icmp list

[suthomas1]

i have an acl which is :

access-list local_inside extended permit icmp 192.168.100.0 255.255.255.0 any log alerts interval 400

1. if it says only icmp protocol to any, does it cover icmp echo & echo-reply both?

2. does interval 400 indicate a period of 400 secs after which the next hit for the same list will be shown. existing flow using the present session till the time interval?

3. since destination is any here, will it register icmp from source to interface ip of the firewall itself, if ping be tried to those interfaces or will it only have flow through the firewall?

TIA.

[rmavila]

Hi

1. it covers both icmp echo and reply.

2.interval specifies the log interval at which to generate system log message 106100. Valid values are from 1 to 600 seconds. The default is 300.

3. Access-list will register the the pings which flow through the firewall and not to the interface of the firewall.

Hope the above answers your question.

Regards

Rahul

[suthomas1]

Thanks for the answers. A small bit here, since the acl says any destination, shouldnt icmp to fw interface also count under those.

If this is not it, where would icmp from same source subnet to fw interface be accounted for.

TIA

[praprama · Accepted solution]

Hi,

ICMP traffic to the firewall is not controlled using access-lists. Instead you will have to use the "icmp" command details of which can be found below:

http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/i1.html#wp1685750

For example, if you would like to allow the subnet 192.168.100.0/24 to ping the "inside" interface of the firewall, the command would be

icmp permit 192.168.100.0 255.255.255.0 inside

Hope that clears things out!!

Cheers,

Prapanch