?
Solved

Cisco ACL query

Posted on 2011-10-10
5
Medium Priority
?
477 Views
Last Modified: 2012-06-27
I'm sure this is something very basic, but it has me a bit stumped
This is the config on my SGE2010 switch in Layer 3 mode :-
 
interface port-channel 1
description "VLAN1"
exit
vlan database
vlan 2
exit
interface range ethernet 1/g(13-18,37-42)
switchport access vlan 2
exit
interface vlan 2
name "VLAN"
exit
interface range ethernet 1/g(1,25)
channel-group 1 mode on
exit
interface vlan 1
ip address 192.168.0.26 255.255.255.0
exit
interface vlan 2
ip address 192.168.20.26 255.255.255.0
exit
ip access-list "Test 4"
permit-icmp any any echo-reply any
permit-tcp 192.168.20.50 0.0.0.0 443 192.168.0.6 0.0.0.0 443
exit
interface ethernet 1/g41
service-acl input "Test 4"
exit

The first rule in ACL 'Test 4' was "permit-icmp any any echo-reply any". Once this was bound to port 41, 192.168.0.6 and 192.168.20.50 could ping each other. Then I added the "permit-tcp 192.168.20.50 0.0.0.0 443 192.168.0.6 0.0.0.0 443" rule, . After that rule was added, 192.168.0.6 can ping 192.168.20.50, but not the other way around. Can someone explain to me why that is, and what do I need to change so that I can still ping in both directions.

Just in case it's relevent, I got the 'show running' above from the switch, but the rules were added using the switch's 'Security Suite' in the web console.
0
Comment
Question by:Michael986
  • 2
  • 2
5 Comments
 
LVL 15

Expert Comment

by:greg ward
ID: 36948044
ip access-list "Test 4"
permit-icmp any any echo-reply any
permit-icmp any any echo

Greg
0
 
LVL 17

Expert Comment

by:Marius Gunnerud
ID: 36948317
The echo-reply only allows ICMP packets that are returning from a ping generated on the router/switch. Any ICMP packet originating from another device headed for the router/switch will be dropped. The way around this is as deepdraw has mentioned by adding the echo statement.
0
 

Author Comment

by:Michael986
ID: 36952933
Thanks - I have added an 'Echo-request - Permit' rule (as it has to be done through the security suite, and 'echo' is not an option) - now works OK.

However, I still don't understand the original issue :-
If I have just the one rule - ie permit-icmp any any echo-reply any - then pings work both ways. It's only when adding another, seemingly unrelated, rule that the pings stop in one direction. Why would the second rule cause the difference in behaviour?
0
 
LVL 15

Accepted Solution

by:
greg ward earned 1000 total points
ID: 36953748
As far as i can see it should only allow ping one way.
the second rule is for tcp 443 and should not allow icmp.
You could add at the end
deny icmp any any log and see if it catches any thing

Greg
0
 

Author Closing Comment

by:Michael986
ID: 36965777
It seems that this device uses a 'lite' version of IOS, so I might just have to accept that there's a few anomolies like this.
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This tutorial will go through the steps required to write a script that will back up the configuration settings of a HP-ProCurve switch. You will need to get the following things to follow this tutorial: Telnet Scripting Tool e.g. TST10.exe …
Problem Description:   Couple of months ago we upgraded the ADSL line at our branch office from Home to Business line. The purpose of transforming the service to have static public IP’s. We were in need for public IP’s to publish our web resour…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

809 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question