Description


As a Security measure we can block icmp type 13 & 14, so that the device is not open to others providing information about the clock state of the device.
 

Symptoms


To block icmp type 13 & 14 messages :

Type 13 = for timestamp message
Type 14 =  for timestamp reply message
 

Solution

 

It can be configured as a firewall filter:

set firewall filter ab term 1 from destination-address 1.1.1.1/32
set firewall filter ab term 1 from protocol icmp
set firewall filter ab term 1 from icmp-type timestamp-reply
set firewall filter ab term 1 from icmp-type timestamp
set firewall filter ab term 1 then count abcd
set firewall filter ab term 1 then reject
set firewall filter ab term 2 from source-address 1.1.1.1/32
set firewall filter ab term 2 from protocol icmp
set firewall filter ab term 2 from icmp-type timestamp-reply
set firewall filter ab term 2 then count xyz
set firewall filter ab term 2 then reject
set firewall filter ab term 3 then accept

set interfaces <interface-name> unit 0 family inet filter input ab
set interfaces <interface-name> unit 0 family inet filter output ab
set interfaces <inetrafec-name> unit 0 family inet address 1.1.1.1/24



Or as a custom application, which can be referenced in a security policy to be blocked:


set applications application Custom-ICMP protocol icmp
set applications application Custom-ICMP icmp-type timestamp|timestamp-reply

set security policies from-zone TEST to-zone TEST policy Example-ICMP match source-address any
set security policies from-zone TEST to-zone TEST policy Example-ICMP match destination-address any
set security policies from-zone TEST to-zone TEST policy Example-ICMP match application Custom-ICMP
set security policies from-zone TEST to-zone TEST policy Example-ICMP

Modification History

.