topic Tracert results always showns same IP on ASA in Network Security

Tracert results always showns same IP on ASA

ktwaddell — Mon, 11 Mar 2019 21:54:59 GMT

I have a ASA 5505 as a default gateway to a network, whenever I tracert to outside it shows every hop ip address as the ip address I'm trying to get too, quick example

lets say I'm in a 192.168.0.0/25 network but I want to trace to 10.10.10.10

tracert 10.10.10.10

1 4ms 5ms 6ms 10.10.10.10

2 7ms 8ms 9ms 10.10.10.10

3 *

6 20MS 20MS 20ms 10.10.10.10

get me?

any ideas on why the asa is doing it?

Thanks

Kev

Tracert results always showns same IP on ASA

Diego Armando Cambronero Arias — Thu, 24 Nov 2011 14:57:55 GMT

I have never seeing such a behavior. I would try to enable icmp error inspection and maybe decrement ttl

Tracert results always showns same IP on ASA

ktwaddell — Thu, 24 Nov 2011 16:59:07 GMT

ok great I'll look that up and give it try tomorrow

Cheers

Kev

Re: Tracert results always showns same IP on ASA

anksachd — Fri, 25 Nov 2011 00:12:12 GMT

Hi Kev,

For Outbound traceroute to work through ASA , folllowing needs to be configured :

policy-map global_policy

class inspection_default

inspect icmp

inspect icmp error

access-list out extended permit icmp any any time-exceeded

access-list out extended permit icmp any any unreachable

access-group out in interface outside

If you want to see ASA as a hop in the traceroute output :

ciscoasa(config)#policy-map global_policy

ciscoasa(config-pmap)#class class-default

ciscoasa(config-pmap-c)#set connection decrement-ttl

ciscoasa(config)#icmp unreachable rate-limit 10 burst-size 5

Regards

Ankur

Tracert results always showns same IP on ASA

ktwaddell — Fri, 25 Nov 2011 07:39:58 GMT

Hiya

That didn't work sadly, I got less replys but they were still all showing as the IP address I want to get too. I've just checked checked and I get the very same thing on my other ASA as well.

ok why can I insert, an image, video, url but not the config!!

how do I put a config on here??

too early for this

Tracert results always showns same IP on ASA

mirober2 — Sat, 26 Nov 2011 18:44:27 GMT

Hi Kev,

Is the ASA running an 8.3 or 8.4 version of software? If so, this is caused by the following bug:

CSCtj50797 - Traceroute to or through ASA always shows destination IP

The bug is fixed in 8.3.2 and 8.4.1 and higher.

-Mike

Tracert results always showns same IP on ASA

ktwaddell — Mon, 28 Nov 2011 07:35:31 GMT

Morning All

Well that is spot the issue I'm having, i have 3 ASA's 2 with the same issue and 1 working fine, ios below

not working correctly

5505 8.4(2)

5510 8.4(1)

working fine

5510 8.2(1)

Cheers

Kev

Re: Tracert results always showns same IP on ASA

DaveNoonan26775 — Wed, 28 Apr 2021 14:22:08 GMT

I know this is ancient but it shows up in search results.

Someone else on CCO said that the issue was a no-nat statement with Any as the source interface. I have inside-outside in my no-nat and am seeing this problem. I do have Any in the default NAT statement and will try changing that later.