 Cisco routers and PIX firewalls: access-list 101 remark Allows PING and Traceroute >] access-list 101 permit icmp any any unreachable access-list 101 permit icmp any any time-exceeded access-list 101 permit icmp any any echo-reply interface Ethernet1 ip access-group 101 in Designing Access Lists Or using named access lists: ip access-list extended Allow-ICMP remark [< Allows PING and Traceroute >] permit icmp any any unreachable permit icmp any any time-exceeded permit icmp any any echo-reply interface GigabitEthernet1/0/1 ip access-group Allow-ICMP in Firewalls: object-group icmp-type ICMP-Types description [< Allowed ICMP Types >] icmp-object unreachable icmp-object time-exceeded icmp-object echo-reply access-list Inbound permit icmp any any object-group ICMP-Types access-group Inbound in interface outside Allowing MTU Path Discovery Packets Maximum Transmission Unit (MTU) path discovery allows devices on remote net- works to inform you of MTU limitations. To enable this, you must allow two more ICMP types: source-quench and parameter-problem. You can allow them on Cisco routers and PIX firewalls as follows: Cisco routers: access-list 101 remark [< Allows PING and Traceroute >] access-list 101 permit icmp any any unreachable access-list 101 permit icmp any any time-exceeded access-list 101 permit icmp any any echo-reply access-list 101 permit icmp any any parameter-problem access-list 101 permit icmp any any source-quench interface Ethernet1 ip access-group 101 in And with named access lists: ip access-list extended Allow-ICMP remark [< Allows PING and Traceroute >] permit icmp any any unreachable permit icmp any any time-exceeded permit icmp any any echo-reply permit icmp any any parameter-problem permit icmp any any source-quench interface GigabitEthernet1/0/1 ip access-group Allow-ICMP in Chapter 25: Access Lists Firewalls: object-group icmp-type ICMP-Types description [< Allowed ICMP Types >] icmp-object unreachable icmp-object time-exceeded icmp-object echo-reply icmp-object source-quench icmp-object para