Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

How to Block ICMP Echo Reply from Gateway IP

Hi,

I have following design, please see attached diagram.

I applied access-list in R1 interface facing GGSN. I want to block icmp and ip between GGSN pulbic IP pool and the private IP in the internal network..between R1 & R2.

But i got problem when trace route from client (ip pool), the 192.168.196.65 gateway is always show up in trace route.

I want to hide the private from the client user.

How to block icmp echo reply from this 192.168.196.65 interface ?

interface Vlan1619

description Gi-diginet-A

ip vrf forwarding V502:Gi-diginet

ip address 192.168.196.65 255.255.255.248

ip access-group block-apn2private_hwdiginet in

ip access-group block-private2apn_hwdiginet out

no ip redirects

no ip unreachables

no ip proxy-arp

h ip access-lists

Extended IP access list block-apn2private_hwdiginet

10 deny ip 115.164.0.0 0.0.255.255 192.168.0.0 0.0.255.255 (6 estimate matches)

20 deny ip 115.164.0.0 0.0.255.255 172.16.0.0 0.0.31.255

30 deny ip 115.164.0.0 0.0.255.255 10.0.0.0 0.255.255.255 (23 estimate matches)

40 deny icmp 115.164.0.0 0.0.255.255 192.168.0.0 0.0.255.255

50 deny icmp 115.164.0.0 0.0.255.255 172.16.0.0 0.0.31.255

60 deny icmp 115.164.0.0 0.0.255.255 10.0.0.0 0.255.255.255

70 permit ip any any (23299 estimate matches)

Extended IP access list block-private2apn_hwdiginet

10 deny ip 192.168.0.0 0.0.255.255 115.164.0.0 0.0.255.255

20 deny ip 172.16.0.0 0.0.31.255 115.164.0.0 0.0.255.255

30 deny ip 10.0.0.0 0.255.255.255 115.164.0.0 0.0.255.255

40 deny icmp 192.168.0.0 0.0.255.255 115.164.0.0 0.0.255.255

50 deny icmp 172.16.0.0 0.0.31.255 115.164.0.0 0.0.255.255

60 deny icmp 10.0.0.0 0.255.255.255 115.164.0.0 0.0.255.255

70 permit ip any any (64114 estimate matches)

1 ACCEPTED SOLUTION

Accepted Solutions

Re: How to Block ICMP Echo Reply from Gateway IP

Not sure what platform you are using but it should be something like this.

access-list 100 permit icmp any [client-IP-range] echo-r

route-map LOCAL permit 10

match ip address 100

set interface null0

ip local policy route-map LOCAL

3 REPLIES

Re: How to Block ICMP Echo Reply from Gateway IP

If client does a trace route to a public IP, your inbound ACL won't block it. If I remember correctly, outbound ACL won't apply to the packet generated locally.

You can use a local policy map to drop the icmp reply to the client.

New Member

Re: How to Block ICMP Echo Reply from Gateway IP

Hi ,

thanks for reply.

How can I use local policy in this case ?

Any sample config.

thanks

Re: How to Block ICMP Echo Reply from Gateway IP

Not sure what platform you are using but it should be something like this.

access-list 100 permit icmp any [client-IP-range] echo-r

route-map LOCAL permit 10

match ip address 100

set interface null0

ip local policy route-map LOCAL

1797
Views
0
Helpful
3
Replies