topic Re: Enable Tracroute from DMZ Segment in Network Security

Enable Tracroute from DMZ Segment

estelamathew — Mon, 11 Mar 2019 18:35:59 GMT

Hello Dear's,

I m trying to traceroute internal server from DMZ segment which is connected to remote branches, i have enabled time-exceeded,and echo-reply,it doesn't work,also I tried by enabling unreacheable,and Access-list DMZ extended permit icmp any any but stil doesn't work,

Traceroute from internal to DMZ server is working by "time-exceeded" but it can't be done from DMZ segment to internal server.

When i have enabled Access-list DMZ extended permit UDP any any it works but it doesnt show the firewall hop.I m aware the firewall HOP is shown by the destination address but it is shows me the " * " rather than the destination.

which UDP ports i have to enable to allow traceroute.

Thanks.

Re: Enable Tracroute from DMZ Segment

abinjola — Tue, 07 Sep 2010 09:57:20 GMT

Is it a linux/unix box in DMZ that you are using for traceroute ?, Linux/Unix uses UDP datagrams for traceroute with destination ports numbering from 33434 to 33534 (usually), so you may want to open relevant UDP ports, check in logs and captures which exact ports

Regarding why firewall not showing its interface as the hop, refer:

http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/s1.html#wp1395966

---regards

Re: Enable Tracroute from DMZ Segment

estelamathew — Tue, 07 Sep 2010 20:50:59 GMT

Hello Dear's,

I m tracing from cisco router which is located in branch office that passess through DMZ interface of ASA. I m trying to do trace from branch router to internal windows Server, then why the UDP is neccessary here,i have read about UDP is necessary for Linux nd Unix Box but i m tracing to windows server.I have tried by enabling the same UDP ports as mentioned by you but still i m not able to trace but when i do UDP any any then the traceroute works.

Thanks.

Re: Enable Tracroute from DMZ Segment

golly_wog — Tue, 07 Sep 2010 22:38:29 GMT

Hello my Dear

You are correct, a Cisco IOS box uses UDP for its traceroute, doesn't matter what its tracing to, it will use UDP.

But it depends on how far the hop is away, do you know?You might want to increase the range from 33434 to 33464

😉

Re: Enable Tracroute from DMZ Segment

abinjola — Wed, 08 Sep 2010 04:32:44 GMT

to find out exact port use packet capture command on DMZ

access-list abc permit udp host host

capture cpz access-l abc interface DMZ

now traceroute and do show cap cpz

this will tell you what exact UDP ports you need

Re: Enable Tracroute from DMZ Segment

estelamathew — Wed, 08 Sep 2010 06:27:36 GMT

Thanks Dear,

I found the ports 33455,33456,33457,

Thank u once more for ur kind reply

Re: Enable Tracroute from DMZ Segment

abinjola — Wed, 08 Sep 2010 06:32:51 GMT

I am glad I could help