topic Blocking icmp through ASA in Network Security

Blocking icmp through ASA

shoaib sheikh — Tue, 12 Mar 2019 06:08:42 GMT

config t
(config)# policy-map global_policy
(config-pmap)# class inspection_default
(config-pmap-c)# no inspect icmp
(config-pmap-c)# exit
(config-pmap)# exit
(config)# ping www.google.com
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 216.58.196.100, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 80/84/90 ms

ASA gives logs in ASDM as follows:

An ICMP session was established in the fast-path when stateful ICMP was enabled using the inspect icmp command.

I have applied ACL to block any any ip and any any icmp on outside interface. Is this a normal behaviour of ASA. How do I block icmp ?

Hi,Normal ACL would only

Vibhor Amrodia — Thu, 18 Jun 2015 08:01:20 GMT

Hi,

Normal ACL would only block traffic which is through the box.

This ping is initiated from the ASA device interface so you would need to use the "ICMP deny" command.

Refer:-

http://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/I-R/cmdref2/i1.html#pgfId-1779047

Thanks and Regards,

Vibhor Amrodia

Thanks Vibhor .

shoaib sheikh — Mon, 22 Jun 2015 03:57:42 GMT

Thanks Vibhor .