From: Joe Palomo (palomoj@sbcglobal.net)
Date: Sat Sep 16 2006 - 15:30:46 ART
If you apply the ACL to the VLAN interface then you need to apply the
ACL for egress (out) traffic to the server. Ingress (in) would deny icmp
from server segment outbound. HTH.
ccie16430 (Security)
2nd CCIE wrote:
>Folks ;
> i have a trouble trying to do simple configuration on the 3550 .
> i have server connected to 3550 on port f0/11 .
>
> all i want to do is to deny the icmp to this server and allow everything else .
> although it looks something easy ..it does not work with me
>
> here is my configuration
>
> !
>interface FastEthernet0/11
> switchport access vlan 16
> switchport mode dynamic desirable
> ip access-group 101 in
>!
> !
>access-list 101 deny icmp any host 10.10.16.100
>access-list 101 permit ip any any
>!
>
> with this configuration ..i still can ping the server from anywhere ...i tried to apply the ACL on the interface vlan 16 ..nothing changed .
>
> if i remove the second entry of the ACL (basically deny everything ) ..it works
>
> but i need to the communication to the server ..only the ping i want to disable ...
>
> what am i missing here ?
>
>
> thanks
>
>
>
>---------------------------------
>How low will we go? Check out Yahoo! Messengers low PC-to-Phone call rates.
This archive was generated by hypermail 2.1.4 : Sun Oct 01 2006 - 16:55:40 ART