Cisco IOS Security Configuration Guide: Securing the Data Plane, Release 12.4T - Firewall Stateful Inspection of ICMP [Cisco IOS Software Releases 12.4 T]

Table Of Contents

Firewall Stateful Inspection of ICMP

Contents

Restrictions for Firewall Stateful Inspection of ICMP

Information About Firewall Stateful Inspection of ICMP

Feature Design of Firewall Stateful Inspection of ICMP

ICMP Inspection Checking

How to Use Firewall Stateful Inspection of ICMP

Configuring Firewall Stateful Inspection for ICMP

Verifying Firewall and ICMP Session Information

Monitoring Firewall and ICMP Session Information

Configuration Examples for Stateful Inspection of ICMP

Firewall Stateful Inspection for ICMP Configuration Example

Checking for ICMP Inspection Example

ICMP Session Verification Example

Additional References

Related Documents

Standards

MIBs

RFCs

Technical Assistance

Command Reference

Glossary

Firewall Stateful Inspection of ICMP

The Firewall Stateful Inspection of ICMP feature addresses the limitation of qualifying Internet Control Management Protocol (ICMP) messages into either a malicious or benign category by allowing the Cisco IOS firewall to use stateful inspection to "trust" ICMP messages that are generated within a private network and to permit the associated ICMP replies. Thus, network administrators can debug network issues by using ICMP without concern that possible intruders may enter the network.

Feature Specifications for the Firewall Stateful Inspection of ICMP feature

Feature History

Release

Modification

12.2(11)YU

This feature was introduced.

12.2(15)T

This feature was integrated into Cisco IOS Release 12.2(15)T.

Supported Platforms

For platforms supported in Cisco IOS Release 12.2(11)YU and 12.2(15)T, consult Cisco Feature Navigator.

Finding Support Information for Platforms and Cisco IOS Software Images

Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.

Contents

•Restrictions for Firewall Stateful Inspection of ICMP

•Information About Firewall Stateful Inspection of ICMP

•How to Use Firewall Stateful Inspection of ICMP

•Configuration Examples for Stateful Inspection of ICMP

•Additional References

•Command Reference

•Glossary

Restrictions for Firewall Stateful Inspection of ICMP

•To enable this feature, your Cisco IOS image must contain the Cisco IOS firewall.

•This feature does not work for the User Datagram Protocol (UDP) traceroute, in which UDP datagrams are sent instead of ICMP packets. The UDP traceroute is typically the default for UNIX systems. To use ICMP inspection with a UNIX host, use the "I" option with the traceroute command. This functionality will cause the UNIX host to generate ICMP traceroute packets, which will be inspected by the Cisco IOS firewall ICMP.

Information About Firewall Stateful Inspection of ICMP

The following sections provide information about Cisco IOS Firewall Stateful Inspection of ICMP:

•Feature Design of Firewall Stateful Inspection of ICMP

•ICMP Inspection Checking

Feature Design of Firewall Stateful Inspection of ICMP

ICMP is used to report errors and information about a network. It is a useful tool for network administrators who are trying to debug network connectivity issues. Unfortunately, intruders can also use ICMP to discover the topology of a private network. To guard against a potential intruder, ICMP messages can be blocked from entering a private network; however, a network administrator may then be unable to debug the network. Although a Cisco IOS router can be configured using access lists to selectively allow certain ICMP messages through the router, the network administrator must still guess which messages are potentially malicious and which messages are benign. With the introduction of this feature, a user can now configure a Cisco IOS firewall for stateful inspection to "trust" that the ICMP messages are generated within the private network and to permit the associated ICMP replies.

Note Access lists can still be used to allow unsolicited error messages along with Cisco IOS firewall inspection. Access lists complement Cisco IOS firewall ICMP inspection.

Stateful inspection of ICMP packets is limited to the most common types of ICMP messages that are useful to network administrators who are trying to debug their networks. That is, ICMP messages that do not provide a valuable tool for the internal network administrator will not be allowed. For the Cisco IOS firewall-supported ICMP message request types, see Table 29.

Table 29 ICMP Packet Types Supported by CBAC

ICMP Packet Type

Name

Description

0

Echo Reply

Reply to Echo Request (Type 8)

3

Destination Unreachable

Possible reply to any request

Note This packet is included because it is a possible response to any ICMP packet request.

8

Echo Request

Ping or traceroute request

11

Time Exceeded

Reply to any request if the time to live (TTL) packet is 0

13

Timestamp Request

Request

14

Timestamp Reply

Reply to Timestamp Request (type 13)

Note ICMP packet types 0 and 8 are used for pinging: the source sends out an Echo Request packet, and the destination responds with an Echo Reply packet.

Packet types 0, 8, and 11 are used for ICMP traceroute: Echo Request packets are sent out starting with a TTL packet of 1, and the TTL is incremented for each hop. The intermediate hops respond to the Echo Request packet with a Time Exceeded packet; the final destination responds with an Echo Reply packet.

