CYSA+ access list question

---

The video (cs0-001, recon tools part 3 at ~29:41) says that the following is true about this rule

deny icmp any host 10.1.1.1 echo-reply

Am I misreading the trainers statement? It sounds like its denying ping from 10.1.1.1, which to me is backwards.

I see the rule doing:

Deny icmp from any host going to 10.1.1.1 with keyword echo-reply. (echo-reply seems redundant since its denying ICMP anyway. Is that keyword really needed?)

Am I reading this wrong?

Thank you.

Hmmm - that transcript may be a bit scrambled. :-)

So this ACL statement has the following effect:

ICMP echo-reply packets sourced from any IP address and destined for the system at 10.1.1.1 are denied.

Note that if you leave off the echo-reply keyword at the end of the statement, you would block all ICMP traffic from anywhere to that host. This might not be desired since ICMP might be required for other purposes here beyond echos and echo-replies which are the packets specific to ICMP ping tests.

Here is a handy reference for the other types of ICMP packets and the value (or not) that they bring. :-)

https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml

IIRC, I played that back a few times and is what he says.