Denying Ping

• ICMP is not available in the "Service" column of the security policies. Instead, the option to block ping is available in the "Application" column.

• ICMP service not available in the Service tab:

 

• Ping App-ID available under Security Policy>Application tab:

• Palo Alto Networks does not recommend blocking ICMP as it is an important networking protocol used for diagnostic purposes. It is recommended to only block ping as this affects only echo request packets.

owner: panagent

• To block specific ICMP type and not all types, please follow this link to create a custom App-ID to block/allow: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFZCA0