| 3.6 |  | Task 4: Define Inspection Rules |
| 3.6.5 |  | Inspection rules for ICMP |

| The Firewall Stateful Inspection of ICMP feature, available in IOS 12.2(15)T, addresses the limitation of qualifying Internet Control Management Protocol (ICMP) messages. These messages are placed into either a malicious or benign category by allowing the Cisco IOS firewall to use stateful inspection to "trust" ICMP messages that are generated within a private network and to permit the associated ICMP replies. Thus, network administrators can debug network issues by using ICMP without concern that possible intruders may enter the network.

ICMP is used to report errors and information about a network. It is a useful tool for network administrators who are trying to debug network connectivity issues. Unfortunately, intruders can also use ICMP to discover the topology of a private network. To guard against a potential intruder, ICMP messages can be blocked from entering a private network. However, a network administrator may then be unable to debug the network. Although a Cisco IOS router can be configured using access lists to selectively allow certain ICMP messages through the router, the network administrator must still guess which messages are potentially malicious and which messages are benign. With the introduction of this feature, a user can now configure a Cisco IOS firewall for stateful inspection to "trust" that the ICMP messages are generated within the private network and to permit the associated ICMP replies.

Stateful inspection of ICMP packets is limited to the most common types of ICMP messages that are useful to network administrators who are trying to debug their networks. That is, ICMP messages that do not provide a valuable tool for the internal network administrator will not be allowed. For the Cisco IOS firewall-supported ICMP message request types, see Figure .

To enable the Cisco IOS Firewall to start inspection ICMP messages, perform the following steps in Figure . To troubleshoot ICMP inspection, perform the following optional steps in Figure .

| Web Links http://www.cisco.com/en/US/ products/sw/iosswrel/ps5012/products _feature_guide09186a0080146558.html