topic Re: Ping block is the best way for Security ? in Network Security

Ping block is the best way for Security ?

MrBeginner — Fri, 23 Sep 2022 03:46:24 GMT

Hi ,

I noticed that some network disable the ping and some security engineer disable the ping in network. I also found some article that Disabling ICMP won’t increase security. What is the best practice ? If we enable ping , how to protect the attack like ping of death,icmp flood ,spoofing ,etc ?

Re: Ping block is the best way for Security ?

anboom — Fri, 23 Sep 2022 04:40:08 GMT

@MrBeginner, great post and thanks for asking this question that is very important to understand.

#1) the answer to this is, it depends. Network security is layered and complex so it depends on where you are using ping and trace. Here is a link and short summary from the ASA firewall perspective, which is protecting the internal traffic from the outside.

ICMP Packet Filtering: ICMP is designed as an IP control protocol. As such, the messages it conveys can have far-reaching ramifications to the TCP and IP protocols in general. While the network troubleshooting tools ping and traceroute use ICMP, external ICMP connectivity is rarely needed for the proper operation of a network.

https://tools.cisco.com/security/center/resources/firewall_best_practices#27

Hope this helps! anboom

Re: Ping block is the best way for Security ?

Kasun Bandara — Fri, 23 Sep 2022 06:11:22 GMT

Ping is just a tool to check availability/connectivity of node. disabling ping gives advantage to avoid random ping scans from anyone. but still there is other ways to check availability/connectivity of services. such as nmap scans, tcp scaning, etc.

Re: Ping block is the best way for Security ?

Rob Ingram — Fri, 23 Sep 2022 06:56:32 GMT

@MrBeginner it depends, read this http://shouldiblockicmp.com/

There are ICMP specific attacks, use rate limiting (CoPP) to prevent the CPU being overwhelmed. For anti-spoofing, use uRPF.

Re: Ping block is the best way for Security ?

MHM Cisco World — Fri, 23 Sep 2022 14:04:18 GMT

if you only need ICMP ping then allow it only and deny other ICMP message,