Many engineers don't pay much attention to designing
network security to work correctly with ICMP.
Sure, most organizations know how to lock down devices to prevent attacks
caused by ICMP vulnerabilities, but on the flip side,
few organizations put the effort in to allow critical ICMP messages to pass.
That is going to be the main focus of this module.
I don't want to assume everyone knows how a basic, stateless firewall
filter works, so I'll explain that first. In Cisco speak,
this is an access list, or ACL, sometimes called a traffic filter.
Next, I'll demonstrate a botched ACL implementation on a Globomantics router
and how that can negatively affect network operations.
Together, we will build a solid foundation for
integrating security into our ICMP designs.
You may modify it to suit your specific use case.
Along our journey,
we'll encounter a new ICMP unreachable to help us, the admin prohibited message.
Last, we will analyze this new ICMP message and discuss its usefulness.
Let's explore how stateless firewall filters actually work.
It's really simple.
A firewall has a list of which IP addresses, TCP/UDP ports, and IP
protocol numbers are allowed to pass through it.
Each entry specifies a permit or deny action, which determines whether a
specific flow is forwarded or dropped. In the Globomantics network,
I've disabled the link between R1 and R2 to force traffic across our
firewall on R3. I've configured a simple ACL on R3, which allows
only ICMP ping and Telnet, which is TCP port 23, to be sent towards
the Wired Brain Coffee server.
Another key attribute of stateless firewalls is that they do not
remember the flows that pass through them,
so each packet is independently processed.
Many of the design tips in this module apply to stateful firewalls too,
but to keep this course focused on ICMP,
I'm using the simpler ACL construct.
When pings are sent, they successfully pass the ACL filter.
Likewise, when Telnet packets are sent, they too are permitted by the ACL.
But if the client tries to web into the server using HTTP,
it will be denied by the ACL. What happens if we traceroute? Stay tuned to find out.