Blocks ICMP Error Reporting Packets

[Zhuo]

How Fortinet Blocks ICMP Error Reporting Packets

thanks.

[ebilcari]

You can check this article that covers this topic more in detail.

[Zhuo · Accepted solution]

The test topology is as follows:

The L3 layer switch will tell the fortigate Unreachable, and what we have to do is not to interfere with the L3 layer switch sending the packet to the fortigate. We need to reject the Unreachable packet in the fortigate (equivalent to forwarding traffic).

I have tested the results. Firewall ACL is used in fortigate to prevent Unreachable from being sent to the client. Note: It is not a firewall policy, but a firewall ACL. Just define the icmp service type3 code1.

[ebilcari]

Thanks for sharing your findings. This looks like another elegant way of achieving the same result using a custom service and ACL:

[Zhuo]

The test topology is as follows:

The L3 layer switch will tell the fortigate Unreachable, and what we have to do is not to interfere with the L3 layer switch sending the packet to the fortigate. We need to reject the Unreachable packet in the fortigate (equivalent to forwarding traffic).

I have tested the results. Firewall ACL is used in fortigate to prevent Unreachable from being sent to the client. Note: It is not a firewall policy, but a firewall ACL. Just define the icmp service type3 code1.