> > I am just wondering how many people have ICMP Destination Unreachables > > disabled on their core routers. Could an CPE router, which may encapsulate > > data, be able to depend on ICMP Unreachables to be sent to it? > > > > I know there are many cases where router implementations default it to off > > (to not send ICMP DUs), but wondering who leaves it this way or turns them > > on? Of when it defaults to on, who explicitly turns them off. > > Most of people who disable ICMP DU just don't understand what ICMP DU > is for. Need I mention that PMTUD relies on ICMP type 3/code 4... > In addition, it looks like that "no ip unreach" interface command > disables "too big" message as well, breaking PMTUD. > I prefer to enable ICMP DU on any interfaces where fragmentation may occur.
There is also a middle ground here - leave ICMP Destination Unreachable on but rate limit the replies to a suitably low value. This means that you will *probably* get a reply, but it's certainly not guaranteed. Steinar Haug, Nethelp consulting, [EMAIL PROTECTED] _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
