PIX drops ICMP with less than 20 bytes of payload

Unanswered Question
Feb 20th, 2008
User Badges:

Hi, I'm having the following issue: there's an application that pings a host with 5-byte pings. The PIX (7.2 software) won't forward pings unless they have at least 20 bytes of payload. I can also generate the pings with the DOS command ping x.x.x.x -l 5, which pings with 5 bytes of payload, with the same results. Any ideas?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
abinjola Wed, 02/20/2008 - 21:02
User Badges:
  • Cisco Employee,

is this ICMP request to the Pix interfaces or passing through/transitting the Pix ?

alexhopkins Thu, 02/21/2008 - 12:11
User Badges:

Both. If I ping the interface with a 20-byte ping, it works. With a 19-byte ping or smaller, it doesn't. Same thing for anything beyond the PIX. Other hosts connected to the same switch as the near-end interface of the PIX respond fine to the small pings, so I don't think it's the switch or anything before it that's dropping the pings.



abinjola Thu, 02/21/2008 - 12:43
User Badges:
  • Cisco Employee,

Remove any "ip audit interface command from the config


This Discussion