Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 980
  • Last Modified:

How to block icmp messages with a cisco router

We have some hosts or a host that seems to disconnect all the vpn client on my network.

I took a look at the server logs and here what is shows

22116      11:01:17.531532      MY_IP      DEST_IP      TCP      53025 > pptp [SYN]
Seq=0 Win=8192 Len=0 MSS=1460 WS=2 TSV=4447122 TSER=0

So it seems that some clients seend some icmp destination unreachable on the server. The server somehow close all the connections.

Is it possible to block those icmp send messages with a cisco 800 series.

Like deny icmp all all ? Is it going to work ??

Thanks
0
caclement
Asked:
caclement
  • 2
1 Solution
 
Jimmy Larsson, CISSP, CEHNetwork and Security consultantCommented:
What you see in the logs is not icmp-traffic, it is tcp-traffic to your pptp-port (1723). Unless you use pptp-based vpn you can simply block all incoming pptp-traffic.

access-list YOURINBOUNDACL deny tcp any SERVERIP eq 1723.

Best regards
Kvistofta
0
 
caclementAuthor Commented:
My messages dont show all the log and the wireshark packets, but i realy want to block sent icmp packets. I want to allow the PPTP and GRE tunels. Some bugged PPTP clients send some ICMP destination unreachable to remote  poptop and pptp linux server wich i do not own and control. The server close all the connection simultaneously.

I added the following ACL

access-list 101 deny icmp any any

It seems to works.
0
 
caclementAuthor Commented:
access-list 101 deny icmp any any Blocks any ICMP sent messages.
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now