Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

Silver

ASA not allowing traceroute

Hi.

I've got an annoying problem with my ASA 5520.

I have traffic going from the inside interface (security level 100) to the outside interface (security level 0) with a global PAT applied to the outside interface address for all inside traffic - and I can't seem to traceroute through the firewall.

The ruleset is simple - basically, allow any IP from inside to outside. The NAT is simple - PAT all traffic unless exempted to the IP address of the outside interface.

If I do the trace from my internet edge router it works fine - so I know it's not soemthing my uplinks are filtering - but if I do it through the firewall, I get perfect responses until the hop where it hits the firewall interface - then nothing.

Is there something I am missing that I need to do to allow traceroute to just work with all the rest of the traffic?

Cheers and thanks.

  • Firewalling
Everyone's tags (2)
1 ACCEPTED SOLUTION

Accepted Solutions
Red

ASA not allowing traceroute

Hi Darren,

By defualt ASA does not allow traceroute, you would need to enable it, here's a doc for it:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml

Hope that helps,

Varun

Thanks, Varun Rao Security Team, Cisco TAC
3 REPLIES
Red

ASA not allowing traceroute

Hi Darren,

By defualt ASA does not allow traceroute, you would need to enable it, here's a doc for it:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml

Hope that helps,

Varun

Thanks, Varun Rao Security Team, Cisco TAC
Silver

ASA not allowing traceroute

Varun Rao wrote:

Hi Darren,

By defualt ASA does not allow traceroute, you would need to enable it, here's a doc for it:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml

Hope that helps,

Varun

Varun.

Thanks for that. That document is a little confusing (in typical Cisco fashion! :-)), but by combining it with some other search results, I now have traceroute working just fine.

Appreciate the piointers!

Cheers

New Member

I also had to remove "IP

I also had to remove "IP reverse path" feature on the inbound interface as traceroute replies where comming from intermediate carrier hops with source address that is not routable accross firewall interface therefore they were dropped by "IP reverse path" feature and we could not see intermediate hops on the traceroute, only first and last. After "IP reverse path" was disabled on the transit/external interface traceroute started working. This is not a recommended practice but it was needed to get traceroute working in my case.

no ip verify reverse-path interface INTERFACE_NAME

 

HTH

Angel,

9348
Views
0
Helpful
3
Replies
This widget could not be displayed.