topic Re: Traceroute, tracert, mtr and the Firepower. in Network Security

Traceroute, tracert, mtr and the Firepower.

Stephen Carville — Fri, 21 Feb 2020 15:30:39 GMT

I have a new set of Firepower 2130 appliances and a Management Center 1000. One of the differences between the 5525x and the Firepower is that some users can run traceroute, tracert or mtr and get useful information. Other users cannot get past their gateway. This worked correctly on the ASA 5525x but when the consultant did the conversion to the Firepower rules some weird stuff happened.

Where is traceroute, etal set up? I know the process uses ICMP and/or UDP but just allowing those outbound has not cured the problem. Is there some inspection rule I need to create?

Re: Traceroute, tracert, mtr and the Firepower.

Florin Barhala — Wed, 14 Mar 2018 12:00:46 GMT

I am also interested in this as we might migrate this year.

Meantime can you share your current traceroute "config ". I am having some issues to make it work on my current ASAs.

Re: Traceroute, tracert, mtr and the Firepower.

Stephen Carville — Wed, 14 Mar 2018 16:02:04 GMT

@Florin Barhala wrote:

I am also interested in this as we might migrate this year.

I've only had it a few days but, so far, I am unimpressed. Even a simple change like blacklisting the IP of a CNC server requires redeploying the entire policy. That takes five to ten minutes. Don't get me started on the HTML 5 interface.

What was Cisco thinking?

Meantime can you share your current traceroute "config ". I am having some issues to make it work on my current ASAs.

As I recall, on the ASA I first had to create an object list for the icmp types I wanted to accept from outside:

object-group icmp-type icmp_permit
description icmp types allowed
icmp-object echo-reply
icmp-object source-quench
icmp-object time-exceeded
icmp-object traceroute
icmp-object unreachable

Then on the outside interface acl I added:

permit icmp any any object-group icmp_permit

Finally, the global policy map had to be made aware of icmp

policy-map global_policy
class inspection_default
<buncha stuff>
inspect icmp
inspect icmp error

Re: Traceroute, tracert, mtr and the Firepower.

Florin Barhala — Thu, 15 Mar 2018 07:18:18 GMT

This is not good news (about FTD I mean).
As for my trace issue, I cannot trace from ASA itself specifying the source interface.