Enable Tracroute from DMZ Segment

Answered Question
Sep 7th, 2010

Hello Dear's,

I m trying to traceroute internal server from DMZ segment which is connected to remote branches, i have enabled time-exceeded,and echo-reply,it doesn't work,also I tried by enabling unreacheable,and Access-list DMZ extended permit icmp any any but stil doesn't work,

Traceroute from internal to DMZ server is working by "time-exceeded" but it can't be done from DMZ segment to internal server.

When i have enabled Access-list DMZ extended permit UDP any any  it works but it doesnt show the firewall hop.I m aware the firewall HOP is shown by the destination address but it is shows me the " * "  rather than the destination.

which UDP ports i have to enable to allow traceroute.


Thanks.

Correct Answer by abinjola about 6 years 5 months ago

I am glad I could help

Correct Answer by abinjola about 6 years 5 months ago

to find out exact port use packet capture command on DMZ

access-list abc permit udp host host

capture cpz access-l abc interface DMZ

now traceroute and do show cap cpz

this will tell you what exact UDP ports you need

Correct Answer by abinjola about 6 years 5 months ago

Is it a linux/unix box in DMZ that you are using for traceroute ?, Linux/Unix uses UDP datagrams for traceroute with destination ports numbering from 33434 to 33534 (usually), so you may want to open relevant UDP ports, check in logs and captures which exact ports

Regarding why firewall not showing its interface as the hop, refer:

http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/s1.html#wp1395966

---regards

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (3 ratings)
Loading.
Correct Answer
abinjola Tue, 09/07/2010 - 02:57

Is it a linux/unix box in DMZ that you are using for traceroute ?, Linux/Unix uses UDP datagrams for traceroute with destination ports numbering from 33434 to 33534 (usually), so you may want to open relevant UDP ports, check in logs and captures which exact ports

Regarding why firewall not showing its interface as the hop, refer:

http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/s1.html#wp1395966

---regards

estelamathew Tue, 09/07/2010 - 13:50

Hello Dear's,

I m tracing from cisco router which is located in branch office that passess through DMZ interface of ASA. I m trying to do trace from branch router to internal windows Server, then why the UDP is neccessary here,i have read about UDP is necessary for Linux nd Unix Box but i m tracing to windows server.I have tried by enabling the same UDP ports as mentioned by you but still i m not able to trace but when i do UDP any any then the traceroute works.

Thanks.

golly_wog Tue, 09/07/2010 - 15:38

Hello my Dear

You are correct, a Cisco IOS box uses UDP for its traceroute, doesn't matter what its tracing to, it will use UDP.

But it depends on how far the hop is away, do you know?You might want to increase the range from 33434 to 33464

;-)

Correct Answer
abinjola Tue, 09/07/2010 - 21:32

to find out exact port use packet capture command on DMZ

access-list abc permit udp host host

capture cpz access-l abc interface DMZ

now traceroute and do show cap cpz

this will tell you what exact UDP ports you need

estelamathew Tue, 09/07/2010 - 23:27

Thanks Dear,

I found the ports 33455,33456,33457,

Thank  u once more for ur kind reply

Actions

This Discussion