3.11 Ensure Drop Out of State ICMP Packets is enabled

Information

This drops the out of state ICMP packets.

Rationale:

The Firewall verifies that each ICMP reply packet matches a previous request, and each ICMP error matches an existing connection. Out of State ICMP packets should be dropped and logged.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Go to the following path and checked the Drop Out of State ICMP Packets and Log on Drop.

SmartConsole > Global Properties > Stateful Inspection
Checked the Drop Out of State ICMP Packets and Log on Drop

Default Value:

Enabled

See Also

https://workbench.cisecurity.org/files/2828

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION

References: 800-53|CA-3, CSCv7|12.1

Plugin: CheckPoint

Control ID: e299bd8f6e26f20b29f025337191633718a8e0bc00bd57f6e2b911d966e6a078