disable the icmp on the edge asr1001 facing internet

raymond wang · ‎01-19-2015

Hello,

Since the asr 1001 is facing the internet i would like to disable the ping for security purpose. I understand I can create a ACL to stop the ping packets from internet. Once concern is this might cause the capacity issue.

Is there any other ways to disable the ping on the asr1001?

Thanks

Ray

Reza Sharifi · ‎01-19-2015

Hi,

Is should not cause capacity issue. You can create an access-list and apply it to the interface facing the internet and block ICMP. It should be in "in" direction and also make sure you have all your permit statements before you putting in the deny statements.

HTH

raymond wang · ‎01-19-2015

ok. If that is the case, I do not worry about it then.

Thanks to reply.

Bilal Nawaz · ‎01-19-2015

For Internet edge, the ASRs I have configured out there have had ZBFW to protect the SELF zone as well as some inside zones.

If you are in to security like me and run some vulnerability scans (Qualys) in my case the results came back completely clean.

If it is only pings you want to stop a simple ACL will do but normally one would think about protecting the router in other ways too.

e.g. CoPP, ZBFW

Please rate useful posts & remember to mark any solved questions as answered. Thank you.