Enable ICMP on Okta Access Gateway Appliances

Administrators may need to occasionally enable or disable the Internet Control Message Protocol (ICMP) utility on Okta Access Gateway (OAG) appliances for network troubleshooting. Execute specific firewall commands on the appliance to unblock or block ICMP traffic.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Access Gateway (OAG)
• Internet Control Message Protocol (ICMP) Utility

How do administrators enable ICMP on an Okta Access Gateway appliance?

Enable the Internet Control Message Protocol (ICMP) utility by running the firewall commands on the appliance to unblock the traffic and reload the service. The commands need to be executed from the shell. 

Administrators enable ICMP using individual commands.

Execute the commands sequentially to unblock ICMP and verify the firewall configuration.

1. Run the following commands to unblock ICMP:
   

   sudo firewall-cmd --zone=public --add-icmp-block-inversion --permanent

   sudo firewall-cmd --zone=public --add-icmp-block={echo-request,echo-reply} --permanent

   sudo systemctl reload firewalld.service

2. Print the firewall configuration to verify the changes:
   

   sudo firewall-cmd --list-all

Administrators enable ICMP using a single-line script.

Run the individual node script to print the starting configuration, apply the changes, and print the updated configuration with timestamps.

1. Execute the following script:
   
   echo -n "This is the starting configuration: " $(date); echo; sudo firewall-cmd --list-all;sudo firewall-cmd --zone=public --add-icmp-block-inversion --permanent;sudo firewall-cmd --zone=public --add-icmp-block={echo-request,echo-reply} --permanent;sudo systemctl reload firewalld.service; echo -n "The change has been made and can be seen below: "$(date);echo; sudo firewall-cmd --list-all;

Administrators disable the ICMP utility by executing firewall commands.

Disable the ICMP utility by running the firewall commands on the appliance to block the traffic and reload the service.

Administrators disable ICMP using individual commands.

Execute the commands sequentially to block ICMP and verify the firewall configuration.

1. Run the following commands to block ICMP:
   

   sudo firewall-cmd --zone=public --remove-icmp-block-inversion --permanent

   sudo firewall-cmd --zone=public --remove-icmp-block={echo-request,echo-reply} --permanent

   sudo systemctl reload firewalld.service

2. Print the firewall configuration to verify the changes:
   

   sudo firewall-cmd --list-all

Administrators disable ICMP using a single-line script.

Run the individual node script to print the starting configuration, apply the changes, and print the updated configuration with timestamps.

1. Execute the following script:
   
   echo -n "This is the starting configuration: " $(date); echo;sudo firewall-cmd --list-all; sudo firewall-cmd --zone=public --remove-icmp-block-inversion --permanent; sudo firewall-cmd --zone=public --remove-icmp-block={echo-request,echo-reply} --permanent; sudo systemctl reload firewalld.service; echo -n "The change has been made and can be seen below: "$(date);echo; sudo firewall-cmd --list-all;