ICMP
The Internet Control Message Protocol (ICMP) is a protocol layered onto the Internet Protocol Suite to provide error reporting flow control and first-hop gateway redirection. It is normally used by the operating systems of networked computers to send connectivity status query, response and error messages. It is assigned protocol number 1. There is a version of the protocol for both IPv4 and for IPv6. It is not designed to be absolutely reliable like TCP.
ICMP is not typically used for transporting data or for end-user network applications with the exception of some diagnostic utilities such as ping and traceroute.
ICMP messages are sent in several situations, for example:
• when a datagram cannot reach its destination,
• time exceeded messages
• redirect messages
• when the gateway does not have the buffering capacity to forward a datagram
• when the gateway can direct the host to send traffic on a shorter route.
Some of the specific ICMP message types are:
• ICMP_ECHO
• ICMP_TIMESTAMP
• ICMP_INFO_REQUEST
• ICMP_ADDRESS
For ICMP error messages, only those reporting an error for an existing session can pass through the firewall. The security policy will allow traffic to be routed, forwarded or denied. If allowed, the ICMP packets will start a new session. Only ICMP error messages of a corresponding security policy is available will be sent back to the source. Otherwise, the packet is dropped. That is, only ICMP packets for a corresponding security policy can traverse the FortiGate unit.