Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Cannot Perform Tracert From Behind PIX 515E ver. 7.0

Can someone help me with this problem that i am having with Windows desktops not being able to perform a tracert to an IP address outside of the company's network?

From behind the PIX 515E ver 7.0, i could successfully perform a traceroute on any router and switch to an external IP address. However, i could not perform a tracert from any Windows desktop to an external IP address. All i get is answer from the first hop (which is the default gateway) and the last hop (which is the destination IP address). All hops in between have *. Pinging is working properly from the desktops.

The PIX has rules that allow ICMP echo, echo reply, unreachable, time-exceeded and source-quench for any source and destination.

So how is it that the routers and switches could perform a traceroute successfully but Windows desktops could not perform the tracert? Any help is greatly appreaciated. Thanks.



Re: Cannot Perform Tracert From Behind PIX 515E ver. 7.0

Cisco router, like linux, use UDP traceroute, not icmp.

As for your problem, you have permitted every type of icmp windows need. You are receiving a reply from the end host, this tell us the echo,echoreply are ok. The problem seem to be with the time-exeeded. Turn the syslog level on the pix to debug and see why the packet is getting dropped.

New Member

Re: Cannot Perform Tracert From Behind PIX 515E ver. 7.0

Thanks for the info. However, if Cisco router uses UDP traceroute, then how come i see ICMP type 11 in the PIX when i performed a debug icmp trace? Not only that, my inbound access list does not allow UDP.

In addition, when I tried a utility that i downloaded from the Internet that gives me an option to perform UDP traceroute from Windows desktops, it did not go through either. I monitored the debug icmp trace and did not see the trace in the PIX, so i guessed the utility did perform the UDP traceroute.

Regardless, i'll turn on the syslog level to debug and see why the packets are getting dropped. Is there a way to display the syslog messages on the telnet session? Or do i have to configure the PIX to send the syslog messages to a syslog server for analysis?


Re: Cannot Perform Tracert From Behind PIX 515E ver. 7.0


Add/allow Echo Request (ICMP type 8)

Packet types 0, 8, and 11 are used for ICMP traceroute

Echo Request packets are sent out starting with a TTL packet of 1, and the TTL is incremented for each hop. The intermediate hops respond to the Echo Request packet with a Time Exceeded packet; the final destination responds with an Echo Reply packet.



New Member

Re: Cannot Perform Tracert From Behind PIX 515E ver. 7.0

i already have the ICMP echo and echo request message types allowed in to and out of the PIX.