topic Re: How to enable full traceroute in ASA? in Network Security

How to enable full traceroute in ASA?

getaway51 — Fri, 21 Feb 2020 16:16:43 GMT

How to enable traceroute traffic flow for all directions & interfaces in ASA Version 9.1(7) ?

The reason was traceroute frm PC meet with *** time-out when it reaches firewall.

Re: How to enable full traceroute in ASA?

johnlloyd_13 — Tue, 25 Sep 2018 04:15:29 GMT

hi,

allow ICMP unreachable and time-exceeded on your 'outside' ACL.

sample would be:

access-list OUTSIDE_IN extended permit icmp any any unreachable
access-list OUTSIDE_IN extended permit icmp any any time-exceeded

Re: How to enable full traceroute in ASA?

Marvin Rhoads — Tue, 25 Sep 2018 13:28:58 GMT

..and make sure you "inspect icmp" in your class-map that's referenced in your active policy-map.

https://packetu.com/2009/10/09/traceroute-through-the-asa/

Re: How to enable full traceroute in ASA?

getaway51 — Fri, 28 Sep 2018 08:53:21 GMT

You meant the cmd below still not sufficient to allow traceroute? wht others needed?

//create an ACL that permits the incoming ICMP
access-list outside_access_in remark ICMP type 11 for Windows Traceroute
access-list outside_access_in extended permit icmp any any time-exceeded
access-list outside_access_in remark ICMP type 3 for Cisco and Linux
access-list outside_access_in extended permit icmp any any unreachable

//bind the ACL to the outside interface
access-group outside_access_in in interface outside

Re: How to enable full traceroute in ASA?

Marvin Rhoads — Fri, 28 Sep 2018 09:00:05 GMT

Your class map needs to include icmp inspection.

If there's any access-list applied to the inside interface it must also allow icmp.

Re: How to enable full traceroute in ASA?

getaway51 — Fri, 28 Sep 2018 09:29:12 GMT

is there any examples of config i can refer to?

Re: How to enable full traceroute in ASA?

Marvin Rhoads — Fri, 28 Sep 2018 09:31:25 GMT

Yes - please see the link I provided in my reply date 9-25-2018.

Re: How to enable full traceroute in ASA?

getaway51 — Fri, 28 Sep 2018 11:52:41 GMT

"Your class map needs to include icmp inspection". I am not sure how to check in the present config what it meant by "class map" here. I have read thru the blog but not sure abt the icmp inspection except from the access list config.

How class map config enabled for traceroute? How does it normally configured? Any example/sample config for be great.

Re: How to enable full traceroute in ASA?

Rob Ingram — Fri, 28 Sep 2018 12:35:56 GMT

ASA(config)# fixup protocol icmp
OR
ASA(config)# policy-map global_policy
ASA(config-pmap)# class default-inspection-class
ASA(config-pmap-c)# inspect icmp

Re: How to enable full traceroute in ASA?

mkazam001 — Sun, 04 Nov 2018 00:15:14 GMT

policy-map global_policy
class inspection_default
inspect icmp

policy-map global_policy
class class-default
set connection decrement-ttl
access-list OUTSIDE-IN extended permit icmp any any time-exceeded
access-list OUTSIDE-IN extended permit icmp any any unreachable
access-group OUTSIDE-IN in interface OUTSIDE

hope that helps.

azam