Solved: ASA not allowing traceroute

darren.g · ‎11-01-2011

Hi.

I've got an annoying problem with my ASA 5520.

I have traffic going from the inside interface (security level 100) to the outside interface (security level 0) with a global PAT applied to the outside interface address for all inside traffic - and I can't seem to traceroute through the firewall.

The ruleset is simple - basically, allow any IP from inside to outside. The NAT is simple - PAT all traffic unless exempted to the IP address of the outside interface.

If I do the trace from my internet edge router it works fine - so I know it's not soemthing my uplinks are filtering - but if I do it through the firewall, I get perfect responses until the hop where it hits the firewall interface - then nothing.

Is there something I am missing that I need to do to allow traceroute to just work with all the rest of the traffic?

Cheers and thanks.

varrao · ‎11-01-2011

Hi Darren,

By defualt ASA does not allow traceroute, you would need to enable it, here's a doc for it:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml

Hope that helps,

Varun

Thanks,
Varun Rao

View solution in original post

varrao · ‎11-01-2011

Hi Darren,

By defualt ASA does not allow traceroute, you would need to enable it, here's a doc for it:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml

Hope that helps,

Varun

Thanks,
Varun Rao

darren.g · ‎11-02-2011

Varun Rao wrote:

Hi Darren,

By defualt ASA does not allow traceroute, you would need to enable it, here's a doc for it:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml

Hope that helps,

Varun

Varun.

Thanks for that. That document is a little confusing (in typical Cisco fashion! :-)), but by combining it with some other search results, I now have traceroute working just fine.

Appreciate the piointers!

Cheers

garzaangel · ‎03-26-2017

I also had to remove "IP reverse path" feature on the inbound interface as traceroute replies where comming from intermediate carrier hops with source address that is not routable accross firewall interface therefore they were dropped by "IP reverse path" feature and we could not see intermediate hops on the traceroute, only first and last. After "IP reverse path" was disabled on the transit/external interface traceroute started working. This is not a recommended practice but it was needed to get traceroute working in my case.

no ip verify reverse-path interface INTERFACE_NAME

HTH

Angel,