Pings and PIX messages 302020: Built ICMP - 302021: Teardown ICMP Lots of them....

Discussion in 'Cisco' started by Scott Townsend, May 1, 2006.

  1. Scott Townsend

    Scott Townsend Guest

    On my Edge Router I have an Access list for ICMP as follows:

    access-list 103 permit icmp any any time-exceeded
    access-list 103 permit icmp any any port-unreachable
    access-list 103 deny icmp any any
    access-list 103 deny icmp any 0.0.0.0 255.255.255.0
    access-list 103 deny icmp any 0.0.0.255 255.255.255.0
    access-list 103 deny icmp any any redirect


    On the PIX Firewall, I have the Following:

    access-list acl_outside extended permit icmp any any echo-reply
    access-list acl_outside extended permit icmp any any time-exceeded
    access-list acl_outside extended permit icmp any any unreachable

    On my PIX log I get hundreds of the Following

    %PIX-6-302020: Built ICMP connection for faddr 82.160.189.125/0 gaddr
    A.B.C.D/0 laddr 10.10.3.10/0
    %PIX-6-302021: Teardown ICMP connection for faddr 83.79.179.113/0 gaddr
    A.B.C.D/0 laddr 10.10.3.10/0

    The Address A.B.C.D/0 laddr 10.10.3.10/0 has been caught using a Sharing
    program. I've turned off Port 6346/6347 on the Edge Router, but I'm still
    getting the Built and Teardowns.

    I would like to be able to Initiate a Ping out from the 10.1.1.0/24, but not
    a from anywhere else and would like to not allow anyone to Ping us.

    What should I change?

    Thanks,
    Scott<-
     
    Scott Townsend, May 1, 2006
    #1

    1. Advertisements

  2. Scott Townsend

    Walter Roberson Guest

    Which direction is that applied on?
    In the ACL applied out,

    permit icmp 10.1.1.0 0.0.0.255 any echo

    In the ACL applied in,

    permit icmp any PUBLIC_IP PUBLIC_MASK echo-reply

    [PUBLIC_IP PUBLIC_MASK for the case where you are NAT'ing, which you
    need to be doing because RFC1918 does not allow you to source packets
    in any of the reserved IP ranges past the edge of your network.]
     
    Walter Roberson, May 2, 2006
    #2

    1. Advertisements

  3. Scott Townsend

    Scott Townsend Guest

    Which direction is that applied on?
    interface MFR0.672 point-to-point
    description WAN to SBC Internet Service
    ip access-group 103 in


    So should I be applying this to the MFR0 or Ethernet Interface??


    I think I have a Few Issues.

    I guess I Have to assign a Static NAT IP to the Users I want to be able to
    Ping so the Edge Router knows who to let have the Ping Replies.

    Since the Edge router is not doing the NAT, I have a PIX behind it, it cant
    know which of the Public IPs is in the 10.1.1.0/24 network.

    Hmmm...

    Thank you!

     
    Scott Townsend, May 4, 2006
    #3

    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.
Similar Threads

  1. Allow Traceroutes Out to internet, no Pings/traces in. On Both PIX and 2610

  2. 302014: Teardown TCP connection on pix 515

  3. Does anyone know them or has any experience with them (good or bad)?

  4. Teardown TCP conn...... Flow closed by inspection

  5. ACL: Does "permit IP" allow ICMP traffic like pings?

  6. Compacting 5,000 Messages, Moving Them To A Google Account, And Burning Them Onto A CD

  7. Up->Down messages related to ip sla icmp-echo when there are noapparent network issues

  8. Why do my photos come out sidewards when I play them on my DVD eventhough I have rotated them on my

Loading...