PIX drops ICMP with less than 20 bytes of payload

alexhopkins · ‎02-20-2008

Hi, I'm having the following issue: there's an application that pings a host with 5-byte pings. The PIX (7.2 software) won't forward pings unless they have at least 20 bytes of payload. I can also generate the pings with the DOS command ping x.x.x.x -l 5, which pings with 5 bytes of payload, with the same results. Any ideas?

abinjola · ‎02-20-2008

is this ICMP request to the Pix interfaces or passing through/transitting the Pix ?

alexhopkins · ‎02-21-2008

Both. If I ping the interface with a 20-byte ping, it works. With a 19-byte ping or smaller, it doesn't. Same thing for anything beyond the PIX. Other hosts connected to the same switch as the near-end interface of the PIX respond fine to the small pings, so I don't think it's the switch or anything before it that's dropping the pings.

Thanks,

Alex.

abinjola · ‎02-21-2008

Remove any "ip audit interface command from the config