diff --git a/server/src/main/java/com/cloud/network/vpc/NetworkACLServiceImpl.java b/server/src/main/java/com/cloud/network/vpc/NetworkACLServiceImpl.java
index f99ea6b9b8c7..098a19ff23d3 100644
--- a/server/src/main/java/com/cloud/network/vpc/NetworkACLServiceImpl.java
+++ b/server/src/main/java/com/cloud/network/vpc/NetworkACLServiceImpl.java
@@ -946,7 +946,7 @@ protected void updateIcmpCodeAndType (boolean isPartialUpgrade, UpdateNetworkACL
     }
 
     private void updateIcmpCodeAndTypeFullUpgrade (Integer icmpCode, Integer icmpType, NetworkACLItemVO networkACLItemVo) {
-        if (networkACLItemVo.getProtocol().equalsIgnoreCase(NetUtils.ICMP_PROTO)) {
+        if (NetUtils.ICMP_PROTO.equalsIgnoreCase(networkACLItemVo.getProtocol())) {
             networkACLItemVo.setIcmpCode(icmpCode != null ? icmpCode : -1);
             networkACLItemVo.setIcmpType(icmpType != null ? icmpType : -1);
         } else {
diff --git a/server/src/test/java/com/cloud/network/vpc/NetworkACLServiceImplTest.java b/server/src/test/java/com/cloud/network/vpc/NetworkACLServiceImplTest.java
index b24136972ad8..6e31aad078c6 100644
--- a/server/src/test/java/com/cloud/network/vpc/NetworkACLServiceImplTest.java
+++ b/server/src/test/java/com/cloud/network/vpc/NetworkACLServiceImplTest.java
@@ -45,6 +45,7 @@
 import org.apache.cloudstack.context.CallContext;
 import org.apache.commons.lang3.StringUtils;
 import org.junit.Assert;
+import org.springframework.test.util.ReflectionTestUtils;
 import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
@@ -1506,4 +1507,16 @@ public void validateAclAssociatedToVpcTestNullVpcShouldThrowInvalidParameterValu
 
         networkAclServiceImpl.validateAclAssociatedToVpc(networkMockVpcMockId, accountMock, SOME_UUID);
     }
+
+    @Test
+    public void updateIcmpCodeAndTypeFullUpgradeHandlesNullProtocol() {
+        NetworkACLItemVO rule = new NetworkACLItemVO();
+        rule.setIcmpCode(5);
+        rule.setIcmpType(8);
+
+        ReflectionTestUtils.invokeMethod(networkAclServiceImpl, "updateIcmpCodeAndTypeFullUpgrade", 1, 2, rule);
+
+        Assert.assertNull(rule.getIcmpCode());
+        Assert.assertNull(rule.getIcmpType());
+    }
 }