topic Traceroute Between two ASA in Network Security

Traceroute Between two ASA

Shane Riley — Tue, 12 Mar 2019 00:09:54 GMT

Hey Gents/ladies

We have a ASA 5505 and a 5510, that we are using site to site..

I need to traceroute from the 5505-5510.. From the outside interfaces.. Don't want to do this through the site-to-site.

If you know what i mean..

I have temporarily added a few acl on the outside interfaces..

access-list outside_in extended permit icmp any any unreachable

access-list outside_in extended permit icmp any any time-exceeded

access-list outside_in extended permit icmp any any echo-reply

access-group outside_in in interface outside

when i traceroute it only goes one hop.. Maybe thats the way it suppose to be?

I need to know all the hops between the outside interfaces on the 5505 to the outside interface on the 5510..

Is it possible?

Thanks

Traceroute Between two ASA

Jennifer Halim — Tue, 16 Oct 2012 11:23:22 GMT

If you are traceroute between the 2 outside interfaces of the ASA, then you don't need to configure any ACL on the ASA.

And yes, it is definitely possible unless your ISP is blocking traceroute.

Did you try traceroute from both ends and both only goes up one hop?

Do you happen to use the same ISP on both ends?

Traceroute Between two ASA

Shane Riley — Tue, 16 Oct 2012 11:51:52 GMT

Oh right didn't know

Yeah did it from both ends, also from a server on one of the dmz IP..

But probably the problem is that its from the same ISP?

/Shane

Traceroute Between two ASA

Jennifer Halim — Tue, 16 Oct 2012 11:54:28 GMT

Have you tried to traceroute to something on the internet and see if that works? Just try to traceroute to 4.2.2.2

Traceroute Between two ASA

Shane Riley — Tue, 16 Oct 2012 12:04:39 GMT

Yes i tried from the asa 5510 source (outside interface) and it works fine

But the trick is to find the route from the 5510 to the 5505..

I'll try to connect my computer from a ip thats not connected to the firewall but's still located on the same ISP ip range...

Maybe i am on the wrong track...

/Shane

Traceroute Between two ASA

Jennifer Halim — Tue, 16 Oct 2012 12:14:26 GMT

Ahh, try this: from ASA5510 can you traceroute to the ASA5505 default gateway, and vice versa?

Traceroute Between two ASA

Shane Riley — Tue, 16 Oct 2012 12:49:19 GMT

This is from the 5505 traceroute to the default gateway of the 5510...same results when i trry tio traceroute to the 4.2.2.2 from the 5505

KAKORTGW01# traceroute x.x.x.x source outside

Type escape sequence to abort.

Tracing the route to x.x.x.x

1 * * *

2 * * *

3 * * *

4 * * *

5 * * *

6 * * *

7 * * *

8 * * *

9 * * *

10 * * *

11 * * *

12 * * *

13 * * *

14 * * *

15 * * *

16 * * *

I don't know the default gateway of the 5505, the outside interface is configured to get the ip from dhcp..So i can't try from the 5510 to the default gateway of the 5505.

Traceroute Between two ASA

Jennifer Halim — Tue, 16 Oct 2012 12:52:03 GMT

So you can traceroute to 4.2.2.2 from 5510, but not from 5505?

You can check the default gateway of 5505 by checking the route: show route

Traceroute Between two ASA

Shane Riley — Tue, 16 Oct 2012 12:57:52 GMT

Oh damn i feel stupid, forgot about that command.. that was easy Thanks really appreciate your help..

yes exactly i can traceroute to 4.2.2.2 form the 5510 but not from the 5505

Traceroute from the 5510 to the 5505s default gateway is 8 hops

Traceroute Between two ASA

Jennifer Halim — Tue, 16 Oct 2012 13:17:50 GMT

Something weird happening on the 5505 end. I would check with the ISP.

Traceroute Between two ASA

Shane Riley — Tue, 16 Oct 2012 13:53:47 GMT

Well maybe it has something to do with the 5505, it has easy vpn enabled, i just saw that now vpnclient server is the ip address of the 5510.. Don't know how the easy vpn works exactly..

Traceroute Between two ASA

Jennifer Halim — Tue, 16 Oct 2012 14:04:30 GMT

Ahh, no wonder.

Easy vpn, it really depends on which mode it's on and also if split tunneling is configured or not.

It most probably sends everything through the VPN tunnel towards the 5510.

You can temporarily disable the easy vpn, and perform the traceroute, and re-enable it.

Traceroute Between two ASA

Shane Riley — Tue, 16 Oct 2012 14:13:17 GMT

Alright i try to disable the easy vpn and perform the traceroute and see

I'll get back to you in a bit..

Thanks

Shane