Technical Tip: Enable or disable inspecting IPv4 and IPv6 ICMP traffic
Description
This article describes how to enable or disable inspection of IPv4 and IPv6 ICMP traffic without affecting TCP and UDP traffic. In order for the inspection of asymmetric ICMP traffic to not affect TCP and UDP traffic, a pair of settings have been added that can enable/disable the inspection of ICMP traffic being routed asymmetrically for both IPv4 and IPv6.
Scope
FortiGate.
Solution
The syntax in the CLI for configuring the setting is:
IPv4
IPv4
config system settings
set asymroute-icmp enable/disable
end
IPv6
config system settings
set asymroute6-icmp enable/disable
end
Note:
As of v7.6.5 and later, the default setting for 'asymroute-icmp and asymroute6-icmp' has changed from disabled to enabled (in earlier FortiOS versions, the default setting for this was disabled).