Disabling Icmp Messages - Foundry Networks FESX Manual

all ones in the host portion of the address. To accommodate this type of host, you can enable the Layer 3 Switch
to treat IP packets with all zeros in the host portion of the destination IP address as broadcast packets.
NOTE: When you enable the Layer 3 Switch for zero-based sub-net broadcasts, the Layer 3 Switch still treats IP
packets with all ones the host portion as IP sub-net broadcasts too. Thus, the Layer 3 Switch can be configured to
support all ones only (the default) or all ones and all zeroes.
NOTE: This feature applies only to IP sub-net broadcasts, not to local network broadcasts. The local network
broadcast address is still expected to be all ones.
To enable the Layer 3 Switch for zero-based IP sub-net broadcasts in addition to ones-based IP sub-net
broadcasts, enter the following command.
FESX424 Router(config)# ip broadcast-zero
Syntax: [no] ip broadcast-zero

Disabling ICMP Messages

Foundry devices are enabled to reply to ICMP echo messages and send ICMP Destination Unreachable
messages by default.
You can selectively disable the following types of Internet Control Message Protocol (ICMP) messages:
• Echo messages (ping messages) – The Layer 3 Switch replies to IP pings from other IP devices.
• Destination Unreachable messages – If the Layer 3 Switch receives an IP packet that it cannot deliver to its
destination, the Layer 3 Switch discards the packet and sends a message back to the device that sent the
packet to the Layer 3 Switch. The message informs the device that the destination cannot be reached by the
Layer 3 Switch.
Disabling Replies to Broadcast Ping Requests
By default, Foundry devices are enabled to respond to broadcast ICMP echo packets, which are ping requests.
To disable response to broadcast ICMP echo packets (ping requests), enter the following command:
FESX424 Router(config)# no ip icmp echo broadcast-request
Syntax: [no] ip icmp echo broadcast-request
If you need to re-enable response to ping requests, enter the following command:
FESX424 Router(config)# ip icmp echo broadcast-request
Disabling ICMP Destination Unreachable Messages
By default, when a Foundry device receives an IP packet that the device cannot deliver, the device sends an ICMP
Unreachable message back to the host that sent the packet. You can selectively disable a Foundry device's
response to the following types of ICMP Unreachable messages:
• Administration – The packet was dropped by the Foundry device due to a filter or ACL configured on the
device.
• Fragmentation-needed – The packet has the Don't Fragment bit set in the IP Flag field, but the Foundry
device cannot forward the packet without fragmenting it.
• Host – The destination network or sub-net of the packet is directly connected to the Foundry device, but the
host specified in the destination IP address of the packet is not on the network.
• Port – The destination host does not have the destination TCP or UDP port specified in the packet. In this
case, the host sends the ICMP Port Unreachable message to the Foundry device, which in turn sends the
message to the host that sent the packet.
• Protocol – The TCP or UDP protocol on the destination host is not running. This message is different from
the Port Unreachable message, which indicates that the protocol is running on the host but the requested
protocol port is unavailable.
December 2005 © Foundry Networks, Inc.
Configuring IP
16 - 31