How to limit ICMP on the PIX firewall.

[terblac]

Good day guys!!

I have some dilema with regards to limiting ICMP from inside users traversing to other networks such as other DMZs.

I know that in order to let ICMP to pass thru the interfaces you have to create an ACL such as the one below:

access-list DMZACL permit icmp any any

Users would require this config to ping a server on the DMZ but this is a security risk.

In order to minimize I have a created object groups to identify what hosts and networks is allowed to have access to echo-replies.

Still this is an issue since there a lot of host who do extended pings just to monitor the connectivity of the server and it's application.

Do you guys have other ideas?

Such as limiting the echo-replies on the PIX. Like letting the first 5 echo request succeed with 5 echo-replies and the rest would be dropped.

Could this be done?

Thanks,

Chris

[Fernando_Meza · Accepted solution]

Hi .. I don't think you can do this using an ACL on the PIX however, you might be able to stop ICMP sweeps by enabling the IDS signatures using te ip audit command .. for more information refer to the below link

Usage Guidelines Cisco Intrusion Detection System (Cisco IDS) provides the following for IP-based systems:

? Traffic auditing. Application-level signatures will only be audited as part of an active session.

? Applies the audit to an interface.

? Supports different audit policies. Traffic matching a signature triggers a range of configurable

actions.

? Disables the signature audit.

? Enables IDS and still disables actions of a signature class (informational, attack).

Auditing is performed by looking at the IP packets as they arrive at an input interface, if a packet triggers

a signature and the configured action does not drop the packet, then the same packet can trigger other

signatures.

PIX Firewall supports both inbound and outbound auditing.

For a complete list of supported Cisco IDS signatures, their wording, and whether they are attack or

informational messages, refer to Cisco PIX Firewall System Log Messages.

Refer to the Cisco Secure Intrusion Detection System Version 2.2.1 User Guide for detailed information

on each signature. You can view the ?NSDB and Signatures? chapter of this guide at the following

website:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids1/csidsug/sigs.htm