Traceroute result from one end of a tunnel to the other end

[laurathaqi45]

Dear community, 

I was looking to find the answer in regards the following question: "What is the result returned when performing a TraceRoute from one end of the tunnel to the over end of the tunnel". If the Tunnel is GRE, or other protocols. 

Thank you,

Laura 

[MHM Cisco World]

depend on
trace route tunnel IP (far end of GRE tunnel) using ping source (local end of GRE tunnel)
this give you only ONE HOP because the GRE tunnel is P2P <<<<here if you see more than one then there is issue and you must double check the tunnel config 

trace route tunnen destination using ping source <tunnel source> 
this give you many HOP to destination depend one ISP

[balaji.bandi · Accepted solution]

If you have all the Rule allowed for ICMP  (NO ACL or FW bloking for ICMP or any protocol)

you see your Tunnel IP--other end Trunel IP - and destination IP.

[MHM Cisco World]

 @laurathaqi45 

With respect to@balaji.bandi 

That not coreect even if there is acl or fw the traceroute is success.

[balaji.bandi]

That not coreect even if there is acl or fw the traceroute is success.

apolgies, i may be reading this wrong, what i have missed here ...so we can correct it to right.

You mean to say, if there is ACL or FW  which not allow ICMP and  only allow http (80 for discussion) - the Traceroute completes ? with success end to end you mean.

[MHM Cisco World]

this is small lab show you that even if there ACL deny ICMP the ICMP is success ???
why because the R2 ACL can not filter the INNER IP HEADER is only check the outer 
so if there is FW or ACL in Path that not prevent success of PING/Treaceroute. 

[balaji.bandi]

I understand now - what you were referring.

i am reffering end side where R1 and R2 only allow Certain traffic example only port 80 and 443 allowed as intresting services for that tunnel to the end point.