Cisco ASA Series Cli Configuration Manual page 1004

Configuring ICMP Access
Model License Requirement
All models Base License.
Configuring ICMP Access
By default, you can send ICMP packets to any ASA interface using either IPv4 or IPv6. This section tells
how to limit ICMP management access to the ASA. You can protect the ASA from attacks by limiting
the addresses of hosts and networks that are allowed to have ICMP access to the ASA.
Note
For allowing ICMP traffic through the ASA, see
This section includes the following topics:
•
•
•
•
•
Information About ICMP Access
ICMP in IPv6 functions the same as ICMP in IPv4. ICMPv6 generates error messages, such as ICMP
destination unreachable messages and informational messages like ICMP echo request and reply
messages. Additionally ICMP packets in IPv6 are used in the IPv6 neighbor discovery process and path
MTU discovery.
We recommend that you always grant permission for the ICMP unreachable message type (type 3).
Denying ICMP unreachable messages disables ICMP path MTU discovery, which can halt IPsec and
PPTP traffic. See RFC 1195 and RFC 1435 for details about path MTU discovery.
If you configure ICMP rules, then the ASA uses a first match to the ICMP traffic followed by an implicit
deny all entry. That is, if the first matched entry is a permit entry, the ICMP packet continues to be
processed. If the first matched entry is a deny entry or an entry is not matched, the ASA discards the
ICMP packet and generates a syslog message. An exception is when an ICMP rule is not configured; in
that case, a permit statement is assumed.
Licensing Requirements for ICMP Access
The following table shows the licensing requirements for this feature:
Model License Requirement
All models Base License.
Cisco ASA Series CLI Configuration Guide
1-10
Information About ICMP Access, page 1-10
Licensing Requirements for ICMP Access, page 1-10
Guidelines and Limitations, page 1-11
Default Settings, page 1-11
Configuring ICMP Access, page 1-12
Chapter 1 Configuring Management Access
Chapter 1, "Configuring Access Rules."