topic Traceroute "Deny inbound icmp" in Network Security

Traceroute "Deny inbound icmp"

Delmiro Campelo — Tue, 12 Mar 2019 01:21:38 GMT

Hi,

I'm having difficulties with getting traceroute to work from inside to outside. Regular pings work fine, but not traceroute. I thought the icmp inspection would allow alll icmp traffic, I have icmp inspection on globally as well as inside interface.

Commands:

policy-map global_policy-map

class global_class-map

inspect icmp

inspect icmp error

policy-map inside_policy-map

class inside_class-map

inspect icmp

inspect icmp error

service-policy global_policy-map global

service-policy inside_policy-map interface inside

icmp permit any outside

Here is the output:

On the Real-Time Log Viewer:

Deny inbound icmp src outside:4.69.150.77 dst inside:10.0.1.68 (type 11, code 0)

Thanks for your help

Delmiro

Traceroute "Deny inbound icmp"

Julio Carvajal — Sat, 30 Mar 2013 04:15:02 GMT

Hello Delmiro,

I would guess you already have an ACL on the outside interface of your ASA to allow some traffic from OUT to IN right?

Well let's say that the ACL is called Outside_In

Perfom the following to make this happen

access-list Outside_In permit icmp any any eq time-exceeded

Then give it a try and let us know

Traceroute "Deny inbound icmp"

Delmiro Campelo — Sat, 30 Mar 2013 12:56:53 GMT

Thank you that worked perfectly! I have a question, I thought that ICMP inspection would dynamically open up the necessary for port all icmp traffic?

Traceroute "Deny inbound icmp"

Julio Carvajal — Sat, 30 Mar 2013 19:45:57 GMT

Hello Delmiro,

Amazing to hear that I could help someone else

Let me explain you this:

ICMP inspection : This command will convert the ICMP protocol into a stateful protocol but it will work with the basic icmp echo and echo reply , it will check the ICMP ID and place it into it's stateful table waiting for a reply...

In our scenario we are sending from a windows machine ICMP echo paquets with a TTL of 1 and keeps growing as it keeps moving BUT the reply will be an ICMP unreachable which the ASA will not be expecting then dropping it..

Hope that you could understand, if you do not have any other question please mark it as answered

If not let me know an I will do it one more time

Remember to rate all of the helpful posts ( by marking the stars at the left 5 being amazing 1 being the worst answer ever )

Regards,

Traceroute "Deny inbound icmp"

Delmiro Campelo — Sat, 30 Mar 2013 21:27:11 GMT

I appreciate your help, it makes sense now, thanks.

Traceroute "Deny inbound icmp"

Julio Carvajal — Sat, 30 Mar 2013 22:19:05 GMT

Sure Delmiro,

Have a good one