-1

We want to block any ICMP requests that are initiated to our network from the public internet. I ran icmp deny any outside, but when I do that, it takes down our internet - nobody can load web pages. Removing it by running no icmp deny any outside fixes the problem. What am I missing here?

0

1 Answer 1

3

What you're missing is: First, ICMP, at least in part, is required for proper functioning of the Internet. Second, blocking pings is completely pointless; it has no security benefits whatsoever, and can cause you trouble later on when you decide you need to be able to ping your device from outside for troubleshooting or other reasons.

If you're really determined to "block pings" directed at your ASA then you can do that by specifying the ICMP type (echo-request, which Cisco for some reason simply calls echo) you want to block.

icmp deny any echo outside
2
  • Same issue when I run that command. Could someone not reflect ping responses using a spoofed IP if we don't block it? Thanks
    – sa289
    Mar 10, 2016 at 1:15
  • 1
    Something very strange is wrong with your setup if you lost connectivity by running that. As for "reflect ping responses using a spoofed IP" it doesn't matter as the ASA won't respond to broadcast pings by default. There's nothing you need to do. Unicast pings aren't an issue since there's no way to amplify it. Mar 10, 2016 at 1:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .