Overview

In the realm of B2B telecommunications, securing the network edge is paramount. Disabling the ICMP ping response on your Optical Network Terminal (ONT) WAN port is a fundamental security hardening technique used to obscure the device from casual network discovery and potential DDoS amplification attacks. This FAQ provides definitive, expert-level answers for network architects and engineers on implementing this stealth configuration, alongside critical pre-sales and post-sales queries for high-performance routing switches.

Frequently Asked Questions

Q1: How do I disable ICMP ping response on my ONT WAN port for stealth?

The definitive method is to configure an Access Control List (ACL) on the WAN interface that explicitly denies ICMP echo-request packets. The exact command syntax is interface wan 0/0/0 ip access-group DROP_ICMP in where the ACL is defined as access-list 100 deny icmp any any echo. This prevents the ONT from replying to pings from the public internet, effectively hiding the device from basic reconnaissance scans. It is crucial to ensure that this policy does not interfere with necessary ICMP messages required for Path MTU Discovery (Type 3, Code 4) to avoid performance degradation.

Q2: Does disabling ICMP ping response affect network monitoring or SLA reporting?

Yes, it will break standard ICMP-based monitoring probes (e.g., from PRTG, Nagios, or SolarWinds) that rely on ping responses to check device up-time and latency. To maintain monitoring stealth while preserving visibility, it is recommended to configure a separate management ACL that permits ICMP echo-requests only from a specific, trusted network management subnet (e.g., access-list 100 permit icmp 10.10.0.0 0.0.0.255 any echo) while denying all other sources. This balances security with operational observability.

Q3: Can I disable ICMP ping via the ONT's web interface or only through CLI?

While some ONT models offer a simple GUI toggle under 'Security Settings' or 'Firewall' to enable 'Stealth Mode' or 'Ignore Ping from WAN', the most granular and reliable method is via the Command-Line Interface (CLI). The CLI provides precise control over interface-level application of ACLs and ensures configuration consistency, especially when automating security policies across hundreds of edge devices in a large-scale deployment.

Q4: What are the potential side effects of disabling ICMP ping on the WAN port?

Beyond the impact on monitoring, the primary side effect is the potential disruption of ISP-side diagnostic tools used for line testing and fault isolation. By blocking ICMP, you may prolong troubleshooting times during service outages, as ISPs often use ping as a first-line test. Additionally, it renders the ONT invisible to IPv6 Neighbor Discovery probes. Documentation of the change in the network operations log is critical to avoid confusion during incident response.

Q5: What is the maximum switching throughput of the associated core switch?

The maximum switching capacity is 2.56 Tbps with a forwarding performance of up to 1,920 Mpps. This line-rate capability is driven by a high-performance ASIC architecture that ensures zero packet loss even under full-duplex traffic conditions across all 48x 10G and 8x 100G uplink ports, making it ideal for data center spine-leaf topologies.

Q6: What are the optical transceiver compatibility requirements for 100G uplinks?

This platform fully supports standard-compliant MSA (Multi-Source Agreement) QSFP28 transceivers for 100G Ethernet, including SR4, LR4, and AOC (Active Optical Cables) types. While the device accepts third-party optics via manual vendor ID whitelisting through CLI commands, users must ensure the transceiver's maximum power budget and optical reach (e.g., 100m for SR4, 10km for LR4) match the specific network link requirements to maintain reliable Layer-1 connectivity.

Q7: How do I troubleshoot if the ONT loses connectivity after applying the ACL?

If connectivity is lost, it is likely due to an overly restrictive ACL that is blocking DHCP or ARP requests required for WAN link establishment. The immediate troubleshooting step is to establish a console connection (via RJ45 serial) to the ONT, access the CLI, and append a permit statement at the top of the ACL for essential protocols (e.g., permit udp any any eq bootps and permit udp any any eq bootpc). Alternatively, temporarily remove the ACL from the interface via no ip access-group DROP_ICMP in to restore connectivity, then re-apply a corrected version.

Q8: Is MACsec supported on the WAN interface for additional data plane encryption?

Yes, this hardware platform supports IEEE 802.1AE MACsec (Media Access Control Security) on the WAN and uplink interfaces to provide line-rate encryption for traffic between the ONT and the upstream aggregation switch. MACsec is configured via the CLI using MKA (MACsec Key Agreement) protocols and requires a shared Connectivity Association Key (CAK) to authenticate and encrypt the physical link. This provides robust Layer 2 security without the overhead of IPsec, complementing the stealth provided by disabling ICMP.