Can't traceroute through interfaces on ASA - possible

jamesgonzo · ‎09-23-2008

Hi,

From a windows PC I can't tracert or pathping though different interfaces on the ASA 5520 or to the internet, is this something that can be achieved?

satish_zanjurne · ‎09-23-2008

Yes !!!! it can be achieved.

For ASA/PIX 7.X

Use following access-list

access-list 101 permit icmp any any echo-reply

access-list 101 permit icmp any any source-quench

access-list 101 permit icmp any any unreachable

access-list 101 permit icmp any any time-exceeded

access-group 101 in interface outside

Or

Add following policy statement to global policy.

policy-map global_policy

class inspection_default

inspect icmp

HTH...rate if helpfull....

jamesgonzo · ‎09-23-2008

Thanks, I have added:

policy-map global_policy

class inspection_default

inspect icmp

But no change. I'm trying from a subinterface off the ASA (VLAN in a 3750). Do I need to do something else?

Thanks

satish_zanjurne · ‎09-23-2008

Can you paste your ASA config ??