I want to wrap up by discussing some less common but still
important ICMP message types you may want to consider
permitting across your firewall.
In my years of networking,
I've only encountered these packets in production a handful of
times, so I decided to exclude them from this course.
First, the redirect message. These are the ICMP type 5 messages, and there are
several codes to differentiate between network redirection,
host redirection, and even specific redirections for packets with
specific quality of service, or QoS, markings.
ICMP redirects are typically used on LAN networks with multiple routers
whereby one router is aware of a better path off segment and needs to
communicate that path to the other routers.
IP routing tends to handle this for us in modern
networks, so this message is rare.
Second, there is another type of time exceeded message.
We've explored the TTL‑specific one, which is type 11, code 0, in great depth.
There is also a type 11 code 1 variant, which can be used to signal that, hey,
I was expecting more fragments, but they didn't
show up, so reassembly timed out.
Minimizing fragmentation in the network is a top priority anyway, so if
you have a lot of these messages in your network,
you should consider a more comprehensive redesign. From a firewall perspective,
you could simply permit all type 11 ICMP messages to cover both
TTL and fragmentation reassembly variants.
Last, there are ICMP timestamp and timestamp replies
using codes 12 and 13, respectively.
I've only seen these legitimately used once in my career.
Timestamps are IP options that provide greater details than a
simple ICMP ping as they can record one‑way transit times plus
ICMP processing time at the remote node.
These are often blocked for security reasons.
Now you know the fundamental design concepts behind
ICMP's role in securing networks.
First and foremost, ICMP isn't something to blindly deny as many do.
It's very useful for network operations, as we've
demonstrated. I've provided a basic model here.
Your mileage may vary, and I would recommend fine‑tuning your
firewall rules to better suit your environment.
For example,
this might include adding bandwidth policers to prevent
ICMP‑based denial‑of‑service attacks.
We've completed the IPv4 portion of this course. I encourage you
to review any unclear areas before continuing.
Next up, we will cover many of the same tools using their IPv6 equivalents. See you there.