Disable ICMP type 3 messages?

[beaven67]

Is there a way to just disable icmp type 3 messages. I still want echo and echo replies just not unreachables.

Anyone know,

Pat Beaven

[emnoc]

I was not under the impression the fortigate sent  icmp unreachable directly. Can you explain what's sending the icmp.Code type 3 message? The fortigate ? or something down wind?

[beaven67]

I believe the device behind the firewall sends the icmp unreachable. I want to filter out these but see no way of doing so at this point?

emnoc wrote:

I was not under the impression the fortigate sent  icmp unreachable directly. Can you explain what's sending the icmp.Code type 3 message? The fortigate ? or something down wind?

[emnoc]

The diagnostic command diag debug flow is your friend, traffic allow by the fwpolicy , will only allow what's allowed.

So I bet you have ALL/ANY or icmp-any allowed by the policy on what ever is sending the icmp.Code.Type 3

I would audit my  fwpolicies & review my security layout. You should have no valid reason unlessed design for a host behind to have icmp.type 3s exiting your network imho