Endpoint Protection

  • Private Community
 View Only

  • 1.  SEP logs showing ICMP [type=3, code=3] being blocked

    Posted May 07, 2018 01:44 AM

    Hi,

    I have ICMP [type=3, code=3] being blocked:

    Source x.y.128.124 [netmask is x.y.255.255.255.224] 

    Destination is x.y.246.161 

    ====

    Source is a Windows 2012R2 host with a route table entry:

    Network Desitnation/Netmask/Gateway/Interface/Metric

    0.0.0.0/0.0.0.0/x.y.128.97/x.y.128.124/261

    ====

    Destination is a "back box" device Linux based with no user sign-on

    I have allowed ping ICMP[type=2] between  x.y.128.124->x.y.246.161

    x & y represent the same IP "octet". The gateway for source is correct for our network.

    Source and Destination are on different VLANs.

    ==> Can someone please suggest why ICMP [type=3, code=3] being blocked?

    A google search shows that ICMP [type=3, code=3] is usually caused by a "network unreacheable" error.

    However this article:

    https://www.wilderssecurity.com/threads/type-3-code-3.187716/

    could be caused by an IGMP error when trying to get route information

    ==> Any thoughts on this problem?



  • 2.  RE: SEP logs showing ICMP [type=3, code=3] being blocked

    Posted May 07, 2018 10:45 AM

    SEP firewall has a default rule that blocks it. If for some reason it needs to be allowed then create a rule to allow it and move up to the top of the firewall rule stack.