ICMP Inspection Checking

Return packets are checked by the inspect code, not by ACLs. The inspect code tracks each destination address from outgoing packets and checks each return packet. For ECHO REPLY and TIMESTAMP REPLY packets, the return address is checked. For UNREACHABLE and TIME EXCEEDED packets, the intended destination address is extracted from the packet data and checked.

For more information, see Checking for ICMP Inspection Example.

How to Use Firewall Stateful Inspection of ICMP

This section contains the following procedures:

•Configuring Firewall Stateful Inspection for ICMP

•Verifying Firewall and ICMP Session Information

•Monitoring Firewall and ICMP Session Information

Configuring Firewall Stateful Inspection for ICMP

To enable the Cisco IOS Firewall to start inspection ICMP messages, perform the following steps:

SUMMARY STEPS

1. enable

2. configure terminal

3. ip inspect name inspection-name icmp [alert {on | off}] [audit-trail {on |off}] [timeout seconds]

DETAILED STEPS

Command or Action

Purpose

Step 1

enable
Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2

configure terminal
Example:

Router# configure terminal

Enters global configuration mode.

Step 3

ip inspect name inspection-name icmp [alert {on | off}] [audit-trail {on |off}] [timeout seconds]
Example:

Router(config)# ip inspect name test icmp alert on audit-trail on timeout 30

Turns on inspection for ICMP.

•alert—Alert messages are generated. This function is on by default.

•audit-trail—Audit trail messages are generated. This function is off by default.

•timeout—Overrides the global channel inactivity timeout value. The default value of the seconds argument is 10.

Verifying Firewall and ICMP Session Information

To display active ICMP session and IP access list information, perform the following optional steps:

SUMMARY STEPS

1. enable

2. show ip inspect session [detail]

3. show ip access-list

DETAILED STEPS
Command or Action

Purpose

Step 1

enable
Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2

show ip inspect session [detail]
Example:

Router# show ip inspect session

(Optional) Displays existing sessions that are currently being tracked and inspected by the Cisco IOS firewall.

•The optional detail keyword causes additional details about these sessions to be shown.
Step 3
show ip access-list
Example:
Router# show ip access-list 
(Optional) Displays the contents of all current IP access lists.

For a sample output example, see the section "ICMP Session Verification Example."
Monitoring Firewall and ICMP Session Information

To monitor debugging messages related to ICMP inspection, perform the following optional steps:

Note Effective with Cisco IOS Release 12.4(20)T, the debug ip inspect command is replaced by the debug policy-firewall command. See the Cisco IOS Debug Command Reference for more information.

SUMMARY STEPS

1. enable

2. debug ip inspect icmp

DETAILED STEPS
Command or Action

Purpose

Step 1

enable
Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.
Step 2
debug ip inspect icmp
Example:
Router# debug ip inspect icmp
(Optional) Displays the operations of the ICMP inspection engine for debugging purposes.

For an example of sample output, see the command debug ip inspect in the Command Reference section.
Configuration Examples for Stateful Inspection of ICMP

This section provides the following configuration examples:

•Firewall Stateful Inspection for ICMP Configuration Example

•Checking for ICMP Inspection Example

•ICMP Session Verification Example

Firewall Stateful Inspection for ICMP Configuration Example

The default ICMP timeout is deliberately short (10 seconds) due to the security hole that is opened by allowing ICMP packets with a wild-carded source address back into the inside network. The timeout will occur 10 seconds after the last outgoing packet from the originating host. For example, if you send a set of 10 ping packets spaced 1 second apart, the timeout will expire in 20 seconds or 10 seconds after the last outgoing packet. However, the timeout is not extended for return packets. If a return packet is not seen within the timeout window, the hole will be closed and the return packet will not be allowed in. Although the default timeout can be made longer if desired, it is recommended that this value be kept relatively short.

The following example shows how to configure a firewall for stateful inspection of ICMP packets:
no service pad
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname UUT
!
ip subnet-zero
no ip domain lookup
!
ip inspect audit-trail
ip inspect name test icmp alert on audit-trail on timeout 30
!
interface Ethernet0
ip address 192.168.10.2 255.255.255.0
ip inspect test in
!
interface Ethernet1
ip address 192.168.20.2 255.255.255.0
ip access-group 101 in
!
ip classless
ip route 0.0.0.0 0.0.0.0 192.168.20.3
no ip http server
!
access-list 101 deny ip any any
!
line con 0
exec-timeout 0 0
!
end
Checking for ICMP Inspection Example

