topic Re: PIX 7.0 can no longer traceroute outside? in Network Security

PIX 7.0 can no longer traceroute outside?

rwhite — Fri, 21 Feb 2020 08:06:48 GMT

Hi all,

I have a PIX 515E that we recently upgraded to 128mb RAM and PIX 7.0. At the very top of our inbound access list, we have the following lines to enable people on our LAN to be able to traceroute to the internet:

access-list outside_access_in line 1 remark Allow ICMP echo-replies

access-list outside_access_in line 2 extended permit icmp any any echo-reply

access-list outside_access_in line 3 remark Allow ICMP traceroute

access-list outside_access_in line 4 extended permit icmp any any traceroute

access-list outside_access_in line 5 remark Permit ICMP unreachables

access-list outside_access_in line 6 extended permit icmp any any unreachable

access-list outside_access_in line 7 remark Permit ICMP time-exceeded

access-list outside_access_in line 8 extended permit icmp any any time-exceeded

This all worked fine before the upgrade, where we were previously running 6.3(3). Now after the upgrade, traceroutes and MTR's from *nix or Windows no longer work. I have another PIX running 6.3(3) in parallel that still works fine.

Is this a bug in the new 7.0 software? Or is there something new I need to enable to get this working with 7.0?

Thanks,

-ryan.

Re: PIX 7.0 can no longer traceroute outside?

bphan — Thu, 28 Apr 2005 06:10:56 GMT

Hello Ryan:

Have you tried enabling inspection for ICMP and see if that works?

Please also upload your 7.0 config for analysis.

See release notes for PIX 7.0 code below as regards to ICMP inspection.

----

Version 7.0(1) introduces an ICMP inspection engine. This engine enables secure usage of

ICMP, by providing stateful tracking for ICMP connections, matching echo requests with

replies. Additional controls are available for ICMP error messages, which are only

permitted for established connections.

Use the inspect icmp and the inspect icmp error commands to configure the ICMP inspection

engine.

For a complete description of the command syntax, see the Cisco PIX Security Appliance Command

Reference.

http://www.cisco.com/en/US/products/sw/secursw/ps2120/prod_release_note09186

a00803f0f4c.html

Command reference:

http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_command_refer

ence_chapter09186a00803dfa9b.html

Thanks,

Binh

Re: PIX 7.0 can no longer traceroute outside?

rwhite — Thu, 28 Apr 2005 15:31:57 GMT

Thanks Binh, looks like it's fixed now. I indeed had to enable "inspect icmp error" to get traceroute's working again.