Re: ICMP blocking on PIX .4.4.1

["Steven M. Bellovin" <smb () research att com>]

In message <20000427134048.DAFEC42FF@jimsun>, Jim Seymour writes:

> Allowing ICMP (or any connection-less protocol, such as UDP) *through*
> the firewall is another issue entirely.  Connection-less protocols are
> not safe.  Cannot be made safe.  Other than perhaps allowing syslog
> from the router to a syslog host, specifically, I don't see any
> particular reason to allow any UDP through a firewall.

You can allow inbound UDP if it is to a known-safe destination.  You're 
certainly right that without connection semantics, it's very hard to link a 
reply to an outbound query.

As for ICMP -- in many cases, it's vital to allow the 'fragmentation needed' 
ICMP message through, or Path MTU Discovery will break.  And that, in turn, 
leads to black holes.  It's especially problematic if routes go through 
tunnels (i.e., IPsec), since that cuts the effective MTU of that link below 
the 1500 bytes that is generally accepted.

                --Steve Bellovin