Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

ASA traceroute return traffic (hops)

I currently am trying to set up an ACL to allow only type 11 ICMP messages back through the outside interface of our ASA using specific hosts and destination addresses.  Currently I have two object groups set up with internal address (object group 1) and external specified hosts (internet).  Also my global policies are set to allow icmp traffic to be inspected.  The issue im trying to resolve is when I trace to an internet site www.yahoo.com after leaving the ASA it starts to time out.

results and configs below

C:\Users>tracert www.yahoo.com

Tracing route to ds-any-fp3-real.wa1.b.yahoo.com [98.139.183.24]

over a maximum of 30 hops:

  1    <1 ms    <1 ms    <1 ms  x.x.x.x.

  2    <1 ms    <1 ms    <1 ms x.x.x.x.

  3     1 ms    <1 ms    <1 ms x.x.x.x.

  4    <1 ms    <1 ms    <1 ms x.x.x.x.

  5     1 ms     2 ms     1 ms x.x.x.x.

  6    13 ms     5 ms     4 ms x.x.x.x.

  7     9 ms     8 ms     8 ms x.x.x.x.

  8     *        *        *     Request timed out.

  9     *        *        *     Request timed out.

10     *        *        *     Request timed out.

11     *        *        *     Request timed out.

12     *        *        *     Request timed out.

13     *        *        *     Request timed out.

14     *        *        *     Request timed out.

15     *        *        *     Request timed out.

16     *        *        *     Request timed out.

17     *        *        *     Request timed out.

18     *        *        *     Request timed out.

19     *        *        *     Request timed out.

20     *        *        *     Request timed out.

21     *        *        *     Request timed out.

22     *        *        *     Request timed out.

23     *        *        *     Request timed out.

24     *        *        *     Request timed out.

25     *        *        *     Request timed out.

26     *        *        *     Request timed out.

27     *        *        *     Request timed out.

28     *        *        *     Request timed out.

29    36 ms     *        *     ir2.fp.vip.bf1.yahoo.com [98.139.183.24]

30   130 ms    98 ms    66 ms  ir2.fp.vip.bf1.yahoo.com [98.139.183.24]

object-group network objectgroup1

description -- these are the source addresses

network-object xx.xx.0.0 255.255.0.0

object-group network objectgroup2

description -- external hosts

network-object host xx.xx.xx.xx

network-object host xx.xx.xx.xx

access-list acl_outside extended permit icmp object-group objectgroup1 object-group objectgroup2 eq time-exceeded

class-map inspection_default

match default-inspection-traffic

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect ip-options

  inspect netbios

  inspect rsh

  inspect rtsp

  inspect skinny

  inspect sqlnet

  inspect sunrpc

  inspect tftp

  inspect sip

  inspect xdmcp

  inspect icmp

How can I have the hosts in between show

Everyone's tags (1)
1 REPLY
Cisco Employee

ASA traceroute return traffic (hops)

Hey

There are a couple of things missing there. Even if you allow it with ACLs the inspection is going to drop it. Try the following document:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml

Let me know.

Mike

Mike
330
Views
5
Helpful
1
Replies