topic Trace Route from inside int in Network Security https://community.cisco.com/t5/network-security/trace-route-from-inside-int/m-p/2328401#M343386 <HTML><HEAD></HEAD><BODY><P>Hi,</P><P></P><P>Do you have ICMP Inspection enabled?</P><P></P><P>If not, add</P><P></P><P><STRONG>fixup protocol icmp</STRONG></P><P><STRONG>fixup protocol icmp error</STRONG></P><P></P><P>If those dont help, you could consider adding these to the external interface ACL</P><P></P><P><STRONG>access-list <ACL name=""> permit icmp any any time-exceeded</ACL></STRONG></P><P><STRONG>access-list <ACL name=""> permit icmp any any unreachable</ACL></STRONG></P><P></P><P>This document might also help you with troubleshooting and configuring</P><P></P><P><A class="jive-link-external-small" href="http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml">http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml</A></P><P></P><P>- Jouni</P></BODY></HTML> Fri, 06 Sep 2013 20:16:10 GMT Jouni Forss 2013-09-06T20:16:10Z Trace Route from inside int https://community.cisco.com/t5/network-security/trace-route-from-inside-int/m-p/2328400#M343383 <P>We can trace from cli on asa5510 (8.0(3)) but can not from inside host. We have icmp and echo-reply on both interfaces. The logs show successful building/teardown of ICMP to/from the faddr and there are not any denies by acl's or errors.</P><P></P><P>Any clues by you smart people?</P><P></P><P>THANKS!!!!!</P><P>C.T.</P> Tue, 26 Mar 2019 00:52:01 GMT https://community.cisco.com/t5/network-security/trace-route-from-inside-int/m-p/2328400#M343383 Charlie Taylor 2019-03-26T00:52:01Z Trace Route from inside int https://community.cisco.com/t5/network-security/trace-route-from-inside-int/m-p/2328401#M343386 <HTML><HEAD></HEAD><BODY><P>Hi,</P><P></P><P>Do you have ICMP Inspection enabled?</P><P></P><P>If not, add</P><P></P><P><STRONG>fixup protocol icmp</STRONG></P><P><STRONG>fixup protocol icmp error</STRONG></P><P></P><P>If those dont help, you could consider adding these to the external interface ACL</P><P></P><P><STRONG>access-list <ACL name=""> permit icmp any any time-exceeded</ACL></STRONG></P><P><STRONG>access-list <ACL name=""> permit icmp any any unreachable</ACL></STRONG></P><P></P><P>This document might also help you with troubleshooting and configuring</P><P></P><P><A class="jive-link-external-small" href="http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml">http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml</A></P><P></P><P>- Jouni</P></BODY></HTML> Fri, 06 Sep 2013 20:16:10 GMT https://community.cisco.com/t5/network-security/trace-route-from-inside-int/m-p/2328401#M343386 Jouni Forss 2013-09-06T20:16:10Z