What does no IP Unreachables mean?
The “no ip unreachables” also helps you when you have an ACL configured on the interface with deny statements with log. The router needs to punt the packet to the CPU which must generate an icmp unreachable message for each dropped packet.
What does ip unreachables do?
The purpose of configuring no ip unreachables is to suppress the router from sending an ICMP unreachable message (i.e. Administratively Prohibited, Host Unreachable, etc) out an external interface when it receives a packet that is denied by an ACL or for which it has no route.
What does no IP Proxy ARP mean?
When you configure no ip proxy-arp on the interface you are instructing IOS that it should not respond to an ARP request for a remote address.
What is service pad in Cisco?
service pad. To enable all packet assembler/disassembler (PAD) commands and connections between PAD devices and access servers, use the service pad command in global configuration mode. To disable this service, use the no form of this command.
How is no IP unreachables a security feature?
The “no ip unreachables” will silently drop the packets and not generate an unreachable back to the initiator. This is also a security feature, if an attacker is trying to break through he will never know there is a router in between that is dropping these packets because he never get the unreachable messages back.
Why is disabling ICMP unreachables is a bad thing?
Disabling ICMP unreachables can increase security: An attacker could gather information’s about your network when scanning it, like unused IP’s and networks. When working with (interface-) Access-Lists, a deny statement triggers an ICMP Type 3 Code 9/10 message (Network/Host is Administratively Prohibited).
When to use No IP unreachables in ACL?
The “no ip unreachables” also helps you when you have an ACL configured on the interface with deny statements with log. The router needs to punt the packet to the CPU which must generate an icmp unreachable message for each dropped packet. In a situation where there are lots of denied packets it could keep the CPU busy in generating these packets.
Can a Cisco switch generate host unreachable messages?
01-12-2007 07:07 AM In addition to the above post i would like to add that a Cisco switch can generate automatically three types of ICMP messages: Host Unreachable, Redirect and Mask Reply. An attacker can use these messages to aid in mapping a network. Hence these commands are generally disabled on the interface as a security policy.