Best way to allow ICMP

[Fabian1]

Hi everyone,

I have some subnets were we are very strict with allowing traffic. Now at the end of the ACL I simply say, deny ANY.

In the protocol list of the acl there is no ICMP, just TCP, UDP and any.

Where can I configure to allow ICMP? Or do I have to change the deny any at the end and deny tcp and udp to allow ICMP? I'm a bit confused here...

Thank you!

[KarstenI · Accepted solution]

You are talking about the ACLs that you can configure on the Switches?

Then you are IMO out of luck. With an ACL

   deny tcp
   deny udp
   allow IP

ICMP should work, but also all other IP protocols that you likely don't want. This is a job for a firewall.