PIX & icmp unreachables

[jjoensen]

I have a customer with suspected Path MTU Discovery problems over a PIX vpn tunnel. I have no access to the pix'es, but does PIX default generate and send icmp type 3 code 4 messages (Fragmentation Needed and Don't Fragment was Set) ?

If yes, will an acl denying icmp filter it ?

If no, how do you turn it on - globally or pr. interface ?

Thank you

[mostiguy]

ACls don't apply to the pix - only the traffic the flow through it. Use the ICMP command to permit ICMP traffic to the pix interfaces:

icmp permit 0.0.0.0 0.0.0.0 unreachable outside

will allow unreachables to touch the outside pix interface, for example

[jjoensen]

OK, but what about the pix itself - will it default issue an icmp unreachable message to a host trying to do MTU path discovery over the vpn tunnel ?

thanks

[ovt]

Yes, if the PIX is the tunnel endpoint he should participate in PMTUD and log 602102. Look at 602101 also:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/63syslog/pixemsgs.htm#wp1056796

Another interesting question: what will happen if we have a network with lower MTU behind the PIX inside interface? So far as I know the only ICMP messages that are PAT'ed by PIX are echo and echo-replay :) But I might be wrong.

Oleg Tipisov,

REDCENTER,

Moscow