ACL policy with ICMP types

  • 1
  • 1
  • Question
  • Updated 4 years ago
  • Answered
I want/need to create an ACL that only allows certain ICMP types and denies "the rest". Specifically "echo (8)", "echo-reply (0)", "time-exceeded (11)", "traceroute (30, I know. technically deprecated)", and "unreachable (3)" need to be accepted.

And "of course" there are a few other rules in that policy file as well, like accepting only HTTP/S traffic etc.

My question is, do I need to create five distinct entries in my policy file, each saying

if match all {
   protocol icmp;
   icmp-type 3;
} then {
   permit;
}

or can I simply have one

if  {
      icmp-type 3;
      icmp-type 0;
      icmp-type 30;
      ...
} then {
   permit;
}

I don't think we have (in 15.3/4/5/6.X) the option of "AND" and "OR", do we? So I guess I can not do

if  {
      protocol icmp; AND
      ( icmp-type 3; OR
      icmp-type 0; OR
      icmp-type 30; OR
      ...)
} then {
   permit;
}

correct?


Thanks,

     Frank
Photo of Frank

Frank

  • 3,776 Points 3k badge 2x thumb

Posted 4 years ago

  • 1
  • 1
Photo of Sumit Tokle

Sumit Tokle, Alum

  • 5,738 Points 5k badge 2x thumb
if  match any {
      icmp-type 3;
      icmp-type 0;
      icmp-type 30;
      ...
} then {
   permit;
}

By default, policy matches all the condition. You can use above type of policy.
Photo of Paul Russo

Paul Russo, Alum

  • 9,694 Points 5k badge 2x thumb
Hey Frank the other option you would have is to permit the ones you want and then deny all other ICMP packets.  Not sure which is easier for you.

Thanks
P
Photo of Frank

Frank

  • 3,776 Points 3k badge 2x thumb
Yeah, that's what I'm doing - there's a "deny all" at the very end which I omitted.
I do wonder about the effectiveness of essentially checking every packet against 5 icmp-types, even tcp/udp packets, but I hope there's internal optimization going on that I don't see (or that it's not that expensive to do) :)
Photo of Paul Russo

Paul Russo, Alum

  • 9,694 Points 5k badge 2x thumb
Hey Frank

Going through the AL policy file should not impact performance at all. We do the check I HW and we do it in parallel when the packet ingress especially the switch. That allows us to forward at L2/LA do ACLs and QoS at wire speed.

Does that help?

P
Photo of Frank

Frank

  • 3,776 Points 3k badge 2x thumb
Sure does - and thank you much!
Photo of Frank

Frank

  • 3,776 Points 3k badge 2x thumb
OUCH!!!
 -> Line 73 : Protocol needs to be set to icmp or icmpv6 , before setting "icmp-type".

However, this seems to be sufficient to pass the check command:

entry Allow_ICMP {
        if match any {
                protocol icmp;
                icmp-type 0;
                icmp-type 3;
                icmp-type 8;
                icmp-type 11;
                icmp-type 30;
        } then {
                permit;
        }
}

If I hit another snag, I'll be back posting :)
Photo of Frank

Frank

  • 3,776 Points 3k badge 2x thumb
Whooops:
# refresh policy "test"

Error:  Was not able to refresh policy test
Line 75 : Attribute icmp-type already exists as a match statement in Acl entry Allow_ICMP.
Configuration failed on backup MSM, command execution aborted!

I guess I have to type out five different entries. At least on 15.5.1.6 :(

Yup, that worked.
Photo of Grosjean, Stephane

Grosjean, Stephane, Employee

  • 13,346 Points 10k badge 2x thumb
Hi,

You cannot have several icmp-type in the same match condition. Any packet can only be of one type, not all. That's why you have the error message. You would have the same kind of error if you tried to have on the same condition match both an IPv4 and an IPv6 address. That's not possible.

Rgds,
Stephane