topic Re: allow icmp type 3 in General Topics

allow icmp type 3

ahtiakel — Tue, 08 Feb 2011 12:37:53 GMT

Hello,

How to configure policy to deny all icmp types, but only allow icmp type 3. Is it possible at all?

Thanks!

Re: allow icmp type 3

spolo — Wed, 09 Feb 2011 16:49:11 GMT

Have you tried making a custom App ID for this? ICMP type 3 is not one of the App ID signatures in the native database, but it looks like it would be easy to create one. I did it quickly and you can see it in the attached screen capture, but I haven't tested it. Maybe you could give it a shot!

To create a custom App ID, go to Objects tab > Applications > Click the "New" button. Give it a name and description in the "Configuration" tab, and then in the "Advanced" tab, you can choose your ICMP type.

Once you have a custom App ID, you could create a security policy to allow this application.

Re: allow icmp type 3

ahtiakel — Thu, 10 Feb 2011 07:20:23 GMT

Yes, I've done it. But little bit strange that sometimes also other applications are matching this rule then. In example ftp. May-be ftp uses icmp type 3 in some part of making connection?

Br!