Inbound turbo-configured; 20 elements access-list Inbound line 1 permit udp any object-group Webservers object-group Webserver-svcs-udp Chapter 25: Access Lists access-list Inbound line 1 permit udp any host gto eq domain (hitcnt=7611) access-list Inbound line 1 permit udp any host meg eq domain (hitcnt=7244) access-list Inbound line 2 permit tcp any object-group Webservers object-group Webserver-svcs access-list Inbound line 2 permit tcp any host gto eq WWW (hitcnt=22578) access-list Inbound line 2 permit tcp any host gto eq ssh (hitcnt=4430) [-- text removed -- ] Allowing Outbound Traceroute and Ping One of the more common frustrations with firewalls is the inability to ping and traceroute once the security rules are put in place. The idea that ICMP is dangerous is valid, but if you understand how ICMP behaves, you can allow only the types you need, and thus continue to enjoy the benefits of ping and traceroute. Assuming that you're allowing all outbound traffic, you can apply packet filters that allow as inbound traffic only those reply packets that are the result of ping and traceroute commands. This will allow your tests to work when they're initiated from inside the network, while disallowing those same tests when they originate from outside the network. For these tools to work, you must allow the following ICMP packet types in from the outside: ICMP unreachable There are many ICMP unreachable types, including network unreachable and host unreachable. Generally, allowing them all is acceptable, because they are response packets. Time exceeded Time exceeded messages are sent back by traceroute at each hop of the path taken toward the intended destination. Echo reply An echo reply is the response from a ping packet. The packet filters are usually included at the end of whatever inbound access lists are already in place. They should generally be placed at the bottom of the ACL unless there is a large amount of ICMP traffic originating inside your network. Here are some ex- amples of deploying these filters for