ICMP Inspection

[George D]

How can I allow outbound ICMP but prevent a remote shell exploit such as this:

http://resources.infosecinstitute.com/icmp-reverse-shell/#gref

[johnlloyd_13]

hi,

you can configure ICMP inspection under global policy map.

this will let the ASA create a state table and remember who's making ping request from the 'inside' or trusted interface.

policy-map global_policy
 class inspection_default
  inspect icmp
  inspect icmp error