Cisco Extended ACL on 2811 Not Working Properly

Question

I am almost positive this is an issue of missing a key component or not declaring/applying the ACL properly, but I am unable to figure out the fix on my own. What I am trying to do is only allow PC2 to send any traffic to PC3 and PC1. Essentially PC4 should be inaccessible to PC2.

Since I am unable to post images yet, I will try to explain the topology which is very simple. PC1 and PC2 are behind SWITCH1 and SWITCH1 is connected to ROUTER0 on port f0/1. On the left side PC3 and PC4 are behind SWITCH2 and SWITCH2 is connected to ROUTER0 on port f0/0. The IPs are as follows:

• PC1 11.0.0.2/8 & Connected to f0/1 on SWITCH1
• PC2 11.0.0.3/8 & Connected to f0/2 on SWITCH1
• PC3 10.0.0.2/8 & Connected to f0/1 on SWITCH2
• PC4 10.0.0.3/8 & Connected to f0/2 on SWITCH2
• ROUTER0 f0/0 10.0.0.1/8 & Connects to f0/24 on SWITCH2
• ROUTER0 f0/1 10.0.0.2/8 & Connects to f0/24 on SWITCH1

The ACL as it exists now is as follows:

ip access-list extended NSL1
 permit ip host 11.0.0.3 host 10.0.0.2

The problem is that devices on the left side of the topology (PC1 & 2) can no longer ping 11.0.0.1 or 10.0.0.1 when they were able to prior to implementing the ACL. It gives the "Destination host unreachable." error. PC1 also cannot ping anything on or to the right of the router, but I know that is because I have not put a permit statement in for it yet. Any help would be greatly appreciated. I would think it should be a simple fix, but I don't know since I don't have much experience with Cisco IOS.

Below is the full running-config of ROUTER0.

Router>
Router>en
Router#sh run
Building configuration...

Current configuration : 579 bytes
!
version 12.4
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Router
!
!
!
!
!
!
!
!
!
!
!
!
!
!
spanning-tree mode pvst
!
!
!
!
interface FastEthernet0/0
  ip address 10.0.0.1 255.0.0.0
  duplex auto
  speed auto
!
interface FastEthernet0/1
  ip address 11.0.0.1 255.0.0.0
  ip access-group NSL1 in
  duplex auto
  speed auto
!
interface Vlan1
  no ip address
  shutdown
!
ip classless
!
!
ip access-list extended NSL1
 permit ip host 11.0.0.3 host 10.0.0.2
!
!
!
!
!
line con 0
 line vty 0 4
 login
!
!
!
end

Answer 1

Your access list is specifying 11.0.0.3 as the source and 10.0.0.2 as the destination - other traffic ingressing on the f0/1 interface will not be allowed (and I think it's a little strange that they're sending ICMP Unreachables instead of just dropping the packet, but there you have it).

If you want to allow pings to the router's IPs, you'll also need to put those in the ACL:

ip access-list extended NSL1
 permit ip host 11.0.0.3 host 10.0.0.2
 ! let it communicate with the other interface's routed IP:
 permit ip host 11.0.0.3 host 10.0.0.1
 ! let's just allow it to hit anything else in its subnet; might as well, right?
 permit ip host 11.0.0.3 11.0.0.0 0.255.255.255

Note that only 11.0.0.3 will be able to ping now with this ACL; you'd need to allow 11.0.0.2 explicitly as well.