Home / server / Questions / 28935
In Process
Peter
Asked: 2009-06-20 12:56:19 +0800 CST

Juniper firewall - large pings for testing

  • 772

Is there an way to permit ping packets larger than 1472 through a Juniper SSG520M firewall?

"Ping of Death" and "Large Size ICMP Packet" protection has already been disabled under the 'Screening' options.

I need to be able to ping from the Trust side to the Untrust side (and perhaps vice versa) with packets larger than 1500 (i.e. ping 192.168.1.1 -l 4096) so I can force fragmentation.

firewall ping juniper

2 Answers

  1. Note that linux ping by default these days seems to set the don't fragment bit. Check the man page for your implementation (as there are several depending on distribution sigh).

    For the "iputils" version you want the "-M dont" option.

    • 1

  2. If you login to the cli, you should be able to see why the ping is being dropped with ffilter Something along the lines of set ffilter dst-ip <whatever> src-ip <whatever>

    Should tell you what rule is actually dropping the ping, so you can turn it off.

    • 1