Information
The ICMP supports IP traffic by relaying information about paths, routes, and network conditions. Routers automatically send ICMP messages under a wide variety of conditions. Host unreachable ICMP messages are commonly used by attackers for network mapping and diagnosis.
Solution
Disable ICMP unreachable notifications on all external interfaces.
Step 1: The Arista router can be configured to filter out the ICMP Unreachable for (Type 3) code 0 (Network unreachable) IPv4 and IPv6 packets with the following command:
router(config)#ip icmp rate-limit-unreachable 0
router(config)#ipv6 icmp rate-limit-unreachable 0
Step 2: The Arista router can be configured to filter out the ICMP Unreachable for (Type 3) code 1 (Network unreachable) IPv4 and IPv6 packets with the following command:
router(config)#ip access-list BLK-ICMP-Unreachables
10 deny icmp any any host-unreachable
20 permit ip any any
!
Step 3: This would need to be applied on the egress interface (for example as in et1 below):
router(config)#interface ethernet1
no routerport
ip address 32.1.1.12/24
ip access-group BLK-ICMP-Unreachables out
!