Figure 1 Networking diagram for an AR used as a gateway
Main configuration on the AR:
# acl number 3301 rule 5 deny icmp destination 188.8.131.52 0 rule 10 permit ip # interface GigabitEthernet0/0/1 traffic-filter outbound acl 3301 #
Run the traffic-filter outbound acl 3301 command on an AR interface to block ping packets with destination address 184.108.40.206. When destination address 220.127.116.11 is pinged on the AR, the ping operation succeeds but packet filtering does not take effect.
The ping 18.104.22.168 command cannot be executed on a PC but can be executed on the AR.
The ping 22.214.171.124 command executed on the AR is directly sent from the protocol stack to the outbound interface without entering the forwarding plane. Traffic filtering applies to the forwarding plane without involving the QoS process, so packets cannot be filtered. This is a normal situation that destination address 126.96.36.199 can be pinged on the AR.
The AR software includes the control and forwarding planes. The differences are as follows:
The forwarding panel forwards packets destined for another device. Generally, packets with inbound and outbound physical interfaces are called packets destined for another device.
Packets sent by the control plane do not enter the forwarding plane. Most of these packets are irrelevant to services deployed on the forwarding plane.