Blocking unsolicited echo-reply from the outside of firewall

[dnbsection]

                   What is the easiest way to stop unsolicited icmp echo-reply packets coming from the outside of an Cisco ASA 5500 firewall?

[Jouni Forss]

Hi,

The firewall should now allow any ICMP Echo replys through the firewall if it hasnt seen a Echo for that same reply.

Instead of allowing Inbound ICMP from the WAN with an ACL you should configure ICMP Inspection

In a very default ASA configuration they would be added in the following way

policy-map global_policy

class inspection_default

  inspect icmp

  inspect icmp error

Hope this helps

- Jouni