Block ICMP ping from a PC to a PC

aclgns3ping

I have a topology like this

PC1 ------Switch
PC2 ------Layer --------- Router
PC3-------two

PC1 192.168.1.34 VLAN 10.

PC2 192.168.1.50 VLAN 20. 
PC3 192.168.1.51 VLAN 20.

I configured a router on a stick to ping between any PC. Then, I want PC2 can ping PC1 and PC3 cannot ping PC1. I use an access list to the switch:

conf t
access-list 101 permit ip host 192.168.1.50 host 192.168.1.34
access-list 101 deny ip host 192.168.1.51 host 192.168.1.34
int f1/0
ip access-group 101 in
end

but it doesn't work. Can you tell me why? I've tried configuring to the router, but it's doesn't work, either.

I configured in GNS3 which doesn't support access-map.

Best Answer

First you must deny the packets from host 3 to host 1; then permit any thing else.

access-list 101 deny ip host 192.168.1.51 host 192.168.1.34
access-list 101 permit ip any any

however, if you want only to deny the ping, you must use icmp instead of ip in the deny part:

access-list 101 deny icmp host 192.168.1.51 host 192.168.1.34 echo
Related Topic