How to block ICMP Ping on Cisco Routers

ICMP is a network management protocol. It is available on all IP devices. Devices use it to exchange error and related information. It allows devices to send and receive error and message notifications.

An adversary can use the ICMP protocol to reveal information about your network or to launch a DoS attack against a device on your network. For example, the 'tracert' and 'ping' commands use the ICMP protocol. An adversary can use the 'tracert' command to locate your network resources, or the 'ping' command to launch a DoS attack on your servers.

To prevent an adversary from abusing the ICMP protocol, you can use extended access lists. An extended access list allows you to control ICMP error messages and the messages that devices can send and receive.

Creating extended access lists for ICMP messages

The following global configuration mode command creates an extended access list for ICMP messages.

Router(config)# access-list 100-199|2000-2699 permit|deny icmp
source_address source_wildcard_mask
destination_address destination_wildcard_mask
[icmp_message] [log]

Syntax parameters:-

100-199 | 2000-2699:- These are the two number ranges reserved for extended access lists. To create an extended access list, you must select a number from one of these ranges.
permit|deny:- This is the action that the ACL will perform if the packet matches the defined condition.
ICMP:- This option specifies that you are creating a statement for the ICMP protocol.
source_address source_wildcard_mask:- It defines the source IP address that you want to match.
destination_address destination_wildcard_mask:- It specifies the destination IP address that you want to match.
icmp_message:- This is the type of ICMP message that you want to filter.

The following table lists some of the most common types of messages that you can filter.

An access list does nothing until you apply it to an interface. The following interface configuration mode command applies it to the interface.

Router(config-if)#ip access-group ACL_# in|out

Replace the ACL_# with the ACL number or name. To apply the ACL in the outward direction, use the 'out' option. To apply it in the inward direction, use the 'in' option.

Packet Tracer example

Either create a Packet Tracer lab as shown in the following image, or download the pre-created lab and load it into Packet Tracer.

Packet Tracer Lab with Initial Configuration

Currently in this network:-

• All sections can access each other.
• HTTP, HTTPS, FTP, TFTP, EMAIL, DHCP, and NTP services are running on the Server.
• The Sales section and Manager section can access services running on the Server.
• The Sales section can also send ping requests to the Server.

To verify the setup, access the web service running on the Server from PC2 and send ping requests from PC0 to the Server. The following image verifies that the Sales section (PC2) can access the web service.

The following image verifies that the Sales section (PC0) can send ping requests to the Server.

Objectives:-

Block the Sales section from sending ping requests to the Server. But at the same time, do not disrupt any other services or features of the network. For this, you need an extended access list on the router.

Creating an extended access list to block ICMP echo messages

Access the Router's CLI prompt and enter the following commands.

Router>enable
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#access-list 101 deny icmp 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255 echo
Router(config)#access-list 101 permit ip any any
Router(config)#interface gigabitEthernet 0/0
Router(config-if)#ip access-group 101 in
Router(config-if)#exit
Router(config)#

Verifying the ACL implementation

This ACL blocks echo requests from the Sales section without blocking data flow for any other service or disrupting connectivity between sections. To verify it, send ping requests from PC2 to Server0. If ping requests are blocked, it verifies ACL implementation.

This ACL must not block any other network features or services. To verify this, reaccess the web service from PC2. If PC2 can access a web page from the web server running on Server0, it verifies that the ACL is not blocking or interrupting any other service except echo messages. The following image shows this testing.

This ACL must not block echo requests from the Manager section. To verify this, send a ping request from the Manager section. If the Manager section can ping the Server section, it verifies that the ACL is not blocking echo requests from other sections. The following image shows this testing.

The following link provides the configured Packet Tracer lab for the above example.

Packet Tracer Lab with ACL Configuration

Conclusion

This tutorial explained how to create and implement an extended access list to block ICMP echo messages (ping requests) from specific sections of your network while maintaining uninterrupted access to other services. By following the outlined steps, you can create an access list that denies ICMP echo requests specifically, ensuring that sensitive network information remains protected from potential attackers.