topic Re: FXOS and traceroute in Network Security

FXOS and traceroute

paveljanik — Tue, 12 Mar 2019 14:17:13 GMT

Hi friends,

on a freshly installed FPR 4110 (2.4(1.222)), traceroute (as a command) doesn't work:

PJFPR# connect local-mgmt 

PJFPR(local-mgmt)# traceroute 8.8.8.8

Invalid parameter in , allowed characters are: a-zA-Z0-9. /:@_[]~-

PJFPR(local-mgmt)#

Any ideas?

Re: FXOS and traceroute

Marvin Rhoads — Wed, 13 Feb 2019 03:08:19 GMT

That's odd - it's definitely a supported command:

https://www.cisco.com/c/en/us/td/docs/security/firepower/fxos/CLI_Reference_Guide/b_FXOS_CLI_reference/b_CLI_reference_chapter_0101.html#wp2659671621

What terminal emulator are you using?

Re: FXOS and traceroute

paveljanik — Wed, 13 Feb 2019 06:48:35 GMT

Hi Marvin,

Yes, it is cut&pasted directly from the documentation. I have used macOS Terminal and ssh. I have now tested the freshly installed SLES and its console now with the same result. I can’t test serial console now unfortunately.

Ping with the same params (with or without "count 2") works ok:

PJFPR(local-mgmt)# ping 8.8.8.8 count 2
PING 8.8.8.8 (8.8.8.8) from 10.74.65.43 eth0: 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=51 time=2.61 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=51 time=2.51 ms

--- 8.8.8.8 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 2.519/2.567/2.616/0.070 ms
PJFPR(local-mgmt)# traceroute 8.8.8.8
Invalid parameter in , allowed characters are: a-zA-Z0-9. /:@_[]~-
PJFPR(local-mgmt)#

I have two FPRs and both show the same behaviour. ping works, but traceroute (and also traceroute6) don't.

Machines are in IPv4 only network and ping6 and traceroute6 have different results:

PJFPR(local-mgmt)# traceroute6 2a01::1
Invalid parameter in , allowed characters are: a-zA-Z0-9. /:@_[]~-
PJFPR(local-mgmt)# ping 2a01::1       
connect: Network is unreachable
PJFPR(local-mgmt)#

Only ping output is correct.

After few more tries, I added also the source address and it works:

traceroute 8.8.8.8 source 1.2.3.4

where 1.2.3.4 is my IP I can see in

PJFPR(local-mgmt)# show mgmt-port
eth0      Link encap:Ethernet  HWaddr 70:6d:15:xx:xx:xx  
          inet addr:1.2.3.4  Bcast:1.2.3.255  Mask:255.255.255.0
...
PJFPR(local-mgmt)#

The output is edited for privacy.

So it definitely looks like a documentation (source is needed) or software bug. Can anyone reproduce?

PJFPR# show version 
    Version: 2.4(1.222)
    Startup-Vers: 2.4(1.222)
PJFPR#

Re: FXOS and traceroute

Marvin Rhoads — Thu, 14 Feb 2019 01:59:41 GMT

I don't have a 4100 series to test on right now but it definitely looks like a documentation (or possibly software) bug.

I'd recommend submitting a documentation feedback report by clicking the link on the page I mentioned earlier documenting the command. It definitely indicates the "source" keyword is optional.

I've found Cisco to be responsive to feedback via that venue. I've had a couple of docs updated by using it.

Re: FXOS and traceroute

paveljanik — Thu, 14 Feb 2019 09:19:41 GMT

Yes, done.

Re: FXOS and traceroute

jomarlat — Thu, 14 Mar 2019 18:14:14 GMT

This was a bug (CSCvo40020 which was a duplicate of CSCvn85159). The issue was fixed in the most recent FXOS release.