What configuration should you apply to a firewall to allow internal ping requests while blocking external traceroute requests?

• A. Allow all ICMP traffic and block TCP connections
• B. Permit inbound ICMP echo replies and block outbound ICMP Time Exceeded
• C. Block all inbound and outbound ICMP traffic
• D. Block all outbound ICMP Time Exceeded in Transit

Answer: (D)

To achieve the goal of allowing internal ping requests while blocking external traceroute requests, it’s essential to focus on the behavior of ICMP traffic. Traceroute typically utilizes ICMP echo requests (type 8) and receives Time Exceeded messages (often ICMP type 11) as it identifies the path to a destination.

Blocking outbound ICMP Time Exceeded messages in transit ensures that your firewall does not allow responses that would reveal the path information to an external source. This configuration effectively prevents an external entity from using traceroute against your network, thereby enhancing security. At the same time, internal ping requests can still be processed normally since internal traffic is generally not restricted in this scenario.

This selective blocking maintains the necessary operational functionality for internal communications while minimizing exposure to potentially abusive reconnaissance techniques from the outside.