topic Re: ICMP BLOCK ON FTDs in Network Security

ICMP BLOCK ON FTDs

fmugambi — Wed, 01 Nov 2023 07:07:15 GMT

Hello Team,

Managing my FTDs via FMC. Needed help to restrict ICMP on outside interfaces, but allow a few internal endpoints to PING them, for SNMP and other reasons.

Once i do this under platform settings, ICMP is blocked to all, even on the permitted endpoints. Am i doing anything wrong?

Your support will be appreciated.

Re: ICMP BLOCK ON FTDs

rveracon — Wed, 01 Nov 2023 23:44:12 GMT

Hello fmugambi,

Can you provide more information into what objects and ICMP service are you using for your configuration? If this configuration affects data interfaces you can also create two ACP Rules, one blocking ICMP traffic and other allowing the traffic and you can define which hosts/networks should be blocked specifically there.

Best regards!

Re: ICMP BLOCK ON FTDs

fmugambi — Thu, 02 Nov 2023 06:09:21 GMT

Under platform settings, then a policy, ICMP Access , ICMP UnReachable ..

Is this the correct way?

Re: ICMP BLOCK ON FTDs

Herald Sison — Thu, 02 Nov 2023 17:07:44 GMT

what are the values here? did you use Deny as action?

Re: ICMP BLOCK ON FTDs

fmugambi — Fri, 03 Nov 2023 05:50:23 GMT

Yes I did, and a different entry for permit for endpoints I would wish to reach this ICMP.

But ends up blocking all endpoints.

I as well presume it evaluates the rules top-down, correct?

Re: ICMP BLOCK ON FTDs

rveracon — Fri, 03 Nov 2023 23:05:09 GMT

Hello fmugambi,

Is there a particular reason why you are using ICMP type 3 (destination unreachable)? What might be happening is that you declare a rule for ICMP 3 denying traffic, then you permit ICMP 3 traffic on other rules, but the actual type you receive on the firewall are type 8 (ICMP requests). So what ends up happening like any kind of ACL is that there is no rule allowing that traffic which ends up dropping everything on the implicit deny rule that exists.

Try creating an ICMP rule with type 8 (echo requests) allowing some hosts and test if those hosts can ping again.

Best regards!

Re: ICMP BLOCK ON FTDs

MHM Cisco World — Sat, 04 Nov 2023 16:18:42 GMT

https://community.cisco.com/t5/network-security/block-icmp-to-ftd-device-interface-ip-in-fdm/td-p/4152340

use flexconfig to deny ICMP toward FTD interface (not ICMP bypass FTD)

Thanks A Lot
MHM