Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Enable Tracroute from DMZ Segment

Hello Dear's,

I m trying to traceroute internal server from DMZ segment which is connected to remote branches, i have enabled time-exceeded,and echo-reply,it doesn't work,also I tried by enabling unreacheable,and Access-list DMZ extended permit icmp any any but stil doesn't work,

Traceroute from internal to DMZ server is working by "time-exceeded" but it can't be done from DMZ segment to internal server.

When i have enabled Access-list DMZ extended permit UDP any any  it works but it doesnt show the firewall hop.I m aware the firewall HOP is shown by the destination address but it is shows me the " * "  rather than the destination.

which UDP ports i have to enable to allow traceroute.


Thanks.

3 ACCEPTED SOLUTIONS

Accepted Solutions
Cisco Employee

Re: Enable Tracroute from DMZ Segment

Is it a linux/unix box in DMZ that you are using for traceroute ?, Linux/Unix uses UDP datagrams for traceroute with destination ports numbering from 33434 to 33534 (usually), so you may want to open relevant UDP ports, check in logs and captures which exact ports

Regarding why firewall not showing its interface as the hop, refer:

http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/s1.html#wp1395966

---regards

Cisco Employee

Re: Enable Tracroute from DMZ Segment

to find out exact port use packet capture command on DMZ

access-list abc permit udp host host

capture cpz access-l abc interface DMZ

now traceroute and do show cap cpz

this will tell you what exact UDP ports you need

Cisco Employee

Re: Enable Tracroute from DMZ Segment

I am glad I could help

6 REPLIES
Cisco Employee

Re: Enable Tracroute from DMZ Segment

Is it a linux/unix box in DMZ that you are using for traceroute ?, Linux/Unix uses UDP datagrams for traceroute with destination ports numbering from 33434 to 33534 (usually), so you may want to open relevant UDP ports, check in logs and captures which exact ports

Regarding why firewall not showing its interface as the hop, refer:

http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/s1.html#wp1395966

---regards

New Member

Re: Enable Tracroute from DMZ Segment

Hello Dear's,

I m tracing from cisco router which is located in branch office that passess through DMZ interface of ASA. I m trying to do trace from branch router to internal windows Server, then why the UDP is neccessary here,i have read about UDP is necessary for Linux nd Unix Box but i m tracing to windows server.I have tried by enabling the same UDP ports as mentioned by you but still i m not able to trace but when i do UDP any any then the traceroute works.

Thanks.

New Member

Re: Enable Tracroute from DMZ Segment

Hello my Dear

You are correct, a Cisco IOS box uses UDP for its traceroute, doesn't matter what its tracing to, it will use UDP.

But it depends on how far the hop is away, do you know?You might want to increase the range from 33434 to 33464

;-)

Cisco Employee

Re: Enable Tracroute from DMZ Segment

to find out exact port use packet capture command on DMZ

access-list abc permit udp host host

capture cpz access-l abc interface DMZ

now traceroute and do show cap cpz

this will tell you what exact UDP ports you need

New Member

Re: Enable Tracroute from DMZ Segment

Thanks Dear,

I found the ports 33455,33456,33457,

Thank  u once more for ur kind reply

Cisco Employee

Re: Enable Tracroute from DMZ Segment

I am glad I could help

298
Views
0
Helpful
6
Replies
CreatePlease to create content