Hi Jimmysturn:
What's likely happened here is that you have IDS attack policy binded to your outside interface with the action to 'drop' or 'reset' any packets that match the signatures in the Attack category.
Signature 2151 (Large ICMP) will drop the packets hitting the PIX outside interface or those that go through the PIX outside interface when you ping with large packet size (993+ bytes):
From your post, you must have had the following IDS policy on your PIX:
ip audit name attackpolicy attack action drop
(or
ip audit name attackpolicy attack action drop alarm
or
ip audit name attackpolicy attack action reset alarm
or both)
If you want to ping with large packet, there are several things that you can do:
1) Remove the 'attackpolicy' policy completely from your outside interface. This will turn off all IDS signatures in the Attack category.
Carefully examine this and see if that's what you want to do.
To achieve the above, issue the following command:
'no ip audit interface outside attackpolicy'
2)Disable signature 2151 by issuing the command:
'ip audit signature 2151 disable'
That would disable only the large ICMP attack signature while leaving other attack signatures in the Attack sig category ON.
3) Set signature action to log (to a syslog server or internal buffer) the large ICMP packets instead of dropping them. Again, this needs to be carefully determined just as the 1st option.
Issue the following command to achieve the above goal:
ip audit name attackpolicy attack action alarm
Hope it helps.
Please rate the post accordingly if you find it helpful.
Sincerely,
Binh
