[ Contents] [ Prev] [ Next] [ Index] [ Report an Error]

Blocking Large ICMP Packets

Because ICMP packets contain very short messages, there is no legitimate reason for large ICMP packets. If an ICMP packet is unusually large, something is wrong.

Before You Begin
For background information, read Understanding Large ICMP Packet Protection.

You can use either J-Web or the CLI configuration editor to block large ICMP packets. The specified security zone is the one from which the ICMP packets originated.

This topic covers:

J-Web Configuration

To configure screens:

Select Configure>CLI Tools>Point and Click CLI.
Next to Security, click Configure or Edit.
Next to Screen, click Edit.
Next to Ids option, click Add new entry.
In the Name box, type icmp-large.
Next to Icmp, click Configure.
Next to Large, select the check box and click OK.
To save and commit the configuration, click Commit.

To configure zones:

Select Configure>CLI Tools>Point and Click CLI.
Next to Security, click Configure or Edit.
Next to Zones, click Configure.
Next to Security zone, click Add new entry.
In the Name box, type zone.
In the Screen box, type icmp-large and click OK.
To save and commit the configuration, click Commit.

CLI Configuration


            
               user@host# set security screen ids-option
                     icmp-large icmp large
               user@host# set security zones security-zone
                     zone screen icmp-large

Blocking Large ICMP Packets

J-Web Configuration

CLI Configuration

Related Topics