Filtering ICMP traffic

This option allows configuring an ACE to selectively permit some types of ICMP traffic, while denying other types. An ACE designed to permit or deny ICMP traffic can optionally include an ICMP type and code value to permit or deny an individual type of ICMP packet, while not addressing other ICMP traffic types in the same ACE. As a further option, the ACE can include the name of an ICMP packet type.

Syntax:

<deny|permit> icmp <SA> <DA> [icmp-type [icmp-code]]

<deny|permit> icmp <SA> <DA> [icmp-type-name]

Using icmp as the packet protocol type, you can optionally specify an individual ICMP packet type or packet type/code pair to further define the criteria for a match. This option, if used, is entered immediately after the destination IP address (DA) entry.

For example, the following ACE specifies "destination unreachable" (ICMP type 1) where "address unreachable" (3; a subtype of "destination unreachable") is the specific code.

#permit icmp any any 1 3

For more information on ICMP types and codes, visit the Internet Assigned Numbers Authority (IANA) website at www.iana.org, and refer to “Internet Control Message Protocol version 6 (ICMPv6) Type Numbers”.

[icmp-type-name]