Simple question: Can a service for icmp/ping be created, or should I just configure "Application Default" under Service? We have ping/icmp defined under Application, but we also have specific services configured also and ping will not work, falls to the clean-up rule. It's my understanding that if you have specific applications configured that only those applications would be matched on the rule if services were setup with "Application Default", correct?
I did read "How Application-Default in the Rulebase Changes the Way Traffic is Matched" and that was my conclusion.
Since ICMP is not having a layer-4 header on it, it will use Identifier as source port, the destination port is the ICMP Sequence Number.
Hence, ICPM source and destination port numbers are random in nature and you cannot match with any custom services for this. The recommendation would be, create a separate rule for ICMP traffic (application=ping, service= application-default or any).
Hope this helps.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!