topic Re: ICMP thru FWSM in Network Security

ICMP thru FWSM

fauresr — Mon, 11 Mar 2019 10:35:07 GMT

Hi,

we have a set of FWSM running 3.2(1)

Rules are set to allow ICMP both inbound and outbound.

However traceroute gives some unexpected results, half of the hosts do not respond. It also produces the following message in the log.

%FWSM-4-313004:Denied ICMP type=icmp_type, from source_address oninterface interface_name to dest_address:no matching session

ICMP packets were dropped by the security appliance because of security checks added by the stateful ICMP feature that are usually either ICMP echo replies without a valid echo request already passed across the security appliance or ICMP error messages not related to any TCP, UDP, or ICMP session already established in the security appliance.

Any idea what can I do to fix this. I am not worried about the syslog message, I can always filter these out. But I need reliable traceroute.

Thank you,

Remy

Re: ICMP thru FWSM

Kmageshkumar — Sun, 15 Jul 2007 04:38:50 GMT

Hi,

Can you please try configuring the inspection for the icmp_error and please let me know if this fix your problem.Also don't forget have icmp allow ACL's from source to destination in dual direction.

Regards,

Magesh

Re: ICMP thru FWSM

fauresr — Sun, 15 Jul 2007 23:55:02 GMT

Hi,

I set icmp and icmp error inspection, ALCs allow icmp from source to destination.

Still, traceroute traffic get somewhat disrupted. It is also inconsistent. Several attempts few minutes appart do not lead to the same result.

I talked to TAC about this, and was informed of a bug ID. Expected to be addressed in next release.

Remy

Re: ICMP thru FWSM

Kmageshkumar — Mon, 16 Jul 2007 02:20:46 GMT

Hi,

Thanks for the update.please let us know what is the current version used and the bug ID and also what new version TAC suggested.This would be helpful.

Re: ICMP thru FWSM

fauresr — Mon, 16 Jul 2007 14:45:02 GMT

Our FWSM is currenlty running version 3.2(1)

The bug ID TAC gave me is: CSCsj53485

From what I was told, this affects version 3.1(5) and 3.1(6) and will be addressed in 3.1(7)

It seems it also affects 3.2(1) and will be addressed in 3.2(2)

I do not have a timeframe for resolution.

Regards,

Remy

Re: ICMP thru FWSM

Kmageshkumar — Thu, 19 Jul 2007 02:44:37 GMT

Thanks for your detailed update.