Re: PIX firewall and ICMP

[Darrell Porter <dporter () cpp com>]

What are they using ICMP to troubleshoot?  

Allowing ICMP from any to any is ill-advised.  If ICMP is needed for
troubleshooting, allow ICMP from inside to any.  Or you may want to educate
your users on http://www.network-tools.com or http://www.traceroute.org

My 2 cents

Darrell

Darrell Porter
Director, Network Operations
CPP, Inc.
Davies-Black Publishing
http://www.cpp.com
800-624-1765 ext 153
650-969-8608 fax



---------------------------------------------------------------------------
----------------------------------------------------------------------------