trace route to ISE interface

[benbroadfoot]

Hi there,

I am attempting to do a trace route from a switch to an interface I have on a my ISE server however it is getting blocked. Does ISE (v2.6.0.156) have some sort of firewall that could be blocking the trace attempt?

Thanks!

[MHM Cisco World]

first try ping,
are ping success ?

[benbroadfoot]

yes it pings fine, just stops on tracert - see png

[Marcelo Morais]

Hi @benbroadfoot ,

 about " ... have some sort of firewall that could be blocking the trace attempt... " ... at CLI, use the following command and search for iptables:

ise/admin# show tech-support
...
*****************************************
Running iptables -nvL...
*****************************************
...

Note: I'm able to traceroute an ISE on version 2.7.

Hope this helps !!

[benbroadfoot]

Thanks for the info @Marcelo Morais!

I have attached a screen shot of the start of the iptables section of the tech-support - what am I looking for exactly?

[Marcelo Morais · Accepted solution]

Hi @benbroadfoot ,

 the iptables looks fine !!!

 Please try the following two options:

1. If you have another ISE Node, try to traceroute from Node 2 to Node 1:

iseNode2/admin# traceroute <IP Addr of iseNode1>
traceroute to <IP Addr of iseNode1> (<IP Addr of iseNode1>), 30 hops max, 60 byte packets
1 <IP Addr of iseNode1> 0.469 ms 0.450 ms 0.449 ms

2. try to traceroute from your PC to Node 1 (using the following command) to check if the packet arrives at Node 1:

iseNode1/admin# tech dumptcp 0 | inc ICMP

10:35:05.130657 IP (tos 0x48, ttl 1, id 61535, offset 0, flags [none], proto ICMP (1), length 92)
<your PC IP Addr> > <IP Addr oof iseNode1>: ICMP echo request, id 1, seq 255, length 72

Hope this helps !!!

[benbroadfoot]

Thanks @Marcelo Morais not sure why I didn't try this initially! I AM able to tracert to the ISE interface from a PC so I'm guessing the issue isn't with ISE at all. Strange it will not allow me from a switch but will allow me from a PC?

Thanks again for your tips!

[Marcelo Morais]

@benbroadfoot , glad to be of help !!!

[MHM Cisco World]

friend use traceroute with source IP
source IP is the IP you add to ISE for router/SW