topic Re: problem with decrement-ttl traceroute in Network Security

problem with decrement-ttl traceroute

saber.sattari — Fri, 21 Feb 2020 17:35:10 GMT

please help me . i can not do it

Re: problem with decrement-ttl traceroute

Marvin Rhoads — Sat, 12 Oct 2019 11:41:40 GMT

Try removing the "icmp..." line and putting that in a separate FlexConfig object.

Also make sure you've typed in the line manually and not pasted it from an external text editor.

It works fine on my FMC (currently running 6.5.0 but this config has been in place since 6.1.x):

Re: problem with decrement-ttl traceroute

Rob Ingram — Sat, 12 Oct 2019 12:54:48 GMT

Hi,

The flexconfig method certainly worked before on older versions of FTD, but I've recently deployed FTD 6.4 and I recieved the same error "error - unsupported CLI" as you do.

This cisco documentation provides provides the new method to configure. You will need to define and extended ACL, then define a "Threat Defense Service Rule" under the Access Control Policy > Advanced settings.

ACL

Threat Defense Service Policy

Once configured the output on the CLI is the same syntax as before, I assume Cisco has just removed the ability to configure via Flexconfig in newer versions.

HTH

Re: problem with decrement-ttl traceroute

Marvin Rhoads — Sun, 13 Oct 2019 02:51:19 GMT

Good catch @Rob Ingram!

It looks like upgraded FMC carries forward the old syntax but new installations require you to use the new method. That's confusing to say the least.

Re: problem with decrement-ttl traceroute

saber.sattari — Sun, 13 Oct 2019 13:46:14 GMT

Thank you for your answer
But the problem still exists

marvin , RJI

I did all that you said , But when I write the word (connection ), the problem is correct

Re: problem with decrement-ttl traceroute

Rob Ingram — Sun, 13 Oct 2019 19:28:45 GMT

Hi,

I think you did not read my comment properly, you cannot configure this command using Flexconfig on newer versions of FTD.

As per the cisco guide here, you need to define an Extended ACL and modify the Threat Defense Service Policy to reference the ACL and then tick the box to "Enable Decrement TTL". See the screenshots I previously provided.

HTH