I have IPSec tunnel set up between 2 routers. It used to work fine, however recently I hardened policy in IDS and I started getting alerts about ICMP type 11 code 1 being sent from one router to another.

What does Time exceeded mean in context of IPSec, is it safe, what other ICMP types/codes should I allow for proper IPSec operation?

  • I think it's performance issue, CPU in weaker router is maxed to 100%. After disabling one of connected workstation which generated most of traffic router stopped generating Time exceeded packets. – Lapsio Aug 5 '17 at 14:18

Most Time Exceeded messages are from someone running traceroute. Aside from that it could indicate a few relatively rare things, like you have a routing loop, or you have a machine with a too-low default TTL value, or really do have an excessively long route that's not a loop.

In general, don't block ICMP messages. It's a newbie mistake new firewall admins make all the time. ICMP is critical for a lot more than just ping, and if you block it you're going to break path MTU discovery and a bunch of other things.

  • I'm not blocking all ICMP - I'm passing echo and MTU discovery. That's why I'm asking which types are "okay". I prefer whitelisting over blacklisting. I've seen many professional, hardened, production security systems that blocked ICMP. Also there are known attacks to some ICMP types – Lapsio Aug 5 '17 at 18:25
  • I strongly recommend that you blacklist only those ICMP types that you know still have active attacks against them. There's a lot of mythology among layman firewall admins recommending blocking protocols just because one implementation on one OS had an exploit that was patched 20 years ago. Or because it presents the most minor of information leaks. But when those protocols are the Control Messages of the Internet, that's not a wise approach. – Spiff Aug 7 '17 at 3:03
  • Blocking ICMP is not wise when network is in development. But with static network where those ICMP messages actually shouldn't occur during normal operation, blocking them on fw and generating alerts helps in network anomaly detection. As I said this time it's router overload. Without those IDS alerts I probably wouldn't notice that router CPU is topped during network storage access. In fact most of ICMP messages should never be generated in properly operating network. Security implications are obvious - and I'm not talking about actual exploits but environment recognition like eg. ping sweep – Lapsio Aug 7 '17 at 18:51

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.