25

Searching around I haven't been able to determine the best practice for ICMP on a firewall.

For example on a Cisco ASA would it be safe and recommended to allow ICMP from any if ICMP inspection is enabled. This would then allow for things like type 3 unreachables to make it back to the clients.

Improve this question

1 Answer 1

Reset to default
32

No, ICMP should not be blocked. It's vital signalling protocol. Internet does not function without it.

PMTUD is broken if you drop ICMP.

IPv6 does not even begin to work without ICMP, as L3 to L2 address resolution (ARP in IPV4) is riding on top of ICMP in IPv6.

Also troubleshooting will take longer if ICMP echos are dropped. Alas often FW people train of thought appears to be 'when in doubt, drop'.

You use FW because your inside network has services not requiring auth or unmanaged hosts running vulnerable software. ICMP really is not a practical attack vector.

Improve this answer
4
  • 1
    I agree dropping all ICMP on the network is not a good idea. Just saying ICMPv6 (proto 58) is different from ICMP (proto 1). Dropping ICMP on the firewall does not affect IPv6 functionality, unless ICMPv6 are explicitly dropped as well ?
    – sdaffa23fdsf
    Commented Jun 26, 2013 at 13:50
  • Yes, ICMPv6 is different. It'll depend on your firewall though whether "drop all ICMP" includes ICMPv6. Usually, it doesn't, ipv6 rules are separate from ipv4 ones.
    – user661
    Commented Jun 26, 2013 at 15:21
  • Are you recommending that all ICMP be allowed through or just types like unreachables, time-exceeded, and traceroute to name a few?
    – generalnetworkerror
    Commented Jun 27, 2013 at 2:54
  • 1
    I personally allow them all, I've not heard of ICMP attack-vector (but I'm biased, I'm very anti-FW). Minimum set I'd recommend is: destination unreachable, time exceeded, parameter problem, echo, echo-reply, timestamp, timestamp-reply (great for measuring unidirectional latency at 1ms precision).
    – ytti
    Commented Jun 27, 2013 at 6:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.