Users Guide

Access Control Lists 763
Block Incoming Pings and Responses
This example configures an ingress ACL that blocks incoming pings and ping
responses. Since packets generated by the CPU are not affected by ACLs, to
block pinging from the switch we add a rule to block the ping responses on
ingress.
console#config
console(config)#ip access-list no-ping
console(config-ip-acl)#deny icmp any any icmp-message echo
console(config-ip-acl)#deny icmp any any icmp-message echo-reply
console(config-ip-acl)#2147483647 permit every
console(config-ip-acl)#exit
console(config)#interface gi1/0/1
console(config-if-gi1/0/1)#ip access-group no-ping in
console(config-if-gi1/0/1)#exit
Block RFC 1918 Addresses
This ingress ACL may be useful on connections to ISPs to block traffic from
non-routable addresses.
console#config
console(config)#ip access-list no-private-internet
console(config-ip-acl)#deny ip 10.0.0.0 0.255.255.255 any
console(config-ip-acl)#deny ip 192.168.0.0 0.0.255.255 any
console(config-ip-acl)#deny ip 172.16.0.0 0.15.255.255 any
console(config-ip-acl)#2147483647 permit every
console(config-ip-acl)#exit
console(config)#interface port-channel 1
console(config-if-Po1)#ip access-group no-private-internet in
console(config-if-Po1)#exit