Re: ICMP Packets.

[Alec Muffett - SunLabs <Alec.Muffett () UK Sun COM>]

> 1) Is there any reason that echo reply would need to be allowed out in =
> response to an external request? I know this is the case for other ICMP =
> messages such as packet-too-big, but I am not sure why echo-reply would =
> ever be needed

Sometimes, if you have your own DNS domain, your NIC will want to ping your 
DNS server at regular intervals to check that it is alive; since the DNS 
server is likely to be inside your perimeter router, this is one possible 
instance where it may be necessary.  I saw this happen with ".com.ru", IIRC.

Nonetheless, as other have said, ban *everything* and then only explicitly 
permit the minimum set of functionality that is required for business function.

        - alec

-- 
    alec muffett, sun microsystems laboratories, alec.muffett @ uk.sun.com
               birds and planes go through the rainbow every day