Allowing ICMP Destination Unreachable Fragmentation Required

WesEvernden — Mon, 09 Nov 2020 20:13:46 GMT

Hi,

I am trying to figure out how I let ICMP Type 3 Code 4 (Fragmentation Needed) packets back to the original sender that needs to reduce its MTU. What's not clear to me is if these are allowed when ICMP stateful inspection is enabled.

These ICMP packets do contain the original headers in the payload, if the FW is parsing down in to the payload, finding the original tcp/udp connection details, checking it's state table and dropping with "ICMP error does not match an existing connection" then I know the tcp/udp session is not on that same FW.

Thanks,

-Wes

Re: Allowing ICMP Destination Unreachable Fragmentation Required

PhoneBoy — Mon, 09 Nov 2020 21:32:46 GMT

Believe these are generally blocked without an explicit rule to enable them.

topic Allowing ICMP Destination Unreachable Fragmentation Required in General Topics

Allowing ICMP Destination Unreachable Fragmentation Required

Re: Allowing ICMP Destination Unreachable Fragmentation Required