ASA traceroute return traffic (hops)

gbudesheim — Tue, 12 Mar 2019 03:22:09 GMT

I currently am trying to set up an ACL to allow only type 11 ICMP messages back through the outside interface of our ASA using specific hosts and destination addresses. Currently I have two object groups set up with internal address (object group 1) and external specified hosts (internet). Also my global policies are set to allow icmp traffic to be inspected. The issue im trying to resolve is when I trace to an internet site www.yahoo.com after leaving the ASA it starts to time out.

results and configs below

C:\Users>tracert www.yahoo.com

Tracing route to ds-any-fp3-real.wa1.b.yahoo.com [98.139.183.24]

over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms x.x.x.x.

2 <1 ms <1 ms <1 ms x.x.x.x.

3 1 ms <1 ms <1 ms x.x.x.x.

4 <1 ms <1 ms <1 ms x.x.x.x.

5 1 ms 2 ms 1 ms x.x.x.x.

6 13 ms 5 ms 4 ms x.x.x.x.

7 9 ms 8 ms 8 ms x.x.x.x.

8 * * * Request timed out.

9 * * * Request timed out.

10 * * * Request timed out.

11 * * * Request timed out.

12 * * * Request timed out.

13 * * * Request timed out.

14 * * * Request timed out.

15 * * * Request timed out.

16 * * * Request timed out.

17 * * * Request timed out.

18 * * * Request timed out.

19 * * * Request timed out.

20 * * * Request timed out.

21 * * * Request timed out.

22 * * * Request timed out.

23 * * * Request timed out.

24 * * * Request timed out.

25 * * * Request timed out.

26 * * * Request timed out.

27 * * * Request timed out.

28 * * * Request timed out.

29 36 ms * * ir2.fp.vip.bf1.yahoo.com [98.139.183.24]

30 130 ms 98 ms 66 ms ir2.fp.vip.bf1.yahoo.com [98.139.183.24]

object-group network objectgroup1

description -- these are the source addresses

network-object xx.xx.0.0 255.255.0.0

object-group network objectgroup2

description -- external hosts

network-object host xx.xx.xx.xx

access-list acl_outside extended permit icmp object-group objectgroup1 object-group objectgroup2 eq time-exceeded

class-map inspection_default

match default-inspection-traffic

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect ip-options

inspect netbios

inspect rsh

inspect rtsp

inspect skinny

inspect sqlnet

inspect sunrpc

inspect tftp

inspect sip

inspect xdmcp

inspect icmp

How can I have the hosts in between show

ASA traceroute return traffic (hops)

Maykol Rojas — Sun, 29 Dec 2013 20:29:29 GMT

Hey

There are a couple of things missing there. Even if you allow it with ACLs the inspection is going to drop it. Try the following document:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml

Let me know.

Mike

topic ASA traceroute return traffic (hops) in Network Security

ASA traceroute return traffic (hops)

ASA traceroute return traffic (hops)