Ascend Archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: (ASCEND) Suppressing ICMP errors



On Thu, 25 Jun 1998, Michiel Boland wrote:

> Hi
> 
> I have an anti-spoof filter on all our dialup customers. However,
> any ICMP unreachables that get sent as a result of someone using
> a packet with a 'wrong' source address appear to be flung out
> onto the net rather than sent back along the interface from which
> the original packet was received.

I presume you are using basic filters, not Secure Access F/W?  You are
_rejecting_ the bogus packets, and implicitly generating a ICMP to the
source address (ie the bogus address)?  Yes, that will get flung out onto
the internet :-(

> Is there someone who has found a way to stop these bogus ICMP
> messages? Obviously I do not want to filter *all* ICMP from my
> max. 

The underlying problem is that you need to silently drop these packets,
not reject them.  AFAIK, that is only an option in SA F/W (ie not in the
basic filtering.  Feature request time? 

Regards,
Neale.

++ Ascend Users Mailing List ++
To unsubscribe:	send unsubscribe to ascend-users-request@bungi.com
To get FAQ'd:	<http://www.nealis.net/ascend/faq>


Follow-Ups: References: