Cisco ASA Series User Manual

1-10
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Management Access
Configuring ICMP Access
Configuring ICMP Access
By default, you can send ICMP packets to any ASA interface using either IPv4 or IPv6. This section tells
how to limit ICMP management access to the ASA. You can protect the ASA from attacks by limiting
the addresses of hosts and networks that are allowed to have ICMP access to the ASA.
Note For allowing ICMP traffic through the ASA, see Chapter 1, “Configuring Access Rules.”
This section includes the following topics:
• Information About ICMP Access, page 1-10
• Licensing Requirements for ICMP Access, page 1-10
• Guidelines and Limitations, page 1-11
• Default Settings, page 1-11
• Configuring ICMP Access, page 1-12
Information About ICMP Access
ICMP in IPv6 functions the same as ICMP in IPv4. ICMPv6 generates error messages, such as ICMP
destination unreachable messages and informational messages like ICMP echo request and reply
messages. Additionally ICMP packets in IPv6 are used in the IPv6 neighbor discovery process and path
MTU discovery.
We recommend that you always grant permission for the ICMP unreachable message type (type 3).
Denying ICMP unreachable messages disables ICMP path MTU discovery, which can halt IPsec and
PPTP traffic. See RFC 1195 and RFC 1435 for details about path MTU discovery.
If you configure ICMP rules, then the ASA uses a first match to the ICMP traffic followed by an implicit
deny all entry. That is, if the first matched entry is a permit entry, the ICMP packet continues to be
processed. If the first matched entry is a deny entry or an entry is not matched, the ASA discards the
ICMP packet and generates a syslog message. An exception is when an ICMP rule is not configured; in
that case, a permit statement is assumed.
Licensing Requirements for ICMP Access
The following table shows the licensing requirements for this feature:
Model License Requirement
All models Base License.
Model License Requirement
All models Base License.

Cisco ASA Series Specifications

General

Brand	Cisco
Model	ASA Series
Category	Network Hardware
Language	English