topic About APP-ID icmp and ping. in General Topics

About APP-ID icmp and ping.

ttongfly — Fri, 04 Nov 2011 05:50:53 GMT

Hi guys.

I have question about APP-ID that ICMP and PING. I found that some document said "ICMP is all of icmp procol and PING is only ICMP type 0 and 7 is echo request and reply".

When we have white list security policy, For open a PING application, Shoud we open ICMP and PING also? I think they has got app-dependency so ICMP must be opend and also ping should be opend. right?

Thanks.

Regards.

Roh.

Re: About APP-ID icmp and ping.

gswcowboy — Wed, 09 Nov 2011 04:33:58 GMT

Typically, users want to discuss denial of ping vs icmp. Here's a general feedback.

ICMP is not available in the "Service" column of the security policies. Instead the option is available in the "Application" column. However, you should exercise caution when denying the protocol ICMP, as this will effect all ICMP packets and any application reliant on the protocol. The alternative option is to simply deny PING as an application, which uses ICMP Type 8 (Echo Request) and 0 (Echo Reply).

Re: About APP-ID icmp and ping.

ttongfly — Fri, 11 Nov 2011 00:30:35 GMT

Hello rkalugdan

Thank you for kind answer!

Regards.

Roh

Re: About APP-ID icmp and ping.

JimmyChernega — Tue, 03 Nov 2020 21:36:34 GMT

Can someone explain why a PING fails, even if I allow all ICMP ? Even if you assume PING is application level, I've still allowed it at layer 3. I noticed the same thing with SSH. Thanks.

Re: About APP-ID icmp and ping.

SutareMayur — Wed, 04 Nov 2020 06:24:01 GMT

@JimmyChernega,

There is one KB article available on PA community given below. This may help you.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIoCAK