Re: ICMP Packets.

>1) Is there any reason that echo reply would need to be allowed out in =
>response to an external request? I know this is the case for other ICMP =
>messages such as packet-too-big, but I am not sure why echo-reply would =
>ever be needed

Sometimes, if you have your own DNS domain, your NIC will want to ping your
DNS server at regular intervals to check that it is alive; since the DNS
server is likely to be inside your perimeter router, this is one possible
instance where it may be necessary. I saw this happen with ".com.ru", IIRC.

Nonetheless, as other have said, ban *everything* and then only explicitly
permit the minimum set of functionality that is required for business function.

        - alec

-- 
    alec muffett, sun microsystems laboratories, alec.muffett @ uk.sun.com
               birds and planes go through the rainbow every day