topic Re: Unable to allow only ICMP Echo Request; Firewall passes all the traffic in General Topics

Unable to allow only ICMP Echo Request; Firewall passes all the traffic

dkraus — Tue, 22 Mar 2011 20:17:45 GMT

Hello,

I have 2 networks in 2 different security zones. I have been trying to set up the firewall (PA-500) to allow only icmp echo request (ping), which is an icmp message number 8 and 0 between the two networks. When using predefined application called "ping" it allows other traffic and not just the icmp ping. I have also tried to create a custom application rule that would define icmp message number 8, but it does exact same thing as the predefined "ping". The rule would look like this:

Name Source Zone Destinatio Zone Source Addr Source User Dest Addr App Service Act Profile

ICMP Ping between Zone1 Zone2 any any any ping any none

zones

When I run tcpdump or such utility on Zone2 host I see also TCP and UDP traffic. The firewall Monitor tells me that this is the rule that allows the other traffic. This could be a potential security issue?

Any suggestions would be greatly appreciated.

Re: Unable to allow only ICMP Echo Request; Firewall passes all the traffic

KGC — Tue, 22 Mar 2011 23:29:24 GMT

Maybe instead of specifying your Service as "any" try using "application-default" ?

Re: Unable to allow only ICMP Echo Request; Firewall passes all the traffic

UtilitySecurity — Mon, 10 Oct 2011 20:07:05 GMT

We ran into this same problem. When you put 'PING' in the Application and leave the Source to 'any' it allows any TCP/UDP traffic. We are going to change the policy and see if 'default-application' fixes it. However, I agree that this is an issue. It is mis-leading to have a policy that states a firewall only allows PING traffic as the application on 'any' service, and yet allows ALL traffic.

Re: Unable to allow only ICMP Echo Request; Firewall passes all the traffic

bpappas — Mon, 10 Oct 2011 20:35:56 GMT

@gmoorman:

if you can demonstrate that a security policy with action = allow, service = any and application = ping is allowing TCP or UDP traffic then I advise you to contact support.

-Benjamin

Re: Unable to allow only ICMP Echo Request; Firewall passes all the traffic

ldormond — Fri, 11 Nov 2011 12:58:56 GMT

Hi,

I got exactly the same kind of issue :

https://live.paloaltonetworks.com/thread/3715?tstart=0

This is weird...

Any idea ?

Regards,

Laurent