Hi All,
I was testing a new access control policy with a single rule that permits ICMP application traffic from my inside network to the outside (see attached screenshot).
As expected, ICMP traffic such as ping, traceroute etc works without any issues and all other traffic is blocked (default action is to block). However, I tested a telnet to an external Web server that I manage on port 80 from an internal host and the connection opened which was unexpected. I checked the FTD and I could see the corresponding connection (using show conn detail) and the destination server also shows the established connection.
Has anyone experienced odd behaviours with the ICMP application detector before?
I also checked the behaviour using packet-tracer as follows and the result is a match of access rule Permit ICMP
> packet-tracer input inside tcp 10.1.31.101 1000 172.16.100.1 80
Phase: 1
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop x.x.x.x using egress ifc outside
Phase: 2
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group CSM_FW_ACL_ global
access-list CSM_FW_ACL_ advanced permit ip ifc inside any ifc outside any rule-id 268440576
access-list CSM_FW_ACL_ remark rule-id 268440576: ACCESS POLICY: Corporate_Policy - Mandatory
access-list CSM_FW_ACL_ remark rule-id 268440576: L7 RULE: Permit ICMP
Additional Information:
This packet will be sent to snort for additional processing where a verdict will be reached
Thanks
