[ Contents] [ Prev] [ Next] [ Index] [ Report an Error]

Blocking Fragmented ICMP Packets

Because ICMP packets contain very short messages, there is no legitimate reason for ICMP packets to be fragmented. If an ICMP packet is so large that it must be fragmented, something is amiss.

Before You Begin

For background information, read Understanding ICMP Fragment Protection.

You can use either J-Web or the CLI configuration editor to block fragmented ICMP packets. The specified security zone is the one from which the fragments originated.

This topic covers:

J-Web Configuration

To configure screens:

  1. Select CLI Tools>Point and Click CLI.
  2. Next to Security, click Edit.
  3. Next to Screen, click Edit.
  4. Next to Ids option, click Add new entry.
  5. In the Name box, type icmp-fragment.
  6. Next to Icmp, click Configure.
  7. Next to Fragment, select the check box and click OK.
  8. To save and commit the configuration, click Commit.

To configure zones:

  1. Select CLI Tools>Point and Click CLI.
  2. Next to Security, click Edit.
  3. Next to Zones, click Edit.
  4. Next to Security zone, click Add new entry.
  5. In the Name box, type zone.
  6. In the Screen box, type icmp-fragment and click OK.
  7. To save and commit the configuration, click Commit.

CLI Configuration

user@host# set security screen ids-option icmp-fragment icmp fragment
user@host# set security zones security-zone zone screen icmp-fragment

Related Topics


[ Contents] [ Prev] [ Next] [ Index] [ Report an Error]