Technical Tip: Block ICMP request originated from the firewall

[srajeswaran]

Description	This article describes the case where it is required to block ICMP requests originating from the Firewall to specific destinations/geolocations. A FortiGate administrator can use interface-policy along with a custom-IPS signature. This article describes how to configure FortiGate to block ICMP requests towards 8.8.8.8.
Scope	All FortiGate versions.
Solution	Configuring IPS signatures to match ICMP requests: config ips custom     edit "ICMP-Block-custom"         set signature "F-SBID( --attack_id 1234; --name ICMP-Block-          custom; --protocol ICMP; --flow from_client; )"         set action block         set comment ''     next end Configuring IPS sensor (rule numbers under 'set rule' are equal to attack_id from above): config ips sensor     edit "Block-ICMP-Out"         config entries             edit 1                 set rule 1234                 set status enable                 set log-packet enable                 set action block             next         end     next end Create an address entry for the destination IP: config firewall address     edit "8.8.8.8"         set subnet 8.8.8.8 255.255.255.255     next end Configuring interface-policy and applying policy to FortiGate's outgoing interface: config firewall interface-policy     edit 1         set interface "OutSide"         set srcaddr "all"         set dstaddr "8.8.8.8"         set service "ALL_ICMP"         set ips-sensor-status enable         set ips-sensor "Block-ICMP-Out"     next end Verification: Before applying firewall interface-policy: execute ping 8.8.8.8 PING 8.8.8.8 (8.8.8.8): 56 data bytes 64 bytes from 8.8.8.8: icmp_seq=0 ttl=112 time=17.1 ms 64 bytes from 8.8.8.8: icmp_seq=1 ttl=112 time=17.4 ms 64 bytes from 8.8.8.8: icmp_seq=2 ttl=112 time=17.2 ms 64 bytes from 8.8.8.8: icmp_seq=3 ttl=112 time=17.2 ms 64 bytes from 8.8.8.8: icmp_seq=4 ttl=112 time=17.3 ms --- 8.8.8.8 ping statistics --- 5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max = 17.1/17.2/17.4 ms After applying the firewall interface-policy: execute ping 8.8.8.8 PING 8.8.8.8 (8.8.8.8): 56 data bytes --- 8.8.8.8 ping statistics --- 5 packets transmitted, 0 packets received, 100% packet loss GUI verification: Log & Report -> Intrusion Prevention: Note: ICMP timestamps can also be blocked using the 'local-in policy' if it is destined to the FortiGate interface. For detailed steps, refer to this KB Article: Technical Tip: Block ICMP timestamp on FortiGate interface while keeping ping enabled.