How to Solve Ping Attacks on a Cisco Router?

“I do not use a firewall in my Cisco router. Recently I am having the problem of ping flooding or ICMP attacks. Is there a way to solve it?”

The question was posted recently in a networking forum and did not get many replies. We will show a configuration to counter this problem in this article. Cisco routers are one of the most stable routers out there, but you still need to guard it against ping attacks.

How could a Firewall Help?

First, it is really necessary that you use a proper Firewall for your Internet connected Cisco router. But if for some reasons you are unable to do it, here is a configuration that will help you. We tried it on a company who faced ping flooding, yet did not want to use firewall as they utilized ping for monitoring and troubleshooting.

You can make an access list authorizing only work stations IP addresses.
For dynamic IP addresses, you can use this method. You will need to use ping software like hrPing, Cisco router counters and a program like Wireshark.

The commands for Cisco router are as follows:
access-list 111 permit icmp any echo
access-list 111 permit icmp any any echo-reply
interface GigabitEthernet0/1
rate-limit input access-group 111 22000 22000 22000 conform-action transmit exceed-action drop

The configuration was tested by excessive pings from hrPing and observation with Wireshark and Cisco router counters. Be sure to keep any eye on system usage and Cisco router memory for any unusual performance.