Allowing ICMP Destination Unreachable Fragmentation Required

[WesEvernden]

Hi, 

I am trying to figure out how I let ICMP Type 3 Code 4 (Fragmentation Needed) packets back to the original sender that needs to reduce its MTU.  What's not clear to me is if these are allowed when ICMP stateful inspection is enabled.

These ICMP packets do contain the original headers in the payload, if the FW is parsing down in to the payload, finding the original tcp/udp connection details, checking it's state table and dropping with "ICMP error does not match an existing connection"  then I know the tcp/udp session is not on that same FW.

Thanks,

-Wes

[PhoneBoy]

Believe these are generally blocked without an explicit rule to enable them.