Cisco ASA 5505 - Manual (Page 750)

37-10
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter 37 Configuring Management Access
Configuring ICMP Access
Configuring ICMP Access
By default, you can send ICMP packets to any ASA interface using either IPv4 or IPv6. This section tells
how to limit ICMP management access to the ASA. You can protect the ASA from attacks by limiting
the addresses of hosts and networks that are allowed to have ICMP access to the ASA.
Note For allowing ICMP traffic through the ASA, see Chapter 34, “Configuring Access Rules.”
This section includes the following topics:
• Information About ICMP Access, page 37-10
• Licensing Requirements for ICMP Access, page 37-10
• Guidelines and Limitations, page 37-10
• Default Settings, page 37-11
• Configuring ICMP Access, page 37-11
Information About ICMP Access
ICMP in IPv6 functions the same as ICMP in IPv4. ICMPv6 generates error messages, such as ICMP
destination unreachable messages and informational messages like ICMP echo request and reply
messages. Additionally ICMP packets in IPv6 are used in the IPv6 neighbor discovery process and path
MTU discovery.
We recommend that you always grant permission for the ICMP unreachable message type (type 3).
Denying ICMP unreachable messages disables ICMP path MTU discovery, which can halt IPsec and
PPTP traffic. See RFC 1195 and RFC 1435 for details about path MTU discovery.
If you configure ICMP rules, then the ASA uses a first match to the ICMP traffic followed by an implicit
deny all entry. That is, if the first matched entry is a permit entry, the ICMP packet continues to be
processed. If the first matched entry is a deny entry or an entry is not matched, the ASA discards the
ICMP packet and generates a syslog message. An exception is when an ICMP rule is not configured; in
that case, a permit statement is assumed.
Licensing Requirements for ICMP Access
The following table shows the licensing requirements for this feature:
Guidelines and Limitations
This section includes the guidelines and limitations for this feature.
Context Mode Guidelines
Supported in single and multiple context mode.
Model License Requirement
All models Base License.