Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

traceroute question


I am dumbfounded over this problem i have.

Whenever i do a traceroute using pingplotter (uses icmp not udp), i get replies from all devices in the path but not from the ASA and our perimeter router. I understand why the ASA doesn't show but i am confused why our perimeter router which is the next hop device after our ASA fails to show in the traceroute results. I connected a laptop to a switch which connectes to the perimter router and traceroute tests show it responding.

Checking the ASA i am able to verify the below:

1. ip inspect icmp and ip inspect icmp error is enabled globally on the ASA.
2. Applied ACL on outside interface allowing all ICMPs to inside.
3. Applied ACL on inside interface allowing all ICMPs to outside.
4. Traceroute from ASA shows perimter router replying.

I would really appreciate any help here.

Thanks in advance.

Community Member

Re: traceroute question

Add to your global policy under class-default the  "decrement-ttl" check. This will make the ASA show up in traceroute and most likely fix your router aswell.

CreatePlease to create content