ICMP traceroute out

[dpachl]

What is the best practice (ACL) to allow ping and traceroute out? Linux and Window clients, ASA5520 Ver.7.2.1 using PAT.

[m.sir]

On Linux Systems, traceroute uses UDP packet. The first packet is addressed to udp 33435 and each another packet will is addressed to an incremented port number. so second is 33436 etc...

. So you need permit UDP>33436

But on Windows, traceroute is implemented by sending ICMP Echo packets..So you need permit ICMP echo packet

if you want linux to behave like windows then use the -I flag "Use ICMP ECHO instead of UDP datagrams."

M.

Hope that helps rate if it does