Difference in ICMP and Ping Service

[johnlloyd_13]

hi,

i'm trying to configure a new FW policy and just wanted to know the difference between ICMP and Ping service.

1.which is best practice to use/choose?

2.if i need to clone/edit a custom ping or icmp service, i.e. echo reply, which service do i use/edit (icmp vs ping)?

3.what is also the difference between the "traceroute" service vs the custom ping "time exceeded" (type:11,code:0).

[dingjerry_FTNT · Accepted solution]

Hi @johnlloyd_13 ,

A simple and quick answer is:  ICMP is a protocol, and Ping is a utility or command line tool using the ICMP protocol.

Here is the full list of all ICMP types and codes:

https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml

1.which is best practice to use/choose?

For Ping, you can apply either ICMP or Ping services.  Both are predefined ones on FGT.

I would recommend you use ICMP if you are allowing or denying other ICMP based services, such as tracert, pathPing, Hping, and so on.

2.if i need to clone/edit a custom ping or icmp service, i.e. echo reply, which service do i use/edit (icmp vs ping)?

You may clone the Ping service object and modify it.  You can get the ICMP type and code info from the link I provided above.

3.what is also the difference between the "traceroute" service vs the custom ping "time exceeded" (type:11,code:0).

If you check the link I provided above, you will find:

traceroute (Linux command) or tracert (Windows command):  ICMP type 30 and you may leave code blank

"time exceeded" : ICMP type 11 and code 0