cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

Welcome to Firewalls

236
Views
0
Helpful
3
Replies
Highlighted

Traceroute, tracert, mtr and the Firepower.

I have a new set of Firepower 2130 appliances and a Management Center 1000. One of the differences between the 5525x and the Firepower is that some users can run traceroute, tracert or mtr and get useful information. Other users cannot get past their gateway. This worked correctly on the ASA 5525x but when the consultant did the conversion to the Firepower rules some weird stuff happened.

 

Where is traceroute, etal set up? I know the process uses ICMP and/or UDP but just allowing those outbound has not cured the problem. Is there some inspection rule I need to create?

3 REPLIES
Frequent Contributor

Re: Traceroute, tracert, mtr and the Firepower.

I am also interested in this as we might migrate this year.

Meantime can you share your current traceroute "config ". I am having some issues to make it work on my current ASAs.

Re: Traceroute, tracert, mtr and the Firepower.


@Florin Barhala wrote:

I am also interested in this as we might migrate this year.

 

I've only had it a few days but, so far, I am unimpressed.  Even a simple change like blacklisting the IP of a CNC server requires redeploying the entire policy.  That takes five to ten minutes.  Don't get me started on the HTML 5 interface.

What was Cisco thinking?

 

Meantime can you share your current traceroute "config ". I am having some issues to make it work on my current ASAs.


As I recall, on the ASA  I first had to create an object list for the icmp types I wanted to accept from outside:

object-group icmp-type icmp_permit
 description icmp types allowed
 icmp-object echo-reply
 icmp-object source-quench
 icmp-object time-exceeded
 icmp-object traceroute
 icmp-object unreachable

Then on the outside interface acl I added:

  permit icmp any any object-group icmp_permit

Finally, the global policy map had to be made aware of icmp

policy-map global_policy
 class inspection_default
  <buncha stuff>
  inspect icmp
  inspect icmp error

Frequent Contributor

Re: Traceroute, tracert, mtr and the Firepower.

This is not good news (about FTD I mean).
As for my trace issue, I cannot trace from ASA itself specifying the source interface.
CreatePlease to create content
Ask the Expert- Webex Hybrid Services Solutions