SSL VPN ICMP type 3 question

[noepkes51]

Hello Cisco Community,

We are using an ASA 5510 for our remote VPN connection.  Since we are using it for only VPN, we have it sitting behind a Checkpoint firewall.  I have firewall rules (on checkpoint) to all the SSL VPN connections (both UDP and TCP port 443).

On Checkpoint I noticed a lot of out of state packets being dropped.  These packets were ICMP time-exceeded, destination unreachable and your standard echo requests.

I opened up the firewall rules to allow the above ICMP connections in and out but I'm still seeing the following errors on the ASA:

%ASA-3-313001: Denied ICMP type=3, code=3 from x.x.x.x on interface outside

%ASA-3-313001: Denied ICMP type=3, code=1 from x.x.x.x on interface outside

Since these requests are coming from legitimate users, I'm wondering what the purpose this ICMP traffic serves and if my checkpoint firewall is reducing VPN performance.

[Jennifer Halim]

Those ICMP type 3 are being dropped on your ASA outside interface because you might have "icmp" rules configured on one or more of your interfaces.

You can check by running the following command: sh run icmp

If you have at least 1 icmp rule configured on any 1 interface, the default rule for any icmp types that you have not allowed on the interfaces are block.

Here is the syslog explaination for your reference:

http://www.cisco.com/en/US/docs/security/asa/asa80/system/message/logmsgs.html#wp4771105

To allow specific ICMP type 3 on your outside interface:

icmp permit any unreachable outside

Hope that helps.

[noepkes51]

Thank you for your help.  However, I am still getting the following: %ASA-3-313001: Denied ICMP type=3, code=3

Does the command you mentioned allow only ICMP type 3, code 0?  I would like too allow all codes for type 3.

This is the results from my show run icmp command:

(config)# show run icmp
icmp unreachable rate-limit 100 burst-size 10
icmp permit any outside
icmp permit any unreachable outside
icmp permit any inside

[Jennifer Halim]

It should be for all ICMP type 3 codes.

Can you please check again if you still have those syslog logged? It might just be a delay as it is still processing the syslog prior to your change on the ICMP command.

[noepkes51]

I checked this morning and had 70 alerts sent to my inbox.  Looks like they're all code 1 or code 3.