topic Re: App ICMP vs. Ping in General Topics

App ICMP vs. Ping

shadowpeak — Wed, 10 Aug 2011 14:13:27 GMT

When icmp is specified as an application in a rule, it appears that icmp requests and replies do not match that rule. The application ping must be added to the rule for a match to occur against echo request and echo reply packets. Isn't ping a subset of the icmp protocol as a whole? I understand how to make this work by adding the application ping, but do not understand why the app icmp does not allow ping. Is the app icmp "all icmp types and codes except ping"?

Re: App ICMP vs. Ping

lardsa — Wed, 10 Aug 2011 14:28:52 GMT

Good question ! I second it!

Re: App ICMP vs. Ping

jleung — Thu, 11 Aug 2011 15:40:47 GMT

Hi,

Let's take another example- facebook.

Facebook is actually kind of web-browsing, but you still need to allow facebook explicitly in order to get the access.

To us if we have any sig to cover a specific app, you must allow that specific app in the policy as well in order to allow the traffic. In the real situation for some apps (not icmp) we also need to consider app dependency.

Actually many traditional firewall do create specific sig for each icmp type traffic and we just create two by default: ping and other icmp traffic (icmp).

Hope this help.