Traceroute across ASA Query

ankurs2008 · ‎04-17-2010

Hi halijenn / all

I have a query in context with the Inbound and Outbound traceroute via the ASA Firewall .

a) To configure the ASA to show its internal network from the outside network:

ciscoasa(config)#access-list internal-out permit icmp any any echo-reply
ciscoasa(config)#access-list internal-out permit icmp any any time-exceeded
ciscoasa(config)#access-list internal-out permit icmp any any unreachable
ciscoasa(config)#policy-map global_policy
ciscoasa(config-pmap)#class inspection_default
ciscoasa(config-pmap-c)#inspect icmp
ciscoasa(config-pmap-c)#inspect icmp error
ciscoasa(config)#service-policy global_policy global
ciscoasa(config)#access-group internal-out in interface outside

i want to know that just for the Inbound Traceroute , the above access-list is required or not , as per the following document

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml

I am getting confused as to what specific we require for Inbound Traceroute ? i believe it is combination of static + ICMP error and set decrement-ttl (if we want to see ASA interface in output).If anyhting else is required , please correct me.

2) For the Outbound traceroute ,do we have to allow inspect icmp and inspect icmp error and allow time-exceeded ( ACL ) ? If yes , I want to know why inspect icmp error is required for Outbound traceroute ?

Federico Coto Fajardo · ‎04-17-2010

Hi,

To allow PING/traceroute through the ASA you would normally use the ACL allow ICMP echo-reply, unreachable and time-exceeded as you mentioned.

Remember that for inbound traffic, you should also have a STATIC NAT for the device that you're trying to reach.

For outbound traffic, only NAT is required (all IP traffic is permitted by default).

The problem is that the ICMP responses from the inside network are not allowed through the ASA back in.

There are two solutions:

Use the ACL on the outside to permit the ICMP packets you wish.

Use the ''icmp inspection'' to allow the replies from connections initiated on the INSIDE.

Federico.

ankurs2008 · ‎04-17-2010

Hi

a) My query is as to why according to the below link the access-lists are configured when the heading of the topic says

Configure the PIX/ASA to show its internal network from the outside network:

Please read the below document

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml

If it just combines the traffic for both inbound and outbound traceroute , i agree ; however do we need ACLs for Inbound traceroute or not is the actual QUESTION over here . I agree with the Static part . Also do we need "inspect icmp " over here or not ?

b) My 2nd question remains unanswered

Federico Coto Fajardo · ‎04-17-2010

I don't agree with that document in that part:
Configure the PIX/ASA to show its internal network from the outside network
If you enter the configuration:

ciscoasa#config t
ciscoasa(config)#access-list internal-out permit icmp any any echo-reply
ciscoasa(config)#access-list internal-out permit icmp any any time-exceeded
ciscoasa(config)#access-list internal-out permit icmp any any unreachable
ciscoasa(config)#policy-map global_policy
ciscoasa(config-pmap)#class inspection_default
ciscoasa(config-pmap-c)#
inspect icmp

ciscoasa(config-pmap-c)#
inspect icmp error

ciscoasa(config-pmap-c)#end
ciscoasa(config)#service-policy global_policy global
ciscoasa(config)#access-group internal-out in interface outside

The only inbound traffic that you're allowing is the traffic specified in the ACL.
When you inspect ICMP, the ICMP replies to queries from the INSIDE are allowed too.
The service policy is applied globally on the ASA as well as the inbound ACL.

So, I agree with you that the above configuration does not allow the PIX/ASA to show its internal network from outside.

For outbound traceroute, I believe you should only allow the ''inspect icmp''
The ''inspect icmp error'' is if you want to enable NAT on ICMP error messages.

Federico.

ankurs2008 · ‎04-17-2010

Hi

For the Outbound traceroute we definitely require time-exceeded ACLs as well , otherwise the reply packet for traceroute wont be allowed in . Also as per the thread , https://supportforums.cisco.com/thread/228370 "inspect icmp error " also needs to be permitted . Please explain as to how the translation will work over here when packet is traversing from Inside to Outside . Also is there any requirement of "inspect icmp " if inbound traceroute is performed ?

I really appreciate clarity on these points

kusankar / halijenn , I would really like to know your comment on this as well .

Federico Coto Fajardo · ‎04-17-2010

You have the concept wrong.

You're saying you have an ASA, and you're saying that you definitely need an ACL to permit the outbound traffic? This is incorrect.

I will try to explain again...

In the ASA, you don't need an ASA to allow outbound traffic (hope I am making this clear).

In case that you already have an ACL applied to the INSIDE interface, in that case the ACL must specify all the traffic that you're permitting (everything else will be denied).

From inside to outside the translation works depending if you have dynamic NAT/PAT, static NAT, policy NAT, NAT excemption, etc.

