topic icmp issue in Network Security

icmp issue

Javi Benito — Mon, 11 Mar 2019 18:48:24 GMT

hello,

I've an issue with the outside interface traffic. In the log server appears this error continuously:

Deny icmp src Internet:213.221.90.107 dst inside:212.6.X.X (type 3, code 1) by access-group "100" [0x0, 0x0]

dst inside 212.6.X.X correspond to outside interface.

In the acl number 100 only have a rule to access to the public web server. This ip is different than outside public interface.

access-list 100 extended permit tcp any host 212.6.X.X eq https

How I can fix this issue?

thanks

Re: icmp issue

Jennifer Halim — Fri, 01 Oct 2010 11:31:15 GMT

ICMP type 3, code 1 is an ICMP host unreachable packet.

If you would like the unreachable packet on your outside interface, you can configure the following:

icmp permit any unreachable outside

Hope that helps.

Re: icmp issue

Javi Benito — Fri, 01 Oct 2010 11:45:59 GMT

I've configured this option and the issue persist.

thanks!!

Re: icmp issue

Jennifer Halim — Fri, 01 Oct 2010 11:59:26 GMT

access-list 100 permit icmp any host 212.6.X.X unreachable

Re: icmp issue

Javi Benito — Mon, 04 Oct 2010 06:01:38 GMT

now yes!!

thanks