5) access-list Inbound line 8 permit icmp any any time-exceeded (hitcnt=14) access-list Inbound line 8 permit icmp any any echo-reply (hitcnt=822) Allowing Outbound Traceroute and Ping One of the more common frustrations with firewalls is the inability to ping and traceroute once the security rules are put in place. The idea that ICMP is dangerous is valid, but if you understand how ICMP behaves, you can allow only the types you need, and thus continue to enjoy the benefits of ping and traceroute. Assuming that you're allowing all outbound traffic, you can apply packet filters that allow as inbound traffic only those reply packets that are the result of ping and traceroute commands. This will allow your tests to work when initiated from inside the network, while disallowing those same tests when they originate from outside the network. To allow these tools to work, you must allow the following ICMP packet types in from the outside: ICMP unreachable There are many ICMP unreachable types, including network unreachable, and host unreachable. Generally, allowing them all is acceptable because they are response packets. Chapter 23: Access Lists Time exceeded Time exceeded messages are sent back by traceroute at each hop of the path taken toward the intended destination. Echo reply An echo reply is the response from a ping packet. The packet filters are usually included at the end of whatever inbound access lists are already in place. They should generally be placed at the bottom of the ACL, unless there is a large amount of ICMP traffic originating inside your network. Here are some examples of deploying these filters for Cisco routers and PIX firewalls: Cisco routers: access-list 101 remark [< Allows PING and Traceroute >] access-list 101 permit icmp any any unreachable access-list 101 permit icmp any any time-exceeded access-list 101 permit icmp any any echo-reply interface Ethernet1 ip access-group 101 in Firewalls: object-group icmp-type ICMP-Types description [< Allowed ICMP Types >] icmp-object unreachable icmp-