Re: Fw rule set question

They are not that big of an issue. What way are these going? Are they going 
form the LAN to the WAN.
Over all Source Quench is needed for TCP flow control. Unreachable and time 
execeeded are also fine.
Unreachable, well that should be obvious. Time Exceeded is usually used for 
trace routes and finding a routing loop.

The only possible risk I can see from these ICMP's is that it may allow for 
internal host enumeration, other then that
the risk is minimal with ICMP.

I recommend that you look at RFC 792, http://www.faqs.org/rfcs/rfc792.html
That will help you understand ICMP a lot better and what it's uses are for.

Juan B wrote:
> hi,
>
> I am evaluating a Fw rule set.
>
> I see that source quench,icmp unreacheble and time
> execeeded (all icmp) is allowed from the internet to
> the internal network. this is a cisco pix. is it a
> requirmnet that those rules will be opened? what
> happened if I disbale them? is there a security risk
> here? I dont rememmber seeing those rules opened in
> any fw I saw..
>
> thanks a lot !
>
> Juan
>
>
>        
> ____________________________________________________________________________________
> Got a little couch potato? 
> Check out fun summer activities for kids.
> http://search.yahoo.com/search?fr=oni_on_mail&p=summer+activities+for+kids&cs=bz
>