Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Bobby_Maclaren
New Contributor II

ICMP redirect passing through FW

Hello community,

I have TCP443 communication that goes from my local network through NAT outside. On a way to destination, it is stopped and ICMP redirect is sent back. It comes on my VIP which is mapped from TCP443 to TCP443. Then there is FW policy that is allowing only TCP443, but the ICMP packet still passes. How is that possible? 

 

1.PNG

 

Thanks everyone for any help. 

3 REPLIES 3
ebilcari
Staff
Staff

If I get it right, in this case is not the server who is responding to the ICMP requests, most probably it's the FGT itself. To disable this go under WAN interface and disable the PING checkbox:

ping.PNG

or disable only this ICMP type from the CLI in port level:

GW (port1) # set icmp-accept-redirect disable 
- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.
pminarik
Staff
Staff

In general, ICMP replies to allowed TCP/UDP traffic are automatically allowed. This is a good thing. The ICMP messages contain the initial part of the packet being replied to, so the FortiGate is able to match the ICMP reply packet to the existing allowed traffic session.

[ corrections always welcome ]
thousand
New Contributor

This is something I am currently experiencing as well.
I think this is probably the behavior of the URL below.
However, I don't know how to stop it.

https://community.fortinet.com/t5/FortiGate/Technical-Note-ICMP-packets-processing-by-the-firewall-p...

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors