For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Hello_World_146's avatar
Hello_World_146
Icon for Nimbostratus rankNimbostratus
Jun 02, 2014

ICMP Filter

Hi Team,   I would like to set an ICMP filter in a CGNAT so that pings coming from internal clients to the internet (e.g. google.com) can go through normally, but trace routes do not show the inte...
application delivery
LTM
performance
security
Cory_50405's avatar
Cory_50405
Icon for Noctilucent rankNoctilucent
Jun 03, 2014

Unsure if you'll be able to do this on your BIG-IP. It can certainly be done on a firewall or some other filtering device between your BIG-IP and your internal user network. The syntax for a Cisco firewall would be something like this if put on an external facing interface:

 

deny icmp any any time-exceeded

 

This should block just ICMP type 11 messages. And you could refine your ACL to only include your internal network to be more thorough.