Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

traceroute question

Hi,

I am dumbfounded over this problem i have.

Whenever i do a traceroute using pingplotter (uses icmp not udp), i get replies from all devices in the path but not from the ASA and our perimeter router. I understand why the ASA doesn't show but i am confused why our perimeter router which is the next hop device after our ASA fails to show in the traceroute results. I connected a laptop to a switch which connectes to the perimter router and traceroute tests show it responding.

Checking the ASA i am able to verify the below:

1. ip inspect icmp and ip inspect icmp error is enabled globally on the ASA.
2. Applied ACL on outside interface allowing all ICMPs to inside.
3. Applied ACL on inside interface allowing all ICMPs to outside.
4. Traceroute from ASA shows perimter router replying.

I would really appreciate any help here.

Thanks in advance.

1 REPLY
Community Member

Re: traceroute question

Add to your global policy under class-default the  "decrement-ttl" check. This will make the ASA show up in traceroute and most likely fix your router aswell.

177
Views
0
Helpful
1
Replies
CreatePlease to create content