Allowing TRACEROUTE through PIX

[corey.mckinney]

What is required to allow a traceroute to go through the PIX firewall? I believe I have it setup correctly, but I'm still unable to trace through. It just times out when it gets to the firewall. Thanks.

[cewhitnel]

Use this ACL applied to your outside interface.

access-list "ACLNAME" permit icmp any any time-exceeded

[corey.mckinney]

How do I apply that ACL to the interface? I can't find the command.

[mkkeyan]

access-group "access list name" in interface outside

[jmia]

Just add the following to your outside interface:

access-list permit icmp any any echo-reply

access-list permit icmp any any unreachable

access-list permit icmp any any time-exceeded

access-group in interface outside

** can be anything you want for the outside interface**

save with write mem and also issue claer xlate

pls rate posts if it helps.