Your IpGenericFilterAction should be configured like this with DiscardAction ICMP on a separate line.
IpGenericFilterAction icmpreply
{
IpFilterAction deny
DiscardAction ICMP
IpFilterLogging yes
}
The general parsing syntax for policy agent is to have 1 attribute and value per line. Any remaining information on the line is treated as a comment and ignored. So DiscardAction ICMP was treated as a comment and ignored as you had determined.
The following section covers general policy agent syntax.
https://www.ibm.com/docs/en/zos/2.4.0?topic=files-general-syntax-rules-policy-agent
There are exceptions among the various policy types but they should be noted.
------------------------------
Joyce Anne Porter
------------------------------
Original Message:
Sent: Thu November 30, 2023 07:25 AM
From: Colin Paice
Subject: Using IpFilterAction deny DiscardAction ICMP
Im having problems getting the Discard action to work ( or even to be picked up from the Policy Agent!)
I have
IpFilterRule ColinInICMP
{
IpSourceAddr 10.1.0.2
IpDestAddr 10.1.1.2
IpGenericFilterActionRef icmpreply
IpService
{
Protocol icmp
Direction inbound
Routing local
}
IpGenericFilterAction icmpreply
{
IpFilterAction deny DiscardAction ICMP
IpFilterLogging yes
}
This is giving me DiscardAction Silent.
If I change it to
IpFilterAction deny DiscardActionzz ICMPzzzzz
It is processed with no errors. It looks like the DiscardAction... is ignored. I'm on z/OS 2.4.
Am I missing something?
Colin
------------------------------
Colin Paice
------------------------------