|
Question : how to configure an access-list in cisco router?
|
|
I want to define an access list for my cisco 2600 router .how can i set access list when anybody wants to ping me get timed out but i can ping out anywhere.i set some copmmand but when anybody ping me received net unreachable i don't like this command i'd like to change this message to timed out. guide me what commands or message code i have to use.
|
Answer : how to configure an access-list in cisco router?
|
|
In your router, when you type "ip ?" is "inspect" one of the options? If so, your image has the IOS firewall. If it's not listed, it doesn't.
To obtain a different image, you need a SmartNet contract for your router. You can buy one from a Cisco reseller like CDW and many others.
Otherwise, try the following access list (without CBAC):
ip access-list extended ACL_OUTSIDE permit icmp any any packet-too-big permit icmp any any echo-reply permit icmp any any time-exceeded permit icmp any any traceroute permit icmp any any unreachable deny icmp any any permit ip any any
Finally apply the access list to the outside interface (in interface command mode): ip access-group ACL_OUTSIDE in
This will allow only the listed ICMP packets but deny all others including echo. It will then allow everything else.
|
|
|