topic Re: Traceroute through ASA? in Network Security

Traceroute through ASA?

CiscoBrownBelt — Fri, 21 Feb 2020 17:34:53 GMT

If traceroute is done lets say some far away host out in the WAN, the trace will stop showing anything once it hits a FW that is blocking it correct? Meaning, It won't just show the * but then show all IPs of the hops after it that aren't FWs?

Re: Traceroute through ASA?

Rob Ingram — Fri, 11 Oct 2019 15:56:22 GMT

Hi,

If you traceroute through the ASA, as default the ASA will not appear as a hop (unless you specify to decrement-ttl). In order for every hop on the outside of the ASA to be displayed you'd specifically need to permit that traffic. To permit traceroute traffic you'd modify your inbound ACL on the outside interface to permit time-exceeded and unreachable (it depends on which OS the traceroute was sent as to which is required).

HTH

Re: Traceroute through ASA?

Marius Gunnerud — Fri, 11 Oct 2019 19:32:27 GMT

To allow trace route through the firewall you need to implement the following commands:

policy-map global_policy

class inspection_default

inspect icmp

inspect icmp error

access-list outside_access_in extended permit icmp any any unreachable
access-list outside_access_in extended permit icmp any any time-exceeded

As @Rob Ingram has already mentioned, if you want the ASA to be seen as a hop along the traceroute path you need to configure the ASA to decrement the TTL counter.

policy-map global_policy

class class-default

set connection decrement-ttl

Re: Traceroute through ASA?

CiscoBrownBelt — Fri, 11 Oct 2019 19:57:29 GMT

Ok so I should allow ICMP as well as class class-default

set connection decrement-ttl?

Re: Traceroute through ASA?

Marius Gunnerud — Fri, 11 Oct 2019 20:05:23 GMT

No,

You need to allow ICMP but set connection decrement-ttl is only if you want the ASA to be seen in the traceroute path. If you want the ASA to remain invisible do not implement this. It is not good practice to implement it and should only be done if you have a specific need to do so.