Explorer

Solved

Blocks ICMP Error Reporting Packets

4 replies
1710 views

How Fortinet Blocks ICMP Error Reporting Packets

thanks.

FortiGate

ZhuoAnswer

Explorer

The test topology is as follows:

The L3 layer switch will tell the fortigate Unreachable, and what we have to do is not to interfere with the L3 layer switch sending the packet to the fortigate. We need to reject the Unreachable packet in the fortigate (equivalent to forwarding traffic).

I have tested the results. Firewall ACL is used in fortigate to prevent Unreachable from being sent to the client. Note: It is not a firewall policy, but a firewall ACL. Just define the icmp service type3 code1.

ebilcari

Staff

You can check this article that covers this topic more in detail.

Emirjon

ZhuoAuthorAnswer

Explorer

The test topology is as follows:

The L3 layer switch will tell the fortigate Unreachable, and what we have to do is not to interfere with the L3 layer switch sending the packet to the fortigate. We need to reject the Unreachable packet in the fortigate (equivalent to forwarding traffic).

I have tested the results. Firewall ACL is used in fortigate to prevent Unreachable from being sent to the client. Note: It is not a firewall policy, but a firewall ACL. Just define the icmp service type3 code1.

ebilcari

Staff

Thanks for sharing your findings. This looks like another elegant way of achieving the same result using a custom service and ACL:

Emirjon

ZhuoAuthor

Explorer

The test topology is as follows:

The L3 layer switch will tell the fortigate Unreachable, and what we have to do is not to interfere with the L3 layer switch sending the packet to the fortigate. We need to reject the Unreachable packet in the fortigate (equivalent to forwarding traffic).

I have tested the results. Firewall ACL is used in fortigate to prevent Unreachable from being sent to the client. Note: It is not a firewall policy, but a firewall ACL. Just define the icmp service type3 code1.

Sign up

Login with SSO

Login to the community

Login with SSO