topic Re: icmp list in Network Security

icmp list

suthomas1 — Mon, 11 Mar 2019 19:03:54 GMT

i have an acl which is :

access-list local_inside extended permit icmp 192.168.100.0 255.255.255.0 any log alerts interval 400

1. if it says only icmp protocol to any, does it cover icmp echo & echo-reply both?

2. does interval 400 indicate a period of 400 secs after which the next hit for the same list will be shown. existing flow using the present session till the time interval?

3. since destination is any here, will it register icmp from source to interface ip of the firewall itself, if ping be tried to those interfaces or will it only have flow through the firewall?

TIA.

Re: icmp list

rmavila — Wed, 03 Nov 2010 11:41:37 GMT

1. it covers both icmp echo and reply.

2.interval specifies the log interval at which to generate system log message 106100. Valid values are from 1 to 600 seconds. The default is 300.

3. Access-list will register the the pings which flow through the firewall and not to the interface of the firewall.

Hope the above answers your question.

Regards

Rahul

Re: icmp list

suthomas1 — Thu, 04 Nov 2010 00:27:05 GMT

Thanks for the answers. A small bit here, since the acl says any destination, shouldnt icmp to fw interface also count under those.

If this is not it, where would icmp from same source subnet to fw interface be accounted for.

TIA

Re: icmp list

praprama — Thu, 04 Nov 2010 03:14:21 GMT

Hi,

ICMP traffic to the firewall is not controlled using access-lists. Instead you will have to use the "icmp" command details of which can be found below:

http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/i1.html#wp1685750

For example, if you would like to allow the subnet 192.168.100.0/24 to ping the "inside" interface of the firewall, the command would be

icmp permit 192.168.100.0 255.255.255.0 inside

Hope that clears things out!!

Cheers,

Prapanch