traceroute question

marcusbrutus — Mon, 11 Mar 2019 17:42:47 GMT

Hi,

I am dumbfounded over this problem i have.

Whenever i do a traceroute using pingplotter (uses icmp not udp), i get replies from all devices in the path but not from the ASA and our perimeter router. I understand why the ASA doesn't show but i am confused why our perimeter router which is the next hop device after our ASA fails to show in the traceroute results. I connected a laptop to a switch which connectes to the perimter router and traceroute tests show it responding.

Checking the ASA i am able to verify the below:

1. ip inspect icmp and ip inspect icmp error is enabled globally on the ASA.
2. Applied ACL on outside interface allowing all ICMPs to inside.
3. Applied ACL on inside interface allowing all ICMPs to outside.
4. Traceroute from ASA shows perimter router replying.

I would really appreciate any help here.

Thanks in advance.

Re: traceroute question

Kent Heide — Sun, 09 May 2010 10:10:09 GMT

Add to your global policy under class-default the "decrement-ttl" check. This will make the ASA show up in traceroute and most likely fix your router aswell.

topic Re: traceroute question in Network Security

traceroute question

Re: traceroute question