| 场景 | 按 ICMP 类型放行/拒绝 |
|---|---|
| 适用 | 三厂 |
| 常用类型 | echo（请求）echo-reply（回显应答）time-exceeded（超时）unreachable（不可达） |
华为 VRP
华为 VRP
acl number 3000
rule 5 deny icmp source any destination 10.1.1.10 0 icmp-type echo
rule 10 permit icmp source any destination 10.1.1.10 0 icmp-type echo-reply
rule 15 permit ip思科 IOS
思科 IOS
access-list 100 deny icmp any host 10.1.1.10 echo
access-list 100 permit icmp any host 10.1.1.10 echo-reply
access-list 100 permit ip any anyH3C Comware
H3C Comware
acl advanced 3000
rule 5 deny icmp source any destination 10.1.1.10 0 icmp-type echo
rule 10 permit icmp source any destination 10.1.1.10 0 icmp-type echo-reply
rule 15 permit ip差异：思科在协议后紧跟类型名（deny icmp any host X echo）；华为/H3C 用 icmp-type 关键字指定。禁 ping 只是降噪，不构成安全防护。