How to block ICMP Type 3 Code 3 messages : udp port 161 unreachable

Forum|Forum|10 years ago
August 19, 2016
4 replies
8458 views

Hi,

I need to block just ICMP Type 3 Code 3 messages (port unreachable) getting from PC1.

PC1==Port4--[FGT-300D]--Port1==PC2

I have created a custom Service ICMP_type3_code3 ans a policy to deny traffic from PC1 to PC2. But still those ICMP are allowed.

The command : diagnose sniffer packet any "host PC1 and PC2" 4

shows the message "port1 out PC1 -> PC2: icmp: PC1 udp port 161 unreachable"

I have the same result when I denied ICMP_ALL.

Can anyone lt me know ho fix that, please ?

Many tnaks.

Abmas

emnoc

New Member

the cli diag debug flow is your best friend. This will ensure your fw-policy and the right matching ingress/egress interfaces are actually matched.

jhouvenaghel_FTNT

Staff

Hello,

This ICMP packet is to reply to a udp packet port 161 received by PC1. So there is first a udp session open on FGT by this udp packet coming from PC2 and this ICMP reply is part of this session. When received by the FGT, the FGT will look inside the ICMP packet, will find the UDP header/payload inside this ICMP packet and it will match an existing session. So it will go through the FGT. You can not block this packet with a deny policy from port4 to port1 as it is a reply packet to an existing session on the FGT

Thanks

ede_pfau

SuperUser

But if you blocked udp/161, wouldn't the ICMP messages stop then? Depends on which device generates the message, and I think it's the second PC which refuses requests to udp/161 and replies with "port unreachable".

Sign up

Login with SSO

Login to the community

Login with SSO