Allowing ICMP Broadcasts through the ProxySG.

Products

• ProxySG Software - SGOS

Issue/Introduction

How do I enable the ProxySG to allow ICMP Broadcast Echos through the ProxySG.

Resolution

Disabling the ICMP broadcast echo command can prevent the ProxySG from participating in a Smurf Attack. A Smurf attack is a type of Denial-of-Service (DoS) attack, where the attacker sends an ICMP echo request packet to an IP broadcast address. This is the same type of packet sent in the ping command, but the destination IP is broadcast instead of unicast. If all the hosts on the network send echo reply packets to the ICMP echo request packets that were sent to the broadcast address, the network is jammed with ICMP echo reply packets, making the network unusable. By disabling ICMP broadcast echo response, the ProxySG does not participate in the Smurf Attack. This setting is disabled by default.

 

At the (config) command prompt, enter the following command:
 

 

To enable or disable ICMP broadcast echo support:

SGOS#(config) tcp-ip icmp-bcast-echo {enable | disable}