ICMP Filtering Recommendations
As you can see, there was a reason that ICMP was created beyond as a playground for attackers. Although most of the 15 ICMP message types can be blocked, several are necessary to the healthy operation of a network. We can rebuild the previous ACLs to allow all the messages we discussed, to block fragments, and to deny any other ICMP messages. Those ACLs are as follows.
Router "police" Serial0 ACL, inbound:
! deny non-initial ICMP Fragments access-list 101 deny icmp any any fragments ! permit echo-request to SerialO interface of the router access-list 101 permit icmp any host 192.0.2.2 echo ! permit echo-request to public server access-list 101 permit icmp any host 126.0.64.10 echo
! permit echo-reply from anywhere to the internal network and the public server access-list 101 permit icmp any 126.0.128.0 0.0.0.255 echo-reply access-list 101 permit icmp any host 126.0.64.10 echo-reply ! permit "fragmentation needed but DF bit set" message access-list 101 permit icmp any any packet-too-big ! permit "Time exceeded" message access-list 101 permit icmp any any time-exceeded ! deny any other ICMP message access-list 101 deny icmp any any
! from here you would continue with other non ICMP related ACL entries
Router "police" Ethernet0 ACL, inbound:
! deny non-initial ICMP Fragments access-list 102 deny icmp any any fragments
! permit echo-request from the internal network to anywhere access-list 102 permit icmp 126.0.128.0 0.0.0.255 any echo ! permit "fragmentation needed but DF bit set" message access-list 102 permit icmp any any packet-too-big ! permit "Time exceeded" message access-list 102 permit icmp any any time-exceeded ! deny any other ICMP message access-list 102 deny icmp any any
! from here you would continue with other non ICMP related ACL entries
Router "police" Ethernet1 ACL, inbound:
! deny non-initial ICMP Fragments access-list 103 deny icmp any any fragments
! permit echo-request from the public web server to anywhere access-list 103 permit icmp host 126.0.64.10 any echo ! permit echo-reply from the public web server to anywhere access-list 103 permit icmp host 126.0.64.10 any echo-reply ! permit "fragmentation needed but DF bit set" message access-list 103 permit icmp any any packet-too-big ! permit "Time exceeded" message access-list 103 permit icmp any any time-exceeded ! deny any other ICMP message access-list 103 deny icmp any any
! from here you would continue with other non ICMP related ACL entries
Continue reading here: Asymmetric Routing and State Aware Security Technology
Was this article helpful?