topic Re: Allow ICMP (ping & tracert) between interfaces on Firepower 11 in Network Security

Allow ICMP (ping & tracert) between interfaces on Firepower 1140

PhilipTalavera7329 — Wed, 06 Jul 2022 18:17:47 GMT

We recently implemented a firepower 1140 running 7.0.1-84. We would like to allow host on our inside network to ping & tracert a host on our DMZ, and vice versa. Our DMZ and inside network have dedicated interface on the firepower. when I create an ACL to allow this traffic, ICMP, echo, and TTL are not listed.

How can I make these available to allow icmp to specific host on these interfaces?

thank you.

Re: Allow ICMP (ping & tracert) between interfaces on Firepower 11

Rob Ingram — Wed, 06 Jul 2022 18:28:04 GMT

@PhilipTalavera7329 how are you managing these devices? If using FMC, you need to configure a service policy, from there you can decrement the TTL. https://www.cisco.com/c/en/us/td/docs/security/firepower/670/configuration/guide/fpmc-config-guide-v67/threat_defense_service_policies.html#id_71048

Here is a guide to configure ICMP/Traceroute through FTD.

Re: Allow ICMP (ping & tracert) between interfaces on Firepower 11

PhilipTalavera7329 — Wed, 06 Jul 2022 23:05:41 GMT

thank you. issue resolved