Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
WesEvernden
Participant

Allowing ICMP Destination Unreachable Fragmentation Required

Hi, 

I am trying to figure out how I let ICMP Type 3 Code 4 (Fragmentation Needed) packets back to the original sender that needs to reduce its MTU.  What's not clear to me is if these are allowed when ICMP stateful inspection is enabled.

These ICMP packets do contain the original headers in the payload, if the FW is parsing down in to the payload, finding the original tcp/udp connection details, checking it's state table and dropping with "ICMP error does not match an existing connection"  then I know the tcp/udp session is not on that same FW.

Thanks,

-Wes

0 Kudos
1 Reply
PhoneBoy
Admin
Admin

Believe these are generally blocked without an explicit rule to enable them.

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events