topic Re: Hops not showing in Traceroute after ASA in Network Security

Hops not showing in Traceroute after ASA

Matt — Fri, 21 Feb 2020 15:33:48 GMT

I'm trying to traceroute through an ASA and none of the hops after the ASA appear. I'm assuming the ASA is blocking the time exceeded responses but can't seem to fix this behavior. The ACL is simple: source any, destination any, service any ip.

A similar question was asked in https://supportforums.cisco.com/t5/firewalling/asa-not-allowing-traceroute/td-p/1783343 but the answer's link is now a 404

Re: Hops not showing in Traceroute after ASA

Rob Ingram — Mon, 26 Mar 2018 18:02:44 GMT

Hi,

Do you have something like this defined on the ASA?

access-list OUTSIDE_IN extended permit icmp any any time-exceeded
access-list OUTSIDE_IN extended permit icmp any any unreachable

Re: Hops not showing in Traceroute after ASA

Matt — Mon, 26 Mar 2018 18:12:18 GMT

No inbound ACL, but wouldn't that be covered by the stateful nature of "access-list INSIDE-OUTSIDE extended permit ip any any" ?

Re: Hops not showing in Traceroute after ASA

Rob Ingram — Mon, 26 Mar 2018 18:22:08 GMT

This post explains all. First paragraph states, inspecting icmp does not result in traceroute working through ASA.

HTH

Re: Hops not showing in Traceroute after ASA

Matt — Mon, 26 Mar 2018 22:42:27 GMT

Creating those ACLs was actually the solution. I verified that ICMP inspection in the service policy is still occurring but for some reason I have to set an inbound rule to allow time-exceeded and unreachables...