Cisco ACL not working as expected

access-controlaclciscorouter

I've a client to which I want to deny access so that he cannot access my network host. There is this specified port that he scanned on my network host which I want to block (Port 137).

Using NMAP, the client is able to find my open port on my network host(137). So I implemented an ACL on my router using the command.

access-list 111 deny udp (insert client ip) any eq 137
access-list 111 permit udp any any

What I wanted to do is to make sure that the moment the client uses NMAP to scan my network host for the port, port 137 will be filtered instead of open because of the ACL configured, however, the client is unable to even ping my network host now unless I add another command, permit ICMP any any, in the ACL.

Why is this so? Can any experts shed light about this?

Best Answer

There is an implicit "deny" at the end of every access-list. So your current access-list actually says:

access-list 111 deny udp (insert client ip) any eq 137
access-list 111 permit udp any any
access-list 111 deny ip any any

This means any UDP traffic (except from the client to port 137) is allowed, but all other traffic on that interface (including TCP and ICMP) is dropped. What you're looking for is this:

access-list 111 deny udp (insert client ip) any eq 137
access-list 111 permit ip any any
Related Topic