policy drop with icmp not sending icmp

[Alex_Samad]

I have a catch all before the default/inbuilt rules

my action is drop with icmp

but when i test and run a tcpdump at the same time I see no icmp packet to say unreachable .

Very strange ? 

Anythoughts ??

[TranceforLife · Accepted solution]

Have you seen this KB:

https://live.paloaltonetworks.com/t5/Learning-Articles/DotW-Send-ICMP-Unreachable-PAN-OS-7-0/ta-p/63...

[BPry]

@Alex_Samad,

You really shouldn't have a catchall rule that has this feature enabled unless it's soley for known traffic, you should never send icmp-unreachables to an unknown service. 

[Alex_Samad]

Have you seen this KB:

https://live.paloaltonetworks.com/t5/Learning-Articles/DotW-Send-ICMP-Unreachable-PAN-OS-7-0/ta-p/63...

explains it

thanks