Staff & Editor

Technical Tip: Blocking ICMP Unreachable Messages on FortiSwitch

Forum|Forum|1 year ago
April 4, 2025
0 replies
669 views

Description

This article describes how to configure FortiSwitch to filter ICMP type 3 messages (for the contextual sake ICMP Type 3 code 3 will be blocked) on FortiSwitch to avoid them from reaching FortiGate.

To block ICMP Unreachable messages (Type3) due to security reasons (e.g. preventing BlackNurse attack):

Type 3 Code 0 - Destination Unreachable Network Unreachable
Type 3 Code 1 - Destination Unreachable Host Unreachable
Type 3 Code 3 - Destination Unreachable Port Unreachable
Type 3 Code 4 - Destination Unreachable Fragmentation Needed and Don't Fragment was Set

Check the article Troubleshoot Tip: How ip-conn Log ID 0000000011 dns logs are generated to understand how FortiGate ip-conn app='DNS' logs are generated.

Scope

FortiSwitch.

Solution

The following diagram shows how FortiSwitch and FortiGate connect.

network diagram.PNG

If for example, an ICMP packet with Type 3 and code 1 reaches FortiGate (FG01) it will generate a ip-conn log message as described in the article Troubleshoot Tip: How ip-conn Log ID 0000000011 dns logs are generated

If FortiGate is connected to a FortiAnalyzer and has multiple computers generating such ICMP messages FortiAnalyzer will have multiple logs 'IP Connection error'.

faz ip-conn fields.png

Add the following command on FortiSwitch to block ICMP Type 3 code 3. Codes 0, ,1, and 4 can also be added if necessary.

FortiSwitch01# config switch acl service custom
edit "ICMP_Type3"
set protocol ICMP
set icmptype 3
set icmpcode 3
next
end

FortiSwitch01# config switch acl ingress
edit 1
config action
set count enable
set drop enable
end
config classifier
set service "ICMP_Type3"
end
set ingress-interface-all enable
next
end