For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Hello_World_146's avatar
Hello_World_146
Icon for Nimbostratus rankNimbostratus
Jun 02, 2014

ICMP Filter

Hi Team,   I would like to set an ICMP filter in a CGNAT so that pings coming from internal clients to the internet (e.g. google.com) can go through normally, but trace routes do not show the inte...
application delivery
LTM
performance
security
Cory_50405's avatar
Cory_50405
Icon for Noctilucent rankNoctilucent
Jun 02, 2014

I would think in order to not show the CGNAT hops, you would want to block ICMP from your CGNATs back to the internal client network. Traceroute depends on network devices to send back ICMP time exceeded messages to the client once the TTL reaches zero. So if you prevent the ICMP messages (type 11) from your CGNAT back to your internal network, then that should achieve what you wish.