Explorer III

Solved

Difference in ICMP and Ping Service

hi,

i'm trying to configure a new FW policy and just wanted to know the difference between ICMP and Ping service.

1.which is best practice to use/choose?

2.if i need to clone/edit a custom ping or icmp service, i.e. echo reply, which service do i use/edit (icmp vs ping)?

3.what is also the difference between the "traceroute" service vs the custom ping "time exceeded" (type:11,code:0).

Best answer by dingjerry_FTNT

Hi @johnlloyd_13 ,

A simple and quick answer is: ICMP is a protocol, and Ping is a utility or command line tool using the ICMP protocol.

Here is the full list of all ICMP types and codes:

1.which is best practice to use/choose?

For Ping, you can apply either ICMP or Ping services. Both are predefined ones on FGT.

I would recommend you use ICMP if you are allowing or denying other ICMP based services, such as tracert, pathPing, Hping, and so on.

2.if i need to clone/edit a custom ping or icmp service, i.e. echo reply, which service do i use/edit (icmp vs ping)?

You may clone the Ping service object and modify it. You can get the ICMP type and code info from the link I provided above.

3.what is also the difference between the "traceroute" service vs the custom ping "time exceeded" (type:11,code:0).

If you check the link I provided above, you will find:

traceroute (Linux command) or tracert (Windows command): ICMP type 30 and you may leave code blank

"time exceeded" : ICMP type 11 and code 0

Staff

Hi @johnlloyd_13 ,

A simple and quick answer is: ICMP is a protocol, and Ping is a utility or command line tool using the ICMP protocol.

Here is the full list of all ICMP types and codes:

1.which is best practice to use/choose?

For Ping, you can apply either ICMP or Ping services. Both are predefined ones on FGT.

I would recommend you use ICMP if you are allowing or denying other ICMP based services, such as tracert, pathPing, Hping, and so on.

2.if i need to clone/edit a custom ping or icmp service, i.e. echo reply, which service do i use/edit (icmp vs ping)?

You may clone the Ping service object and modify it. You can get the ICMP type and code info from the link I provided above.

3.what is also the difference between the "traceroute" service vs the custom ping "time exceeded" (type:11,code:0).

If you check the link I provided above, you will find:

traceroute (Linux command) or tracert (Windows command): ICMP type 30 and you may leave code blank

"time exceeded" : ICMP type 11 and code 0

Sign up