App ICMP vs. Ping

Reply
L0 Member

App ICMP vs. Ping

When icmp is specified as an application in a rule, it appears that icmp requests and replies do not match that rule.  The application ping must be added to the rule for a match to occur against echo request and echo reply packets.  Isn't ping a subset of the icmp protocol as a whole?  I understand how to make this work by adding the application ping, but do not understand why the app icmp does not allow ping.  Is the app icmp "all icmp types and codes except ping"?


Accepted Solutions
L4 Transporter

Hi,

Let's take another example- facebook.

Facebook is actually kind of web-browsing, but you still need to allow facebook explicitly in order to get the access.

To us if we have any sig to cover a specific app, you must allow that specific app in the policy as well in order to allow the traffic. In the real situation for some apps (not icmp) we also need to consider app dependency.

Actually many traditional firewall do create specific sig for each icmp type traffic and we just create two by default: ping and other icmp traffic (icmp).

Hope this help.

View solution in original post


All Replies
Not applicable

Good question ! I second it!

L4 Transporter

Hi,

Let's take another example- facebook.

Facebook is actually kind of web-browsing, but you still need to allow facebook explicitly in order to get the access.

To us if we have any sig to cover a specific app, you must allow that specific app in the policy as well in order to allow the traffic. In the real situation for some apps (not icmp) we also need to consider app dependency.

Actually many traditional firewall do create specific sig for each icmp type traffic and we just create two by default: ping and other icmp traffic (icmp).

Hope this help.

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!