎10-03-2010

Hi Mahesh,

Yes ou understand correctly. You can expect below reasons under destination unreachable.

0 = net unreachable;
1 = host unreachable;
2 = protocol unreachable;
3 = port unreachable;
4 = fragmentation needed and DF set;
5 = source route failed.

where

Codes 0, 1, 4, and 5 may be received from a gateway.

Codes 2 and 3 may be received from a host.

As you can see in your case it is net unreachable so I request you to verify the ip returned in "Reply from x.x.x.x" with the IP you used in ping command as this output could be replied by your gateway also.

also you can see counters increased in your access-list to verify that your ping packet is hitting your access list or not

Regards

mahesh

mahesh18 · ‎10-03-2010

hi,

when i did ping again here is result

i ping 4 packets

here is result from router

2650xm#sh access-lists 102
Extended IP access list 102
    10 deny icmp any any echo (764 matches)
    20 permit ip any any (74156 matches)
2650xm#sh access-lists 102
Extended IP access list 102
    10 deny icmp any any echo (765 matches)
    20 permit ip any any (74168 matches)
2650xm#sh access-lists 102
Extended IP access list 102
    10 deny icmp any any echo (765 matches)
    20 permit ip any any (74180 matches)
2650xm#sh access-lists 102
Extended IP access list 102
    10 deny icmp any any echo (766 matches)
    20 permit ip any any (74207 matches)
2650xm#sh access-lists 102
Extended IP access list 102
    10 deny icmp any any echo (766 matches)
    20 permit ip any any (74225 matches)
2650xm#sh access-lists 102
Extended IP access list 102
    10 deny icmp any any echo (766 matches)
    20 permit ip any any (74243 matches)
2650xm#sh access-lists 102
Extended IP access list 102
    10 deny icmp any any echo (766 matches)
    20 permit ip any any (74258 matches)

so we can see the packtes are reaching the ACL so it means we are getitng reply from the 2650XM router right?

so here 2650xm as per your note is gateway right ?

also what is difference between receiving reply from a gateway and host?

other thing i want to know is when i config the command access-list 102 deny icmp any any echo reply

then i get the request time out ..... saying send 4 packets received 0 and lost 4.

so this means that my echo packet is reaching the destination router but destination router is blocked for echo reply and it is sending .....

also here when we see the received 0 it means my pc received 0 packet from 96.x.x.x router right?

many thanks

mahesh

danrya · ‎10-03-2010

As the other user said, yes. If you don't want the message sent back, you can use "no ip unreachables" under the interface.

Dan

Mahesh Gohil · ‎10-03-2010

Hi mahesh:

also what is difference between receiving reply from a gateway and host?

It means if you are pinging some host behind router and assume that host is not reachable from router then your router will reply

that destination unreachable. here the IP in your ping command and the reply IP will be different.

if both IP is same then this reply is from end host.

hope this is clear to you

Regards

Mahesh

mahesh18 · ‎10-04-2010

Thanks a lot MAhesh