🚀 Cisco ASA ICMP Handling (Post-9.7) – Complete Deep Dive
ICMP (Internet Control Message Protocol) is one of the most misunderstood yet critical protocols in networking. It is often treated as "just ping", but in reality, it plays a fundamental role in diagnostics, routing feedback, and network stability.
With Cisco ASA version 9.7, ICMP handling evolved from a limited, interface-based control model into a flexible, ACL-driven architecture.
📚 Table of Contents
- Pre-9.7 Behavior
- Post-9.7 Improvements
- How ASA Processes ICMP
- Mathematics & Logic of ACL Matching
- Configuration Examples
- CLI Outputs
- Best Practices
- Related Articles
1. ICMP Control Before ASA 9.7
Before version 9.7, ASA treated ICMP differently from TCP/UDP. It relied on the icmp command, which worked only inbound and lacked flexibility.
icmp permit any outside icmp permit any inside
Limitations:
- No outbound control
- No ICMP type granularity
- No deep inspection
🔍 Expand: Why this was a problem
In real networks, different ICMP types have different meanings:
- Echo Request → ping
- Redirect → route manipulation
- Time Exceeded → traceroute
Without filtering, attackers could exploit these.
2. What Changed After 9.7
Cisco moved ICMP control into ACLs, making it consistent with TCP/UDP filtering.
- Granular ICMP type filtering
- Bidirectional control
- Better logging and inspection
3. How ASA Processes ICMP Now
Modern ASA evaluates ICMP using ACL logic:
\[ Decision = Match(ACL) \rightarrow Permit \; or \; Deny \]
Each packet is evaluated sequentially.
Packet Matching Logic
\[ Match = (Source \land Destination \land Type \land Code) \]
📘 Expand: Step-by-step flow
1. Packet arrives 2. Interface ACL checked 3. First match wins 4. Action applied
4. Mathematics Behind ACL Decision Making
Binary Matching Model
\[ f(packet) = \begin{cases} 1 & \text{if permitted} \\ 0 & \text{if denied} \end{cases} \]
Probability of Allowed Traffic
\[ P(allow) = \frac{allowed\ packets}{total\ packets} \]
This helps in traffic analysis and anomaly detection.
Entropy of Traffic (Security Insight)
\[ H = - \sum p(x) \log p(x) \]
Higher entropy = more unpredictable traffic → possible attack.
5. Configuration Examples
Example 1: Allow Ping
access-list ICMP_ALLOW extended permit icmp any any echo-reply access-group ICMP_ALLOW in interface outside
Example 2: Block Redirects
access-list ICMP_BLOCK extended deny icmp any any redirect access-list ICMP_BLOCK extended permit icmp any any echo-request access-group ICMP_BLOCK in interface outside
Example 3: Global Policy
access-list GLOBAL_ICMP extended permit icmp any any echo-reply access-list GLOBAL_ICMP extended deny icmp any any redirect access-group GLOBAL_ICMP global
6. CLI Output Example
ASA# show access-list access-list ICMP_ALLOW line 1 extended permit icmp any any echo-reply (hitcnt=45) access-list ICMP_BLOCK line 1 extended deny icmp any any redirect (hitcnt=12) ASA# show conn protocol icmp ICMP outside 192.168.1.10 -> 8.8.8.8 echo
📊 Expand: Understanding Output
- hitcnt → how many times rule matched
- echo → ping request
- redirect → blocked traffic
7. Best Practices
- Allow only required ICMP types
- Block redirects and timestamp
- Restrict source networks
- Log unusual ICMP spikes
Conclusion
Cisco ASA 9.7 fundamentally changed ICMP handling by aligning it with modern firewall design principles. Instead of treating ICMP as an exception, it is now fully integrated into ACL-based security models.
This gives administrators precise control, better visibility, and stronger security posture.
