Hello Team,

i need your help about acl on apm.Namely, I am able to give remote access with acl and everything's ok . No problem on that. But. ı am unable to make configuration for icmp. As you know We are able to specify either tcp or udp or all protocols on the  action type.However, ı need to allow icmp echo packets on the acl. If i remove the discarding acl ok I can ping to backend side but at this time you know we need to add all ports one by discard. I wonder can we use an irule for that? Or is there another way besides of this? Because I am trying to make user based autentication and no problem on that.Namely, users are able to connect to system through AD. I mean if user is john , he goes to 80 port of server but if user is ken , he goes to port 389 of again.   


content of  test_acl example:

for allow;

type : static

Source IP Address:Any

Source IP Port:Any

Destination IP Address:

Destination IP Port:80





for discard;


type : static

Source IP Address:Any

Source IP Port:Any

Destination IP Address:Any

Destination IP Port:AllPort





Thank you in advance

5 Answer(s):

Hello Waterfall
Mayby this helps:
Network ›› Packet Filters : Rules ›› New Packet Filter Rule...
At least, you can configure icmp, but i didn't try it.

what you said is for only existing vlan on network configuration for ltm but i already want to allow icmp trafficinstead of discarding or rejection if i do as you said at that time it won't work in the acl table which i will create . i think it must be different way of that

acls support only tcp, udp and any (ip protocols)
with the filter configuration you have the ability to allow icmp and the tcp ports you need.

see also
"Using Packet Filters
Another tool made available to use for configuring our sources and destinations are Packet Filters.
These are configured on the BIG-IP system at a global level. This means that packet filters will
impact all traffic traversing the BIG-IP system. This is useful in the case of setting global security for
non TCP and UDP traffic such as ICMP."

But you can also
- allow tcp you need
- drop tcp
- drop udp
- allow all
but there are a lot of protocols which are allowed with this rule


Am having the same problem/challenge. Migrating from a Firepass which allows rules for ICMP per Resource Group to an APM which seems to only allow Packet Filters for ICMP on a per Virtual Server basis. I don't want to have to put in a Virtual Server to replace each Resource Group. Is there another way to apply a filter like that closer to the destination?

Thanks in advance



You cannot set the protocol from the gui, however within the cli/configuration protocol can be set to any protocol number
1 -> ICMP
6 -> TCP
17 -> UDP
Anything but TCP/UDP will show up as any in the gui, but will conform to the protocol numbers as specified in the configuration.

As I am writing this I am questioning myself, however I do recall running into the exact issue and finding this to be the solution.

Your answer: