Advertisement

05.10.2008 at 03:04AM PDT, ID: 23391445
[x]
Attachment Details

Simple Command to disable icmp on External Interface

Asked by Citadelny in Network Routers, Internet Control Message Protocol (ICMP), Cisco PIX Firewall

Tags: Cisco, 2811 Router, Advanced IP services, Used as a VPN Endpoint

Hello all and thanks for any suggestions you may have.

The Cisco ASA (5500) has a simple command to disable and enable ICMP on its interfaces

icmp deny any outside
icmp permit any inside

Is there a very simple way to disable pings (icmp) on an external Interface.

I've attached my config (actually) from an 871 but the IOS level is similar and virtually the same except for the interfaces.

Thanks allStart Free Trial 
1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:

70WEST#sh run
Building configuration...
 
Current configuration : 2241 bytes
 
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
 
hostname 70WEST
 
boot-start-marker
boot-end-marker
 
enable secret 5 xxxxxxxxxxxxxxxxxxxxx
enable password 7 xxxxxxxxxxxxxxxxxxxxxxxxxx
 
no aaa new-model
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 10.2.2.1 10.2.2.19
ip dhcp excluded-address 10.2.2.51 10.2.2.255
 
ip dhcp pool WESTPOOL
   network 10.2.2.0 255.255.255.0
   default-router 10.2.2.1
   domain-name xxxxxxxxxx.com
   dns-server 10.1.10.20 10.1.10.23
   netbios-name-server 10.1.10.23
 
 
no ip domain lookup
 
crypto isakmp policy 10
 encr 3des
 hash md5
 authentication pre-share
crypto isakmp key xxxxx address x.x.x.x no-xauth
 
crypto ipsec security-association lifetime seconds 86400
 
crypto ipsec transform-set aes256-1 esp-3des esp-md5-hmac
 
crypto map outside-map-1 1 ipsec-isakmp
 set peer x.x.x.x
 set transform-set aes256-1
 match address 101
 
interface FastEthernet0
 
interface FastEthernet1
 
interface FastEthernet2
 
interface FastEthernet3
 
interface FastEthernet4
 ip address x.x.x.x 255.255.255.252
 ip nat outside
 ip virtual-reassembly
 duplex auto
 speed auto
 crypto map outside-map-1
 
interface Vlan1
 ip address 10.2.2.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 
ip default-gateway x.x.x.x
ip route 0.0.0.0 0.0.0.0 x.x.x.x name DEFAULT_ROUTE
 
no ip http server
no ip http secure-server
ip nat inside source list 100 interface FastEthernet4 overload
 
ip access-list extended outside_cryptomap_1
 permit ip 10.2.2.0 0.0.0.255 any
 
access-list 95 permit x.x.x.x
access-list 95 permit x.x.x.x
access-list 95 permit 10.1.8.0 0.0.3.255
access-list 100 deny   ip 10.2.2.0 0.0.0.255 10.1.8.0 0.0.3.255
access-list 100 permit ip 10.2.2.0 0.0.0.255 any
access-list 101 permit ip 10.2.2.0 0.0.0.255 10.1.8.0 0.0.3.255
access-list 150 permit ip 10.2.2.0 0.0.0.255 any
dialer-list 1 protocol ip permit
 
 
 
control-plane
 
 
line con 0
 no modem enable
line aux 0
line vty 0 4
 access-class 95 in
 password 7 xxxxxxxxxxxxx
 logging synchronous
 login
 transport input telnet ssh
 
scheduler max-task-time 5000
end
 
70WEST#
[+][-]05.10.2008 at 06:18AM PDT, ID: 21538945

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]05.10.2008 at 07:49PM PDT, ID: 21541316

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]05.16.2008 at 09:48PM PDT, ID: 21588031

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]05.16.2008 at 09:54PM PDT, ID: 21588038

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]05.17.2008 at 03:43AM PDT, ID: 21588673

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]06.09.2008 at 12:05PM PDT, ID: 21745696

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]06.09.2008 at 12:47PM PDT, ID: 21746039

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]06.09.2008 at 01:13PM PDT, ID: 21746244

View this solution now by starting your 7-day free trial. Setting up your free trial is quick, easy, and secure. We will return you to this solution, unlocked, when you're done.

 

About this solution

Zones: Network Routers, Internet Control Message Protocol (ICMP), Cisco PIX Firewall
Tags: Cisco, 2811 Router, Advanced IP services, Used as a VPN Endpoint
Sign Up Now!
Solution Provided By: decoleur
Participating Experts: 2
Solution Grade: B
 
 
[+][-]06.09.2008 at 01:56PM PDT, ID: 21746607

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]06.10.2008 at 07:31AM PDT, ID: 21751617

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
 
Loading Advertisement...
20080716-EE-VQP-32 / EE_QW_2_20070628