On May 17, 2006, at 12:28 AM, Francois Audet wrote:
9. ICMP Destination Unreachable Behavior REQ-12: Receipt of any sort of ICMP message MUST NOT terminate the NAT mapping. a) The NAT's default configuration SHOULD NOT filter ICMP messages based on their source IP address. b) It is RECOMMENDED that a NAT support ICMP Destination Unreachable messages. Spencer: two points here - there is no "unless" for the SHOULD NOT/RECOMMENDEDs, which is really needed, but after looking at the text earlier in this section, I'm not sure why these aren't MUST NOT/REQUIREDs, anyway.I don't really recall why it is a SHOULD instead of a MUST.
We had push back that many lame FW devices just drop all ICMP and the WG finally came to an acceptable middle ground by making these devices "behave compliant" but not "fully behave complaint". Keep in mind that totally breaking ICMP practically has almost no effect on any real applications so most "expert advice" (like books) on configuring firewalls actually suggests at least partially breaking ICMP.
_______________________________________________ Gen-art mailing list [email protected] https://www1.ietf.org/mailman/listinfo/gen-art
