I applied inbound ACL to block ping request from host IP to host IP. The effect after that is ping reply from unblocked IP on the interface that has been applied the inbound ACL is slow/loss.
Any comment? Can it be solved by enabling flow control?
Hardware: Cisco 3700 Fastethernet
The problem is that you're using the finest-grained ACL (host-to-host with a specific protocol (icmp)) and it sounds like you're applying it to an interface that hosts a whole bunch of incoming traffic. You're asking the router to pay attention to three different fields to block or allow traffic, so if you could re-work that to two fields you'd likely see better performance.
Not necessarily as a permanent solution, but as a temporary alleviation to the issue, can you apply that ACL in reverse on the exit interface that leads to the 'victim' you're trying to protect? And by reverse I mean don't allow your victim's icmp echo-replies to make it back to the 'attacker'. It's true this won't stop a flood of icmp inbound from attacker-to-victim immediately, but often echo requests are stopped (automagically or manually) after there aren't any replies. And in this manner you'd free that previous interface from the ACL burden you placed on it.
