https://community.cisco.com/t5/network-security/acl-traceroute/m-p/2975046#M147895 <P>When I traceroute from internal network, after ASA...I only see * which is annoying.</P> <P>I found this article.</P> <P><A href="https://supportforums.cisco.com/discussion/11219676/cannot-traceroute-through-asa" target="_blank">https://supportforums.cisco.com/discussion/11219676/cannot-traceroute-through-asa</A></P> <P></P> <P>Wouldn't this bring down my network?</P> <P></P> <PRE class="prettyprint">ciscoasa#<STRONG>config t</STRONG> ciscoasa(config)#<STRONG>access-list internal-out permit icmp any any echo-reply</STRONG> ciscoasa(config)#<STRONG>access-list internal-out permit icmp any any time-exceeded</STRONG> ciscoasa(config)#<STRONG>access-list internal-out permit icmp any any unreachable</STRONG> ciscoasa(config)#<STRONG>policy-map global_policy</STRONG> ciscoasa(config-pmap)#<STRONG>class inspection_default</STRONG> ciscoasa(config-pmap-c)#<A href="http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/i2.html#wp1735986" target="_blank"> <STRONG>inspect icmp</STRONG> </A> ciscoasa(config-pmap-c)#<A href="http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/i2.html#wp1736134" target="_blank"> <STRONG>inspect icmp error</STRONG> </A> ciscoasa(config-pmap-c)#<STRONG>end</STRONG> ciscoasa(config)#<STRONG>service-policy global_policy global</STRONG> ciscoasa(config)#<STRONG>access-group internal-out in interface outside</STRONG> </PRE> <PRE class="prettyprint">ciscoasa(config)#<STRONG>access-list internal-out permit icmp any any </STRONG><EM>traceroute<BR /><BR /></EM></PRE> <P>My thought is since "internal-out ACL" has deny any any statement at the end......</P> <P>If I apply this ACL to the outside interface.....all traffics will be dropped except ICMP traffics.</P> <P>Am I right?</P> <P>Please help.</P> <P>Thank you.</P> Tue, 12 Mar 2019 08:45:20 GMT jeffkim.cisco 2019-03-12T08:45:20Z https://community.cisco.com/t5/network-security/acl-traceroute/m-p/2975046#M147895 <P>When I traceroute from internal network, after ASA...I only see * which is annoying.</P> <P>I found this article.</P> <P><A href="https://supportforums.cisco.com/discussion/11219676/cannot-traceroute-through-asa" target="_blank">https://supportforums.cisco.com/discussion/11219676/cannot-traceroute-through-asa</A></P> <P></P> <P>Wouldn't this bring down my network?</P> <P></P> <PRE class="prettyprint">ciscoasa#<STRONG>config t</STRONG> ciscoasa(config)#<STRONG>access-list internal-out permit icmp any any echo-reply</STRONG> ciscoasa(config)#<STRONG>access-list internal-out permit icmp any any time-exceeded</STRONG> ciscoasa(config)#<STRONG>access-list internal-out permit icmp any any unreachable</STRONG> ciscoasa(config)#<STRONG>policy-map global_policy</STRONG> ciscoasa(config-pmap)#<STRONG>class inspection_default</STRONG> ciscoasa(config-pmap-c)#<A href="http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/i2.html#wp1735986" target="_blank"> <STRONG>inspect icmp</STRONG> </A> ciscoasa(config-pmap-c)#<A href="http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/i2.html#wp1736134" target="_blank"> <STRONG>inspect icmp error</STRONG> </A> ciscoasa(config-pmap-c)#<STRONG>end</STRONG> ciscoasa(config)#<STRONG>service-policy global_policy global</STRONG> ciscoasa(config)#<STRONG>access-group internal-out in interface outside</STRONG> </PRE> <PRE class="prettyprint">ciscoasa(config)#<STRONG>access-list internal-out permit icmp any any </STRONG><EM>traceroute<BR /><BR /></EM></PRE> <P>My thought is since "internal-out ACL" has deny any any statement at the end......</P> <P>If I apply this ACL to the outside interface.....all traffics will be dropped except ICMP traffics.</P> <P>Am I right?</P> <P>Please help.</P> <P>Thank you.</P> Tue, 12 Mar 2019 08:45:20 GMT https://community.cisco.com/t5/network-security/acl-traceroute/m-p/2975046#M147895 jeffkim.cisco 2019-03-12T08:45:20Z