[c-nsp] ICMP Filtering on firewall

[varaillon]

Hi,

We are filtering and rate limiting icmp traffic on our border router to let
in&out:

Echo
Echo-reply
Unreachable
Time-exceeded

What about icmp to our firewall's interfaces?

Shouldn't I allow the firewall to respond to or send those icmp messages as
well?

What would be the best current practices regarding ICMP traffic ti
firewalls' interfaces?

Thank you!

Christophe