ICMP over

[Pedro Orellana C.]

I have a hp-ux D330 in DMZ sector. I need to lower ICMP (services or protocol) by firewall for DMZ.
when I lower the ICMP of DMZ all connections of the machine go away down, i lose ping, telnet , database conection. etc.
I have QPK and HWE of Mar 2004.
Can you help me, please.

[Sundar_7]

lower ICMP ? - you mean blocking it ? - ICMP has got some 8 control codes or functions - if you want to block only the ability of the other machines to ping your machines in the DMZ then you might want to only block the ICMP-Reply (I think the function code 8) and leave the rest of them unblocked.

[Jeff Schussele]

Hi Pedro,

This is most likely due to the default HP behavior of dead gateway detection. This is an ndd feature that will periodically send ICMP packets to the router & if not rec'd back the route is dropped from the routing table.

It can be disabled with an entry of
TRANSPORT_NAME[X]=ip
NDD_NAME[X]=ip_ire_gw_probe
NDD_VALUE=0
in the /etc/rc.config.d/nddconf file and a reboot or a network stop/start. Replace the "X" with an appropriate index value.

HTH,
Jeff

[Jeff Schussele]

Hi Pedro,

This is most likely due to the default HP behavior of dead gateway detection. This is an ndd feature that will periodically send ICMP packets to the router & if not rec'd back the route is dropped from the routing table.

It can be disabled with an entry of
TRANSPORT_NAME[X]=ip
NDD_NAME[X]=ip_ire_gw_probe
NDD_VALUE[X]=0
in the /etc/rc.config.d/nddconf file and a reboot or a network stop/start. Replace the "X" with an appropriate index value.

HTH,
Jeff

[Pedro Orellana C.]

Thank you, but in my firewall i block ICMP, that is all code of ICMP. In DMZ sector i have 3 machine : two SUN and one HP-UX, only HP-ux is affected when ICMP is blocked.

[Ron Kinner]

I think you are running HPUX 10.3 or higher and you are running into Dead Gateway Detection when you shut off ICMP. HPUX pings the gateway periodically to make sure it is still alive. If the ping fails then it won't use the gateway.

You can prove it by:

ndd -set /dev/ip ip_ire_gw_probe 0


then shut off ICMP on your firewall. If that fixes your problem then edit

/etc/rc.config.d/nddconf to make it permanent.

TRANSPORT_NAME[0]=ip
NDD_NAME[0]=ip_ire_gw_probe
NDD_VALUE[0]=0

Ron

PS If it claims there is no such variable then you are missing a patch.

[Sundar_7]

Yeah, I think both the above posts are right on.

# ndd -get /dev/ip ip_ire_status

execute the above command see if you have DOWN status next to any of the routing entries. If yes then you can enable only ICMP-echo reply for the HP-UX server if you are skeptical in enabling all of the ICMP functions.

[Pedro Orellana C.]

Thank you to all, thank you for all, that all ok.