Cisco PIX 520 - PIX Firewall 520 Online Help Manual page 63

System Properties>PIX
Administration>ICMP
The System Properties>PIX Administration>ICMP panel allows configuration of rules which permit only
specific hosts or networks to communicate with the PIX Firewall unit using the Internet Control Message
Protocol (ICMP) protocol.
The following sections are included in this Help topic:
Field Descriptions
Adding Rules
Editing Rules
Deleting Rules
Applying Changes to the PIX Firewall
The ICMP protocol enables a network device to ping an IP address in order to discover the presence, identity, and
function of other devices and to test intermediate communications links. When a device receives a ping (request),
it can respond with an echo which includes its name, function, and other information. Routers can discover each
other in this way. Administrators also use pinging directly in network management applications and diagnostic
tools, such as the PDM Ping
The ICMP panel can enable or disable the ping response or echo of an interface on the PIX Firewall. When
pinging is disabled, the PIX Firewall cannot be detected by other devices or software applications. However,
"friendly" hosts, such as a PC running PDM or neighboring router may need to ping the PIX Firewall. This
feature is also referred to as configurable proxy pinging.
The rule table configures an access-list command statement that permits or denies ICMP traffic terminating at the
PIX Firewall unit. A permit or deny action is specified for each interface which is added to the rule table. If no
interfaces are added to the rule table, the default action for each interface is to permit ICMP traffic.
When an interface receives an ICMP packet, the PIX Firewall searches the access list. If the first matched entry is
a permit entry, the ICMP packet continues to be processed. If the first matched entry is a deny entry or an entry is
not matched, PIX Firewall discards the ICMP packet and generates the %PIX-3-313001 syslog message. An
exception is when an ICMP access-list command statement is not configured; then, permit is assumed.
Cisco recommends that you grant permission for ICMP unreachable message type (type 3). Denying ICMP
unreachable messages disables ICMP Path MTU discovery, which can halt IPSec and PPTP traffic. See RFC
1195 and RFC 1435 for details about Path MTU Discovery.
tool.