Firewall stateful handling of ICMP packets

Henry Linneweh hrlinneweh at
Thu Dec 4 00:25:14 UTC 2003

there are expert modes where you can apply the
name source destination protocol time comments.  rank state action track
for more stabilized dedicated connections
I am certain there are more depending on the vender

Sean Donelan <sean at> wrote:

You could drop ICMP packets at your firewall if the firewalls properly
implemented stateful inspection of ICMP packets. The problem is few
firewalls include ICMP responses in their statefull analysis. So you are
left with two bad choices, permit "all" ICMP packets or deny "all" ICMP

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>

More information about the NANOG mailing list