ICMP Error Inspection
When this feature is enabled, the security appliance creates translation sessions for intermediate hops that send ICMP error messages, based on the NAT configuration. The security appliance overwrites the packet with the translated IP addresses.
When disabled, the security appliance does not create translation sessions for intermediate nodes that generate ICMP error messages. ICMP error messages generated by the intermediate nodes between the inside host and the security appliance reach the outside host without consuming any additional NAT resource. This is undesirable when an outside host uses the traceroute command to trace the hops to the destination on the inside of the security appliance. When the security appliance does not translate the intermediate hops, all the intermediate hops appear with the mapped destination IP address.
The ICMP payload is scanned to retrieve the five-tuple from the original packet. Using the retrieved five-tuple, a lookup is performed to determine the original address of the client. The ICMP error inspection engine makes the following changes to the ICMP packet:
• In the IP Header, the mapped IP is changed to the real IP (Destination Address) and the IP checksum is modified.
• In the ICMP Header, the ICMP checksum is modified due to the changes in the ICMP packet.
• In the Payload, the following changes are made:
- Original packet mapped IP is changed to the real IP
- Original packet mapped port is changed to the real Port
- Original packet IP checksum is recalculated
Continue reading here: IPSec Pass Through Inspection Overview
Was this article helpful?