In the following example, three destinations were pinged. The example shows that the inspect code tracked each destination address in the inspect session information.
fw_1751#sh ip insp sess detail
Established Sessions
 Session 813A1808 (192.168.156.5:0)=>(0.0.0.0:0) icmp SIS_OPEN
   Created 00:04:20, Last heard 00:00:00
   Destinations: 3
       Dest addr [192.168.131.3]
       Dest addr [192.168.131.7]
       Dest addr [192.168.131.31]
   Bytes sent (initiator:responder) [8456:5880] acl created 4
   Inbound access-list 102 applied to interface Ethernet0/0
   Inbound access-list 102 applied to interface Ethernet0/0
   Inbound access-list 102 applied to interface Ethernet0/0
   Inbound access-list 102 applied to interface Ethernet0/0
ICMP Session Verification Example

The following example is sample output from the show ip access-list command. In this example, Access Control Lists (ACLs) are created for an ICMP session on which only ping packets were issued from the host.
Router# show ip access-list 101
Extended IP access list 101
     permit icmp any host 192.168.133.3 time-exceeded
     permit icmp any host 192.168.133.3 unreachable
     permit icmp any host 192.168.133.3 timestamp-reply
     permit icmp any host 192.168.133.3 echo-reply (4 matches)
Additional References

Related Documents

Related Topic

Document Title

CBAC information and configuration tasks

"Configuring Context-based Access Control"

Additional CBAC commands

Cisco IOS Security Command Reference

Standards

Standards

Title

None

—

MIBs

MIBs

MIBs Link

None

To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://www.cisco.com/go/mibs

RFCs

RFCs¹

Title

RFC 792

Internet Control Message Protocol

RFC 950

Internet Standard Subnetting Procedure

RFC 1700

Assigned Numbers

¹Not all supported RFCs are listed.

Technical Assistance

Description

Link

The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.

To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.

Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

http://www.cisco.com/techsupport

Command Reference

The following commands are introduced or modified in the feature or features documented in this module. For information about these commands, see the Cisco IOS Security Command Reference at http://www.cisco.com/en/US/docs/ios/security/command/reference/sec_book.html. For information about all Cisco IOS commands, go to the Command Lookup Tool at http://tools.cisco.com/Support/CLILookup or to the Cisco IOS Master Commands List.

•debug ip inspect

•ip inspect name

Glossary

ACL—access control list. An ACL is a list kept by routers to control access to or from the router for a number of services (for example, to prevent packets with a certain IP address from leaving a particular interface on the router).

CBAC—Context-Based Access Control. CBAC is the name given to the Cisco IOS Firewall subsystem.

firewall—A firewall is a networking device that controls access to the network assets of your organization. Firewalls are positioned at the entrance points into your network. If your network has multiple entrance points, you must position a firewall at each point to provide effective network access control.

The most basic function of a firewall is to monitor and filter traffic. Firewalls can be simple or elaborate, depending on your network requirements. Simple firewalls are usually easier to configure and manage. However, you might require the flexibility of a more elaborate firewall.

ICMP—Internet Control Message Protocol. An ICMP is a network layer Internet protocol that reports errors and provides other information relevant to IP packet processing.

RPC—remote-procedure call. A RPC is the technological foundation of client or server computing. RPCs are procedure calls that are built or specified by clients and are executed on servers, with the results returned over the network to the clients.

RTSP—Real Time Streaming Protocol. RTSP enables the controlled delivery of real-time data, such as audio and video. Sources of data can include both live data feeds, such as live audio and video, and stored content, such as prerecorded events. RTSP is designed to work with established protocols, such as RTP and HTTP.

SIP—Session Initiation Protocol. SIP is a protocol developed by the IETF MUSIC Working Group as an alternative to H.323. SIP features are compliant with IETF RFC 2543, published in March 1999. SIP equips platforms to signal the setup of voice and multimedia calls over IP networks.

SMTP—simple mail transfer protocol. SMTP is an Internet protocol providing e-mail services.

UDP—User Datagram Protocol. A UDP is a connectionless transport layer protocol in the TCP/IP protocol stack. UDP is a simple protocol that exchanges datagrams without acknowledgments or guaranteed delivery, requiring that error processing and retransmission be handled by other protocols. UDP is defined in RFC 768.

Note Refer to the Internetworking Terms and Acronyms for terms not included in this glossary.

CCDE, CCENT, Cisco Eos, Cisco HealthPresence, the Cisco logo, Cisco Lumin, Cisco Nexus, Cisco StadiumVision, Cisco TelePresence, Cisco WebEx, DCE, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn and Cisco Store are service marks; and Access Registrar, Aironet, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, EtherFast, EtherSwitch, Event Center, Fast Step, Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, iPhone, iQuick Study, IronPort, the IronPort logo, LightStream, Linksys, MediaTone, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, Network Registrar, PCNow, PIX, PowerPanels, ProConnect, ScriptShare, SenderBase, SMARTnet, Spectrum Expert, StackWise, The Fastest Way to Increase Your Internet Quotient, TransPath, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.

All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0812R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

© 2007 Cisco Systems, Inc. All rights reserved.