cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
11415
Views
0
Helpful
4
Replies

ACL for Traceroute

Rupesh Kashyap
Level 1
Level 1

I want to create an acl to permit traceroute. But I see two different types

of the icmp commands for traceroute. Which pair is correct?

>

> permit icmp any any ttl-exceed

> permit icmp any any port-unreachable

or permit icmp any any traceroute

4 Replies 4

Rupesh,

To make sure that I will get any response from Linux,Cisco or Windows box.

permit icmp any any ttl-exceed

permit icmp any any port-unreachable

permit icmp any any echo-reply

This is all about inbound direction.

Toshi

What is the meaning of permit icmp any any traceroute ?

Rupesh,

I'm not sure about that command. Actually it's a different type and code for ICMP.

So It's not all in one command to include things like ttl-exceed and port-unreachable.

Type 0 Echo-reply

Type 3 Destination-unreachable

Code 0 network-unreachable

Code 1 host-unreachable

Code 2 protocol-unreachable

Code 3 port-unreachable

Code 4 fragmentation-needed

Code 5 source-route-failed

Code 6 network-unknown

Code 7 host-unknown

Code 8 network-prohibited

Code 9 host-prohibited

Code 10 TOS-network-unreachable

Code 11 TOS-host-unreachable

Code 12 communication-prohibited

Code 13 host-precedence-violation

Code 14 precedence-cutoff

Type 11 Time-exceeded

Code 0 ttl-zero-during-transit

Code 1 ttl-zero-during-reassembly

Type 30 Traceroute

Toshi

thanks for your efforts. I think you are write as I have never seen traceroute keyword in acl.

Review Cisco Networking products for a $25 gift card