ICMP redirect passing through FW

Forum|Forum|3 years ago
July 21, 2023
3 replies
4074 views

Hello community,

I have TCP443 communication that goes from my local network through NAT outside. On a way to destination, it is stopped and ICMP redirect is sent back. It comes on my VIP which is mapped from TCP443 to TCP443. Then there is FW policy that is allowing only TCP443, but the ICMP packet still passes. How is that possible?

Thanks everyone for any help.

FortiGate

ebilcari

Staff

If I get it right, in this case is not the server who is responding to the ICMP requests, most probably it's the FGT itself. To disable this go under WAN interface and disable the PING checkbox:

or disable only this ICMP type from the CLI in port level:

GW (port1) # set icmp-accept-redirect disable

Emirjon

pminarik

Staff

In general, ICMP replies to allowed TCP/UDP traffic are automatically allowed. This is a good thing. The ICMP messages contain the initial part of the packet being replied to, so the FortiGate is able to match the ICMP reply packet to the existing allowed traffic session.

thousand

New Member

This is something I am currently experiencing as well. I think this is probably the behavior of the URL below. However, I don't know how to stop it.

https://community.fortinet.com/t5/FortiGate/Technical-Note-ICMP-packets-processing-by-the-firewall-policy-on/ta-p/192778

Sign up

Login with SSO

Login to the community

Login with SSO