Disable ping in a router

[SimonPeh]

Hi Guys,

Anybody out there know how to disable ping in a router from an external network but at the same time allow ping in the internal network.

I suppose I need to turn off ICMP protocol in the router.
Can anyone kindly let me know how you do it?

Thank in advance !

Cheers
SP

 

[hexn]

So let me get this straight, you dont want people from the external network to be able to ping your router? Or you dont want people from an external network to ping through your router?

You cant disable ICMP. You can put up an access-list that denies pings entering an interface.

 

[SimonPeh]

Hi inikis,

I do not want anyone to ping through my router or into my network from an external network.

How do u setup the access-list that denies ping ? Is it the same way for disabling FTP and telnet port 20,21 and 23 ?

Any advice ?

Thanks

 

[hexn]

ok, lets say you dont want ping coming in through serial 0 interface

---------------------------------
acess-list 101 deny icmp any any
access-list 101 permit ip any any
!
interface Serial0
ip access-group 101 in
---------------------------------

Does that make sense? If you post your router config, I can write it specific to your router.

 

[wybnormal]

A slight correction.. the above ACL will deny ICMP but send back a message saying it was administratively denied. Which is probably not what you want.

access-list 107 deny icmp any any echo log

This entry will deny the echo back to the pinger. It will appear to be a black hole when the ping is sent

There are several options for ICMP when denying the packet.

MikeS
Find me at

http://www.packetattack.com

"Take advantage of the enemy's unreadiness, make your way by unexpected routes, and attack unguarded spots."
Sun Tzu

 

[svermill]

The above example would also have the drawback of preventing anyone inside your network from pinging to the outside world. The ICMP Echo Replies would get killed coming into s0. There are also other useful ICMP functions besides ping that would be lost.

 

[SimonPeh]

Thank you guys for all the great help and tips.

Your help are appreciated.