Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
New Member

ICMP thru FWSM

Hi,

we have a set of FWSM running 3.2(1)

Rules are set to allow ICMP both inbound and outbound.

However traceroute gives some unexpected results, half of the hosts do not respond. It also produces the following message in the log.

%FWSM-4-313004:Denied ICMP type=icmp_type, from source_address oninterface interface_name to dest_address:no matching session

ICMP packets were dropped by the security appliance because of security checks added by the stateful ICMP feature that are usually either ICMP echo replies without a valid echo request already passed across the security appliance or ICMP error messages not related to any TCP, UDP, or ICMP session already established in the security appliance.

Any idea what can I do to fix this. I am not worried about the syslog message, I can always filter these out. But I need reliable traceroute.

Thank you,

Remy

5 REPLIES
New Member

Re: ICMP thru FWSM

Hi,

Can you please try configuring the inspection for the icmp_error and please let me know if this fix your problem.Also don't forget have icmp allow ACL's from source to destination in dual direction.

Regards,

Magesh

New Member

Re: ICMP thru FWSM

Hi,

I set icmp and icmp error inspection, ALCs allow icmp from source to destination.

Still, traceroute traffic get somewhat disrupted. It is also inconsistent. Several attempts few minutes appart do not lead to the same result.

I talked to TAC about this, and was informed of a bug ID. Expected to be addressed in next release.

Remy

New Member

Re: ICMP thru FWSM

Hi,

Thanks for the update.please let us know what is the current version used and the bug ID and also what new version TAC suggested.This would be helpful.

New Member

Re: ICMP thru FWSM

Our FWSM is currenlty running version 3.2(1)

The bug ID TAC gave me is: CSCsj53485

From what I was told, this affects version 3.1(5) and 3.1(6) and will be addressed in 3.1(7)

It seems it also affects 3.2(1) and will be addressed in 3.2(2)

I do not have a timeframe for resolution.

Regards,

Remy

New Member

Re: ICMP thru FWSM

Thanks for your detailed update.

1033
Views
3
Helpful
5
Replies
CreatePlease to create content