ICMP redirect passing through FW

[Bobby_Maclaren]

Hello community,

I have TCP443 communication that goes from my local network through NAT outside. On a way to destination, it is stopped and ICMP redirect is sent back. It comes on my VIP which is mapped from TCP443 to TCP443. Then there is FW policy that is allowing only TCP443, but the ICMP packet still passes. How is that possible? 

Thanks everyone for any help. 

[ebilcari]

If I get it right, in this case is not the server who is responding to the ICMP requests, most probably it's the FGT itself. To disable this go under WAN interface and disable the PING checkbox:

or disable only this ICMP type from the CLI in port level:

GW (port1) # set icmp-accept-redirect disable 

[pminarik]

In general, ICMP replies to allowed TCP/UDP traffic are automatically allowed. This is a good thing. The ICMP messages contain the initial part of the packet being replied to, so the FortiGate is able to match the ICMP reply packet to the existing allowed traffic session.

[thousand]

This is something I am currently experiencing as well.
I think this is probably the behavior of the URL below.
However, I don't know how to stop it.

https://community.fortinet.com/t5/FortiGate/Technical-Note-ICMP-packets-processing-by-the-firewall-p...