First you have to create an access list:

router(config)#access-list 100 permit icmp any any unreachable
router(config)#access-list 100 permit icmp any any echo-reply
router(config)#access-list 100 permit icmp any any time-exceeded
router(config)#access-list 100 permit icmp any any source-quench
router(config)#access-list 100 deny   icmp any any timestamp-request
router(config)#access-list 100 deny   icmp any any timestamp-reply
router(config)#access-list 100 permit ip any any

Then add id to IN or OUT to the interface:

router(config)#interface GigabitEthernet0/2
router(config)#ip access-group 100 in

Modificare una access-list (Prima magari visualizzala e guarda i numeri di riga)
Visualizzare access-list: router#sh ip access-list 100

router(config)#ip access-list extended 100
router(config-ext-nacl)#67 deny tcp any any eq telnet
router(config-ext-nacl)#do sh ip access-list 100

NOTA: La sequenza è fondamentale per l'applicazione delle regole.

Esempio:

csco-gw02(config-ext-nacl)#do sh ip access-list 100   
Extended IP access list 100
    10 permit icmp any any unreachable (2 matches)
    20 permit icmp any any echo-reply
    30 permit icmp any any time-exceeded
    40 permit icmp any any source-quench
    50 deny icmp any any timestamp-request (1 match)
    60 deny icmp any any timestamp-reply
    70 permit ip any any (84562 matches)