Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
New Member

ICMP Type 3 error messages from PIX 501

when I turn on "debug icmp trace" on my PIX 501, I see a contiguous stream of the following:

210: ICMP unreachable (code 3) kevin7 > 192.168.69.1

211: ICMP unreachable (code 3) kevin7 > 192.168.69.1

212: ICMP unreachable (code 3) kevin7 > 192.168.69.1

213: ICMP unreachable (code 3) kevin7 > 192.168.69.1

214: ICMP unreachable (code 3) kevin7 > 192.168.69.1

215: ICMP unreachable (code 3) kevin7 > 192.168.69.1

216: ICMP unreachable (code 3) kevin7 > 192.168.69.1

217: ICMP unreachable (code 3) kevin7 > 192.168.69.1

218: ICMP unreachable (code 3) kevin7 > 192.168.69.1

219: ICMP unreachable (code 3) kevin7 > 192.168.69.1

220: ICMP unreachable (code 3) kevin7 > 192.168.69.1

221: ICMP unreachable (code 3) kevin7 > 192.168.69.1

222: ICMP unreachable (code 3) kevin7 > 192.168.69.1

223: ICMP unreachable (code 3) kevin7 > 192.168.69.1

224: ICMP unreachable (code 3) kevin7 > 192.168.69.1

Understand that the address 192.168.69.1 is the inside address of the PIX itself. Kevin7 is a workstation in the same 192.68.69 network... his address is .120.

What does this mean?

thx

3 REPLIES

Re: ICMP Type 3 error messages from PIX 501

Can you please post the outpuf of show run | inc icmp

It looks like the kevin7 is trying to ping your PIX and the PIX might not have icmp enabled on the inside interface

New Member

Re: ICMP Type 3 error messages from PIX 501

Yes here is the output of the "sho run | inc icmp" as requested:

kmnrfw1# sho run | inc icmp

access-list outside_in permit icmp any any echo-reply

access-list outside_in permit icmp any any source-quench

access-list outside_in permit icmp any any unreachable

access-list outside_in permit icmp any any time-exceeded

kmnrfw1#

I am not sure why the box called Kevin7 would be continously pinging the Gateway like that??

Thanks

New Member

Re: ICMP Type 3 error messages from PIX 501

I saw this a couple of days ago on a client's network. The client's CSC module failed on his ASA and during the troubleshooting process, I discovered this was happening. I am at a loss as to explain why this is happening. This is not a false report by the PIX/ASA in my opinion, cos when we unplugged the PC, the icmp messages stop. I do find it strange that only icmp unreachable messages are flooding the interface. Could this be some sort of an attack? Has anyone else ever seen this behavior before?

Bryan

571
Views
0
Helpful
3
Replies
CreatePlease to create content