1. Home
  2. Cisco Systems
  3. blocking all ICMP for group on Pix506e?

blocking all ICMP for group on Pix506e?

Hi: I have a couple of websites on distinct IPs behind a PIX506e with 1-to-1 NAT from the public to the private IPs.

According to Mcafee Secure, the server (windows 2003) is revealing the OS and the internal IP in response to ICMP requests. Their recommmendation is to block ICMP requests at the firewall.

Using the PDM GUI, I created a service group with just TCP 21, 80 and 443, and created a hosts/networks group and added the two IPs of the websites to it.

I created an access rule with "permit-any" on the outside I/F and TCP-any pointing to the service group, and of course now http requests can get through.

How do I then block all ICMP requests to the IPs the websites are on? TIA

Reply to
geekyguy
Loading thread data ...

In case it helps anyone else, I added a rule at the top of the list to "deny any" ICMP from the Outside I/F to that service group, and it seems to be working.

Reply to
geekyguy

Congratulations, you have now broken MTU Path Discovery. People using ADSL probably cannot access your site now.

Reply to
Walter Roberson

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.