I have traffic going from the inside interface (security level 100) to the outside interface (security level 0) with a global PAT applied to the outside interface address for all inside traffic - and I can't seem to traceroute through the firewall.
The ruleset is simple - basically, allow any IP from inside to outside. The NAT is simple - PAT all traffic unless exempted to the IP address of the outside interface.
If I do the trace from my internet edge router it works fine - so I know it's not soemthing my uplinks are filtering - but if I do it through the firewall, I get perfect responses until the hop where it hits the firewall interface - then nothing.
Is there something I am missing that I need to do to allow traceroute to just work with all the rest of the traffic?
I also had to remove "IP reverse path" feature on the inbound interface as traceroute replies where comming from intermediate carrier hops with source address that is not routable accross firewall interface therefore they were dropped by "IP reverse path" feature and we could not see intermediate hops on the traceroute, only first and last. After "IP reverse path" was disabled on the transit/external interface traceroute started working. This is not a recommended practice but it was needed to get traceroute working in my case.
no ip verify reverse-path interface INTERFACE_NAME
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
[toc:faq]Introduction:This document describes details on how NAT-T
works.Background:ESP encrypts all critical information, encapsulating
the entire inner TCP/UDP datagram within an ESP header. ESP is an IP
protocol in the same sense that TCP and UDP are I...