在ACL中可选择禁止对应的ping包ICMP类型即可,比如按照如下的ACL写:
[S6700-acl-adv-3000]rule 10 deny icmp icmp-type
INTEGER<0-255> ICMP type
echo Type=8, Code=0
echo-reply Type=0, Code=0
fragmentneed-DFset Type=3, Code=4
host-redirect Type=5, Code=1
host-tos-redirect Type=5, Code=3
host-unreachable Type=3, Code=1
information-reply Type=16, Code=0
information-request Type=15, Code=0
net-redirect Type=5, Code=0
net-tos-redirect Type=5, Code=2
net-unreachable Type=3, Code=0
parameter-problem Type=12, Code=0
port-unreachable Type=3, Code=3
protocol-unreachable Type=3, Code=2
reassembly-timeout Type=11, Code=1
source-quench Type=4, Code=0
source-route-failed Type=3, Code=5
timestamp-reply Type=14, Code=0
timestamp-request Type=13, Code=0
ttl-exceeded Type=11, Code=0
[S6700-acl-adv-3000]rule 10 deny icmp icmp-type echo
相应的如何禁止tracert可以禁止icmp类型为port-unreachable Type=3, Code=3和ttl-exceeded Type=11, Code=0即可