Is there a way to just disable icmp type 3 messages. I still want echo and echo replies just not unreachables.
I was not under the impression the fortigate sent icmp unreachable directly. Can you explain what's sending the icmp.Code type 3 message? The fortigate ? or something down wind?
I believe the device behind the firewall sends the icmp unreachable. I want to filter out these but see no way of doing so at this point?
emnoc wrote:I was not under the impression the fortigate sent icmp unreachable directly. Can you explain what's sending the icmp.Code type 3 message? The fortigate ? or something down wind?
The diagnostic command diag debug flow is your friend, traffic allow by the fwpolicy , will only allow what's allowed.
So I bet you have ALL/ANY or icmp-any allowed by the policy on what ever is sending the icmp.Code.Type 3
I would audit my fwpolicies & review my security layout. You should have no valid reason unlessed design for a host behind to have icmp.type 3s exiting your network imho
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2023 Fortinet, Inc. All Rights Reserved.