Re: Fw rule set question

[Craig Van Tassle <craig () codestorm org>]

They are not that big of an issue. What way are these going? Are they going form the LAN to the WAN.
Over all Source Quench is needed for TCP flow control. Unreachable and time execeeded are also fine.
Unreachable, well that should be obvious. Time Exceeded is usually used for trace routes and finding a routing loop.

The only possible risk I can see from these ICMP's is that it may allow for internal host enumeration, other then that
the risk is minimal with ICMP.

I recommend that you look at RFC 792, http://www.faqs.org/rfcs/rfc792.html
That will help you understand ICMP a lot better and what it's uses are for.

Juan B wrote:
> hi,
>
> I am evaluating a Fw rule set.
>
> I see that source quench,icmp unreacheble and time
> execeeded (all icmp) is allowed from the internet to
> the internal network. this is a cisco pix. is it a
> requirmnet that those rules will be opened? what
> happened if I disbale them? is there a security risk
> here? I dont rememmber seeing those rules opened in
> any fw I saw..
>
> thanks a lot !
>
> Juan
>
>
>        
> ____________________________________________________________________________________
> Got a little couch potato? 
> Check out fun summer activities for kids.
> http://search.yahoo.com/search?fr=oni_on_mail&p=summer+activities+for+kids&cs=bz