How to block ICMP Timestamp Requests

Question

Hi, 
 i know that there already was a similar question here: https://community.sophos.com/utm-firewall/f/network-protection-firewall-nat-qos-ips/117583/blocking-icmp-timestamp-reply-t13-c00-and-t14-c00-not-working 
 However, this doesn't really help me because, I don't want to disable all ICMP related protocols simply. Does anyone know a way to only block ICMP Timestamp requests (and replies) or IF I disable all ICMP checkboxes in Firewall tab, which ones should I reenable afterwards to not have any service issues? For me it's not clear what those checkboxes "enable". We also got this as a finding, so we would like to "fix" this. See screenshot. Any help is appreciated.

MartinSeener · Accepted Answer

Hi, thanks for the feedback. I know that we did not allow ICMP to go through from external, so this was never a "real" issue. Although I took the time to research and want to quickly describe my findings here for anyone else also looking into this. - You do not need ICMP even at the Firewall level from external usually - You may need it in VPNs when using UDP or when your interfaces don't use default MTU of 1500 or provide UDP services - ICMP Type 8 is Echo Request (Ping), Type 3 is Dest. not reachable among others (defined in (Sub)codes) which you may need I've now disabled global ICMP altogether and only left all 3 Ping checkboxes enabled, as well as the "Let Traceroute from internal to external". The FW itself it not traceroutable anymore from external. With this all of my IPSec VPNs still work fine, same for Road-Warrior SSL-VPN and other things. So this one is fixed for me now. Thanks for your help!

How to block ICMP Timestamp Requests

Top Replies