topic ICMP trough Pix in Network Security

ICMP trough Pix

minoc — Fri, 21 Feb 2020 06:40:29 GMT

Does anyone knows what would happen if a forged ICMP echo reply packet coming from the Internet to a inside host hit the outside interface of the Pix?.

The inside host is static translated on the pix. And an ACL which permits ICMP echo-reply, time-exceeded, source-quench and unreachble to the inside host is configured.

What the Pix will do?

Regards,

Carlos Roque

Re: ICMP trough Pix

gfullage — Tue, 08 Apr 2003 23:52:33 GMT

The PIX doesn't do stateful inspection of ICMP packets as far as I'm aware, so if an echo-reply came in, even without an echo having first gone out, I would say the packet will be allowed in to the internal host.

Re: ICMP trough Pix

minoc — Tue, 22 Apr 2003 17:43:02 GMT

Ok, you are right the pix does not perform stateful inspection on ICMP packets, but since there was not connection originated from the inside interface it should block the ICMP reply packet once it hits the outside interface.

Regrads,

Carlos Roque

Re: ICMP trough Pix

steve.barlow — Wed, 23 Apr 2003 11:36:05 GMT

For the icmp packets to cross the PIX it needs a translation rule and an access list rule to permit it. In your example, the translation rule is there with the static and you have specified the acl to allow the echo-reply in. My money would be on that the packet would be allowed in.

Hope it helps.

Steve

Re: ICMP trough Pix

minoc — Thu, 24 Apr 2003 15:45:35 GMT

Right,

But how come the Pix will allow this if there was not an ICMP echo connection originated from the internal host ?.

If you are correct, then the Pix is not performing its job in securing the inside segment. I am pretty sure Checkpoint Firewall-1 will not allow this to go trough it.

Anyone could hijack resources located either on a DMZ or inside LAN.

Regards,

Carlos Roque