ICMP Blocking/Permitting

[rkollar59]

Greetings,

I would like to block any ICMP requests from the outside; returning host unreachable, etc.

Would the syntax be something like:

icmp deny host 1.2.3.4.5 echo-reply outside

I would also like to permit ICMP from inside to outside.

What would the syntax be for this entry? Thanks.

[a-vazquez]

You could simply apply an access-list which would block all ICMP traffic from outside. This is because when we apply a access-list to the interface which is facing the internet when packets come in they are checked against that access-list and will be dropped. I guess this would be a effective way of dropping ICMP messages.

[mostiguy]

Are you talking about how a PIX handles ICMP packets directed at its interfaces? You WANT returning host unreachable, as blocking it will break path MTU detection.

by default, a pix allows all ICMP to its interfaces. Adding any ICMP rules will change this behavior

icmp permit any unreachable outside

Should effectively allow that, and disallow all other icmp to the outside interface