topic Re: policy drop with icmp not sending icmp in General Topics

policy drop with icmp not sending icmp

Alex_Samad — Wed, 02 Aug 2017 08:47:32 GMT

I have a catch all before the default/inbuilt rules

my action is drop with icmp

but when i test and run a tcpdump at the same time I see no icmp packet to say unreachable .

Very strange ?

Anythoughts ??

Re: policy drop with icmp not sending icmp

TranceforLife — Wed, 02 Aug 2017 09:34:30 GMT

Have you seen this KB:

https://live.paloaltonetworks.com/t5/Learning-Articles/DotW-Send-ICMP-Unreachable-PAN-OS-7-0/ta-p/63507

Re: policy drop with icmp not sending icmp

BPry — Wed, 02 Aug 2017 15:22:43 GMT

@Alex_Samad,

You really shouldn't have a catchall rule that has this feature enabled unless it's soley for known traffic, you should never send icmp-unreachables to an unknown service.

Re: policy drop with icmp not sending icmp

Alex_Samad — Wed, 02 Aug 2017 23:13:00 GMT

Have you seen this KB:

https://live.paloaltonetworks.com/t5/Learning-Articles/DotW-Send-ICMP-Unreachable-PAN-OS-7-0/ta-p/63507

explains it

thanks