Does permit ip any any also include GRE and ESP traffic?

[gautamzone]

Dear friends,

When i say on the ASA, access-list xyz extended permit ip any any, does it also include GRE and ESP traffic                   

Thanks a lot

Gautam

[Jon Marshall · Accepted solution]

gautamzone wrote:
Dear friends,
When i say on the ASA, access-list xyz extended permit ip any any, does it also include GRE and ESP traffic                    
Thanks a lot
Gautam

Gautam

No it doesn't. IP includes TCP/UDP/ICMP but GRE and ESP have their own protocol numbers at the IP layer.

Jon

[Kureli Sankar · Accepted solution]

GRE is ip protocol 47 and ESP is ip protocol 50 so, you acl should be

access-list blah permit 47 any any

access-l blah permit 50 any any

access-list blah permit ip any any

-KS

[gautamzone]

Thanks a lot Jon and kushankar for the help.

[Richard Burts]

I just became aware of this old thread and I find it troubling. Especially this statement

No it doesn't. IP includes TCP/UDP/ICMP but GRE and ESP have their own protocol numbers at the IP layer.

If TCP has its own protocol number (which is 6)

and if UDP has its own protocol number (which is 17)

and if ICMP has its own protocol number (which is 1)

then why does GRE (protocol number 47) and ESP (protocol number 50) get treated differently?

All of those packet types are IP and an access list which has permit ip any any would include all of those protocols. The original responses in this thread were not correct and we need to straighten them out.

HTH

Rick

[BaljeetSingh36419]

Good that I scrolled till end .. as got confused with accepted solution . Or maybe difference between theory and practical implementation

[Richard Burts]

I can understand that you would be confused about some aspects of the accepted solutions. I am glad that now you have a better understanding of the issue.  This community is an excellent place to ask questions and to learn about networking. I hope to see you continue to be active in the community.

HTH

Rick