| 10.2 |  | Using ACLs |
| 10.2.5 |  | Ping |

| Overview of the ping command The ping command is one of the most basic and useful troubleshooting tools of the network administrator. Before examining how to disable the ping feature on the firewall and why it should sometimes be done, this section will first briefly review the feature.

The ping command is a very common method for troubleshooting the accessibility of devices. It uses a series of Internet Control Message Protocol (ICMP) Echo messages to determine if a remote host is active or inactive, and the round-trip delay in communicating with the host.

The ping command first sends an echo request packet to an address, and then waits for a reply. The ping is successful only if the echo request gets to the destination, and the destination is able to get an echo reply back to the source.

The PIX Security Appliance and the ping command
Pinging to a PIX Security Appliance interface can be enabled or disabled. With pinging disabled, the PIX Security Appliance cannot be detected on the network. The icmp command implements this feature, which is also referred to as configurable proxy pinging. By default, pinging through the PIX Security Appliance to a PIX Security Appliance interface is not allowed. Pinging an interface from a host on that interface is allowed.

To use the icmp command, configure an icmp command statement that permits or denies ICMP traffic that terminates at the PIX Security Appliance. If the first matched entry is a permit entry, the ICMP packet continues to be processed. If the first matched entry is a deny entry or an entry is not matched, the PIX Security Appliance discards the ICMP packet and generates the %PIX-3-313001 Syslog message. An exception is when an icmp command statement is not configured, in which case, permit is assumed. Cisco recommends that permission be granted for the ICMP unreachable message type (type 3).. Denying ICMP unreachable messages disables ICMP Path MTU discovery, which can halt IPSec and PPTP traffic. See RFC 1195 and RFC 1435 for details about Path MTU Discovery.

Figure lists ICMP Message Types.