Cisco Support Community
Community Member

ICMP unreacheble, rate-limit

Hi !

I'm currently working on projet of network hardening.

Based on Cisco security best pratice, I see it's recommand to rate limit genaration of ICMP unreachable message to prevent DoS attack. (according to document : page 74)

On Catalyst 6509 run IOS 12.2(17r)SX5 I see to possible way to rate-limit ICMP messages if mls QoS is running.

1- mls rate-limit unicast ip ICMP unreachable acl-drop 100 10 (enable by default, according to document : page 74)


mls rate-limit unicast ip ICMP unreachable no-route 100 10

2- ip ICMP rate-limit unreachable <millisecond> (500 ms is default parameters, which permit 2 paquets per seconds, also enable by default if I'm base on :, ACL for IOS section)

Which one of those command have precedence over the other one ?

Which one is better over the other one ?

With the mls rate-limit option, we have the possibility to check default parameter with : "show mls rate-limit" command is exist equivalent for : "ip ICMP rate-limit unreachable"

We have also Catalyst 3550 switches, on which we have to rate-limit genaration of ICMP unreachable message for same reason as 6509. I understand the :"ip ICMP rate-limit unreachable" command is my only option "under "mls " the only option I have is QoS or aclmerge. Under thoses parameter I have no way to rate-limit ICMP message generation....

I have check in running-configuration I did not find any reference to ICMP rate-limit command, I hope this is active like explain in document, ACL for IOS section, (Version 12.2(44)SE3) but I would like to be able to confirm if any show command exist to confirm this.

thanks a lot !

CreatePlease to create content