ASA Traceroute

jay_7301 — Fri, 21 Feb 2020 15:10:31 GMT

Hi,

I'm unable to traceroute through a CISCO ASA 5505. We want to be able to trace to websites for diagnostic purposes for example 8.8.8.8. The following commands we currently have on the firewall are

access-list outside_in extended permit icmp any any time-exceeded
access-list outside extended permit icmp any host (outside public ip ) time-exceeded
icmp unreachable rate-limit 1 burst-size 1
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
inspect icmp

Cisco Adaptive Security Appliance Software Version 9.1(7)4

tracing from the asa sourcing from the outside interface is successful, however tracing from the internal network isn't

Any recommendations would be great

Thanks

Re: ASA Traceroute

Marvin Rhoads — Sat, 20 Jan 2018 01:57:57 GMT

Paul Stewart wrote a blog post a number of years ago that's still valid:

http://www.packetu.com/2009/10/09/traceroute-through-the-asa/

From what you posted you should also include decrement-ttl at a minimum. If that doesn't fix it, tell us more specifically what failure you are seeing and we can go from there.

topic ASA Traceroute in Network Security

ASA Traceroute

Re: ASA Traceroute