Traffic can also flow without translation if nat-control is disabled.

If you want you can post the relevant part of your configuration with exactly what you want to accomplish, so anybody here can help you out.

Federico.

Jennifer Halim · ‎04-18-2010

Hi Ankur,

a) For inbound traceroute, you would need to configure access-list on the outside interface to allow "icmp echo", in your case, you would need the following ACL:

access-list internal-out permit icmp any any echo

Plus static NAT statement as you already mentioned.

Both "inspect icmp" and "inspect icmp error" is required whether it is inbound or outbound traceroute. The "inspect icmp error" is required to allow all the intermediate hops of your traceroute to be allowed back through the ASA.

The "set decrement-ttl" is required if you would like to see ASA interface as one of the hop because by default, ASA interface will not be seen as a hop in your traceroute.

b) As per the above "inspect icmp error" is required to allow all the intermediate hops through the ASA.

Here is a much better explaination on the "inspect icmp error" command reference:

http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/i2.html#wp1726194

Here is another document that explains both the inbound and outbound traceroute for your reference:

http://www.ciscotaccc.com/kaidara-advisor/security/showcase?case=K25604671

Hope that helps.

ankurs2008 · ‎04-18-2010

Hi halijenn,

Thanks for the reply , my first question is answered ; however in the second question i want to ask 2 things as mentioned below :

a) The access-list for time-exceeded applied on the Outside Interface of firewall will allow the error messages (from the intermediate hops ) IN back to the firewall ; however "inspect icmp error " over here will see that the reply ICMP messages are coming from a totally different IP address than the destination IP which was in initial traceroute destination and will allow those packets .If the " inspect icmp error " command would NOT have been specified , the packets would have been denied [inspite of the time-exceeded ACL on Outside interface] by ASA as intermediate hop replying would not have matched the existing session . Please let me know if my understanding of "inspect icmp error " is correct

b) I have gone through the link below ; however i have not understood as to how and which IP will be translated during the Outbound Traceroute while "inspect icmp error " is there ?

For Inbound traceroute i have understood that any hops between the Inside interface of ASA and actual internal Destination (Statically NATTED) will be shown in the traceroute Output based on the Static NAT in ASA as well as in Traceroute Output , the IP Address of those hops will be seen as the Static IP of the inside server

Hence request you to please explain the packet flow of Outbound Traceroute.

http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/i2.html#wp1726194

Jennifer Halim · ‎04-19-2010

a) "inspect icmp error" is to create xlates for all the intermediate hops. Yes, you are right, eventhough you have the ACL to permit the time-exceeded icmp, but if you don't have the "inspect icmp error", the traceroute for all the intermediate hops will not show. The "inspect" is to create the xlate, while the ACL is to permit the time-exceeded icmp packet back.

b) For outbound traceroute, the intermediate hops would be from the firewall outside until the end host (destination host). The same xlates need to be created for the replies to get back to the internal host. Hence "inspect icmp error" is required. Each hop from the firewall outside until the end host will form a different session.

ankurs2008 · ‎04-20-2010

Hi halijenn

Thanks for the reply , In point b ) i would like to confirm if what i am thinking is correct or not .

For outbound traceroute, the intermediate hops would be from the firewall outside until the end host (destination host).

This means that the source will get translated to the Outside interface of ASA and packet will be as follows.Consider that there

are 2 hops after Firewall Outside interface till the final destination

a)

Initial Packet : Original Inside IP -> Hop 1 [ Session 1 ]

Initial NAT Packet : Firewall Outside Interface -> Hop 1 [ Session 1 ]

Reply packet : Hop 1 -> Firewall Outside Interface ; the Firewall Outside Interface will then get changed to the Original Inside IP

b)

Initial Packet : Original Inside IP -> Hop 2 [ Session 2 ]

Initial NAT Packet : Firewall Outside Interface -> Hop 2 [ Session 2 ]

Reply packet : Hop 2 -> Firewall Outside Interface ; the Firewall Outside Interface will then get changed to the Original Inside IP

c)

Initial Packet : Original Inside IP -> Destination Hop [ Session 3 ]

Initial NAT Packet : Firewall Outside Interface -> Destination Hop [ Session 3 ]

Reply packet : Hop 3 -> Firewall Outside Interface ; the Firewall Outside Interface will then get changed to the Original Inside IP

Jennifer Halim · ‎04-21-2010

Yes, you are absolutely correct.

It will allow the icmp session back in depending on which icmp messages respond from each hops (from xlate/session point of view).

ankurs2008 · ‎04-20-2010

Hi halijenn

Please reply to my above query

ankurs2008 · ‎04-21-2010

halijenn,

thanks for the excellent guidance and explanation !!

Jennifer Halim · ‎04-21-2010

You are welcome, and thanks for the rating.