When I traceroute from internal network, after ASA...I only see * which is annoying.
I found this article.
https://supportforums.cisco.com/discussion/11219676/cannot-traceroute-through-asa
Wouldn't this bring down my network?
ciscoasa#config t
ciscoasa(config)#access-list internal-out permit icmp any any echo-reply
ciscoasa(config)#access-list internal-out permit icmp any any time-exceeded
ciscoasa(config)#access-list internal-out permit icmp any any unreachable
ciscoasa(config)#policy-map global_policy
ciscoasa(config-pmap)#class inspection_default
ciscoasa(config-pmap-c)#
inspect icmp
ciscoasa(config-pmap-c)#
inspect icmp error
ciscoasa(config-pmap-c)#end
ciscoasa(config)#service-policy global_policy global
ciscoasa(config)#access-group internal-out in interface outside
ciscoasa(config)#access-list internal-out permit icmp any any traceroute
My thought is since "internal-out ACL" has deny any any statement at the end......
If I apply this ACL to the outside interface.....all traffics will be dropped except ICMP traffics.
Am I right?
Please help.
Thank you.
