Solved: Enable Tracroute from DMZ Segment

estelamathew · ‎09-07-2010

Hello Dear's,

I m trying to traceroute internal server from DMZ segment which is connected to remote branches, i have enabled time-exceeded,and echo-reply,it doesn't work,also I tried by enabling unreacheable,and Access-list DMZ extended permit icmp any any but stil doesn't work,

Traceroute from internal to DMZ server is working by "time-exceeded" but it can't be done from DMZ segment to internal server.

When i have enabled Access-list DMZ extended permit UDP any any it works but it doesnt show the firewall hop.I m aware the firewall HOP is shown by the destination address but it is shows me the " * " rather than the destination.

which UDP ports i have to enable to allow traceroute.

Thanks.

abinjola · ‎09-07-2010

Is it a linux/unix box in DMZ that you are using for traceroute ?, Linux/Unix uses UDP datagrams for traceroute with destination ports numbering from 33434 to 33534 (usually), so you may want to open relevant UDP ports, check in logs and captures which exact ports

Regarding why firewall not showing its interface as the hop, refer:

http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/s1.html#wp1395966

---regards

View solution in original post

abinjola · ‎09-07-2010

to find out exact port use packet capture command on DMZ

access-list abc permit udp host host

capture cpz access-l abc interface DMZ

now traceroute and do show cap cpz

this will tell you what exact UDP ports you need

View solution in original post

abinjola · ‎09-07-2010

I am glad I could help

View solution in original post

abinjola · ‎09-07-2010

Is it a linux/unix box in DMZ that you are using for traceroute ?, Linux/Unix uses UDP datagrams for traceroute with destination ports numbering from 33434 to 33534 (usually), so you may want to open relevant UDP ports, check in logs and captures which exact ports

Regarding why firewall not showing its interface as the hop, refer:

http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/s1.html#wp1395966

---regards

estelamathew · ‎09-07-2010

Hello Dear's,

I m tracing from cisco router which is located in branch office that passess through DMZ interface of ASA. I m trying to do trace from branch router to internal windows Server, then why the UDP is neccessary here,i have read about UDP is necessary for Linux nd Unix Box but i m tracing to windows server.I have tried by enabling the same UDP ports as mentioned by you but still i m not able to trace but when i do UDP any any then the traceroute works.

Thanks.

golly_wog · ‎09-07-2010

Hello my Dear

You are correct, a Cisco IOS box uses UDP for its traceroute, doesn't matter what its tracing to, it will use UDP.

But it depends on how far the hop is away, do you know?You might want to increase the range from 33434 to 33464

;-)

abinjola · ‎09-07-2010

to find out exact port use packet capture command on DMZ

access-list abc permit udp host host

capture cpz access-l abc interface DMZ

now traceroute and do show cap cpz

this will tell you what exact UDP ports you need

estelamathew · ‎09-07-2010

Thanks Dear,

I found the ports 33455,33456,33457,

Thank u once more for ur kind reply

abinjola · ‎09-07-2010

I am glad I could help