Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What are ICMP and ping; where are they used in TR7?
Short answer
ICMP (Internet Control Message Protocol, RFC 792) is the protocol that carries the network's own diagnostic and control messages: that a destination cannot be reached, that a packet's time has expired on the way or that a path requires a smaller packet is reported with this protocol; its counterpart in IPv6 is ICMPv6 (RFC 4443). Ping sends an ICMP Echo Request to the destination and measures whether the Echo Reply arrives and how long it takes; it does not use a port. In TR7, ping is used in the Ping-type health check and in Gateway Monitoring, which probes the default gateway of the route table. In Firewall rules, ICMP is selected as the Protocol; this rule is applied as ICMPv6 in the IPv6 rule set. The Allow ICMP rule on the L4 DDoS Management screen of the route table permits ICMP traffic (default Allow). ICMP traffic, which has no concept of a port, is balanced in the Network vService with ANY - L3.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| Load Balancer → Profiles → Health Checks | Check Type = Ping | Checking whether the server responds at the network level |
| Network → Interfaces → Add Route → Default Gateway checked | Gateway Monitoring: No check (default), Default Monitor Profile or Ping-type profiles | Probing the default gateway with ping; the result is in the Gateway Health column on the Route Tables screen |
| Network → Firewall → Add | Protocol = ICMP | Applying the rule to ICMP traffic (ICMPv6 in the IPv6 set) |
| The L4 DDoS Management screen of the route table | Allow ICMP (default Allow), the Smurf rules | Permitting ICMP traffic and limiting ICMP-based attacks |
| Network vService form | Protocol = ANY - L3 | Balancing protocols that do not use ports, such as ICMP |
| WEB-CLI | sys-cmd ping (ping), sys-cmd ping6 (ping6), sys-cmd traceroute (traceroute) | Testing the access and the path from TR7 to a destination |
- Default Monitor Profile probes every 3 seconds, and its timeout is 2 seconds; it becomes OK after 2 consecutive successes and Error after 5 consecutive failures (Gateway Monitoring).
- ANY - L3 restrictions: Can I load balance protocols without ports, such as ICMP, GRE and IPsec (ANY - L3)?
- The effect of gateway monitoring on VIP failover: What is Gateway Monitoring; how does it affect VIP failover?
Common Misconceptions
- "If ping responds, the service is running." Ping shows only access at the network level; it does not prove that the application is running. For a check at the service level, types such as TCP and HTTP are used.
- "Turning ICMP off completely is always safe." Allow ICMP = Deny turns off not only ping but also ICMP messages such as unreachability and packet size notifications.
- "ICMPv6 is selected separately in the Firewall." Only ICMP is in the Protocol list; when the rule is applied to IPv6 addresses, it is written as ICMPv6.
How it is done in the documentation
