topic Re: traceroute through PIX 525 in Network Security https://community.cisco.com/t5/network-security/traceroute-through-pix-525/m-p/992924#M940640 <HTML><HEAD></HEAD><BODY><P>enable inspect icmp and incpect icmp error in global policy</P></BODY></HTML> Thu, 20 Mar 2008 14:11:32 GMT abinjola 2008-03-20T14:11:32Z traceroute through PIX 525 https://community.cisco.com/t5/network-security/traceroute-through-pix-525/m-p/992923#M940639 <P>Greetings,</P><P>Am running a Cisco PIX 525 with OS v7.2. I am trying to enable traceroute through PIX. I already have the below config on my firewall for allowing ICMP replies from untrusted i/f.</P><P></P><P>access-list xxxx extended permit icmp any any echo-reply</P><P>access-list xxxx extended permit icmp any any unreachable</P><P>access-list xxxx extended permit icmp any any time-exceeded</P><P></P><P>I want to allow these replies from anyone on the untrusted i/f, meaning I don't want to control my users to traceroute only some destinations. At the same time, I am worried that anyone can send a crafted echo-reply flood packet(s) to my network.</P><P>Is there any other secured way of allowing ICMP replies into my network? (No suggestions of H/W upgrade please. Planning to replace this PIX with a netscreen if this is the only way PIX can work.)</P><P>Suggestions are appreciated.</P><P></P><P>Thanks,</P><P>Krishna, CISSP, CCSP</P> Mon, 11 Mar 2019 12:20:10 GMT https://community.cisco.com/t5/network-security/traceroute-through-pix-525/m-p/992923#M940639 ciscokrishna 2019-03-11T12:20:10Z Re: traceroute through PIX 525 https://community.cisco.com/t5/network-security/traceroute-through-pix-525/m-p/992924#M940640 <HTML><HEAD></HEAD><BODY><P>enable inspect icmp and incpect icmp error in global policy</P></BODY></HTML> Thu, 20 Mar 2008 14:11:32 GMT https://community.cisco.com/t5/network-security/traceroute-through-pix-525/m-p/992924#M940640 abinjola 2008-03-20T14:11:32Z Re: traceroute through PIX 525 https://community.cisco.com/t5/network-security/traceroute-through-pix-525/m-p/992925#M940641 <HTML><HEAD></HEAD><BODY><P>i already have inspect icmp on my PIX.</P></BODY></HTML> Thu, 27 Mar 2008 09:09:27 GMT https://community.cisco.com/t5/network-security/traceroute-through-pix-525/m-p/992925#M940641 ciscokrishna 2008-03-27T09:09:27Z Re: traceroute through PIX 525 https://community.cisco.com/t5/network-security/traceroute-through-pix-525/m-p/992926#M940642 <HTML><HEAD></HEAD><BODY><P><A class="jive-link-custom" href="http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml" target="_blank">http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml</A></P></BODY></HTML> Thu, 27 Mar 2008 12:53:04 GMT https://community.cisco.com/t5/network-security/traceroute-through-pix-525/m-p/992926#M940642 srue 2008-03-27T12:53:04Z