how to enable icmp (traceroute) through firewall

[carl_townshend]

Hi all, on my asa, how do i let icmp pass through it, does it allow it via default ? from inside to outside ?

[Jason Fraioli]

try the following ACL for icmp

access-list [named_acl] permit icmp [inside] [outside]

Edit: I don't think firewalls permit any traffic by default.

[vsaavedra]

You will need to allow the icmp type specific to traceroute from outside.

access-list out_in extended permit icmp any any tracertroute

access-list out_in extended permit icmp any any unreachable

also you'll probably need these commands

icmp permit any traceroute outside

icmp permit any unreachable outside