topic Re: Enabling ICMP through ASA Firewalls in Network Security

Enabling ICMP through ASA Firewalls

Drader — Wed, 14 Sep 2022 06:05:01 GMT

Hello, I am new to networking and was wondering if anyone can tell me what is the difference (like in what situation will I need to use them) amongst the following commands for cisco ASA:

1. inspect icmp - for policy-map global_policy

2. access-list icmp extended permit icmp any any (and using access group after)

3. fixup protocol icmp

Thank you in advance!

Re: Enabling ICMP through ASA Firewalls

Kasun Bandara — Wed, 14 Sep 2022 06:51:08 GMT

1st and 3rd commands using to inform firewall to treat ICMP traffic as a statefull way. 2nd command is allowing ICMP traffic using ACL applied to respect direction and interface.

Re: Enabling ICMP through ASA Firewalls

Rob Ingram — Wed, 14 Sep 2022 07:06:00 GMT

@Drader #1 and #3 turn on ICMP stateful inspection globally. The command "fixup protocol icmp" (#3) is just a shortcut to enable icmp inspection under the global policy (#1) - both achieve the same thing.

#2 explictly permits the return ICMP traffic on the ACL, usually this is inbound on the outside interface. You would use the ACL if you didn't want to inspect ICMP. The ACL can of course be configured granularly, so explictly permitting ICMP traffic for certain hosts/subnets, and denying for the rest.