Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

How to tracert to outside in ASA 5505/5520?

Hi,everybody

The tracert issue have troubled me for a long time. I don't know how to deal with it. Pls give me some advice. Thanks!

Following is the details.

The network have two firewall(ASA 5505,ASA 5520) placed in different cities. And all person inside can reach the internet.

The problem is that we can ping internet IP from inside but can not tracert outside IP. It always reply us "request time out".

Why?

Somebody know that?

3 REPLIES
Cisco Employee

Re: How to tracert to outside in ASA 5505/5520?

You need the following:

inspect icmp

inspect icmp error

and also allow icmp unreachable and time-exceeded to come back in via acl applied on the outside interface.

Pls. follow this link:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml#topic0

-KS

Re: How to tracert to outside in ASA 5505/5520?

Hi,everybody

The tracert issue have troubled me for a long time. I don't know how to deal with it. Pls give me some advice. Thanks!

Following is the details.

The network have two firewall(ASA 5505,ASA 5520) placed in different cities. And all person inside can reach the internet.

The problem is that we can ping internet IP from inside but can not tracert outside IP. It always reply us "request time out".

Why?

Somebody know that?

Hi ,

You need to apply the following ACL in in direction of outside interface to allow ping and trace route from the internet to your dmz/inside servers.

access-list OUTSIDE_IN_ACL permit icmp any any echo-reply
access-list OUTSIDE_IN_ACL permit icmp any any time-exceeded   --- Traceroute purpose
access-group OUTSIDE_IN_ACL in interface outside

Hope it clear your query !!

Do rate if helpful !!

Ganesh.H

New Member

Hello,I know this has been a

Hello,

I know this has been a long time ago, but I'm facing the same issue in the ASA. Weirdly enough, I can reach the destination using traceroute with no problem, but I can't see the path to it. I pasted the result below.

I also checked my ASA configuration and the only setting that is not present is the "match any " for the "class-map class_default", because when I enter "class-map class_default" I get the following warning:


ASA(config)# class-map class-default
ERROR: % class-default is a well-known class and is not configurable under class-map

Can you guys help me? I posted below the tracert output and the concerned configuration. I can't find the misfit and I already checked most of the configuration forums.

C:\>tracert www.google.com

Tracing route to www.google.com [173.194.79.104]
over a maximum of 30 hops:

  1    <1 ms    <1 ms    <1 ms  10.0.0.1
  2     *        *        *     Request timed out.
  3     *        *        *     Request timed out.
  4     *        *        *     Request timed out.
  5     *        *        *     Request timed out.
  6     *        *        *     Request timed out.
  7     *        *        *     Request timed out.
  8     *        *        *     Request timed out.
  9     *        *        *     Request timed out.
 10     *        *        *     Request timed out.
 11     *        *        *     Request timed out.
 12     *        *        *     Request timed out.
 13     *        *        *     Request timed out.
 14     *        *        *     Request timed out.
 15     *        *        *     Request timed out.
 16     *        *        *     Request timed out.
 17     *        *        *     Request timed out.
 18     *        *        *     Request timed out.
 19     *        *        *     Request timed out.
 20     *        *        *     Request timed out.
 21     *        *        *     Request timed out.
 22     *        *        *     Request timed out.
 23   212 ms   212 ms   212 ms  pb-in-f104.1e100.net [173.194.79.104]

Trace complete.

---Router configuration

icmp unreachable rate-limit 10 burst-size 5
!
!
!
object-group service ICMP_Return
 service-object icmp echo-reply
 service-object icmp time-exceeded
 service-object icmp traceroute
 service-object icmp unreachable
 service-object icmp6 echo-reply
 service-object icmp6 time-exceeded
 service-object icmp6 unreachable
!
!
!
access-list IF_outside_access_in remark ICMP Return
access-list IF_outside_access_in extended permit object-group ICMP_Return any any
!
!
!
access-group IF_outside_access_in in interface IF_outside
!
!
!
class-map class_default
!--- This does not exit -> match any 
!
!
class-map inspection_default
 match default-inspection-traffic
!
!
!
policy-map global_policy
 class class-default
  set connection decrement-ttl
service-policy global_policy global

5780
Views
0
Helpful
3
Replies