11-01-2011 05:09 PM - edited 03-11-2019 02:45 PM
Hi.
I've got an annoying problem with my ASA 5520.
I have traffic going from the inside interface (security level 100) to the outside interface (security level 0) with a global PAT applied to the outside interface address for all inside traffic - and I can't seem to traceroute through the firewall.
The ruleset is simple - basically, allow any IP from inside to outside. The NAT is simple - PAT all traffic unless exempted to the IP address of the outside interface.
If I do the trace from my internet edge router it works fine - so I know it's not soemthing my uplinks are filtering - but if I do it through the firewall, I get perfect responses until the hop where it hits the firewall interface - then nothing.
Is there something I am missing that I need to do to allow traceroute to just work with all the rest of the traffic?
Cheers and thanks.
Solved! Go to Solution.
11-01-2011 07:51 PM
Hi Darren,
By defualt ASA does not allow traceroute, you would need to enable it, here's a doc for it:
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml
Hope that helps,
Varun
11-01-2011 07:51 PM
Hi Darren,
By defualt ASA does not allow traceroute, you would need to enable it, here's a doc for it:
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml
Hope that helps,
Varun
11-02-2011 03:13 PM
Varun Rao wrote:
Hi Darren,
By defualt ASA does not allow traceroute, you would need to enable it, here's a doc for it:
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml
Hope that helps,
Varun
Varun.
Thanks for that. That document is a little confusing (in typical Cisco fashion! :-)), but by combining it with some other search results, I now have traceroute working just fine.
Appreciate the piointers!
Cheers
03-26-2017 01:56 PM
I also had to remove "IP reverse path" feature on the inbound interface as traceroute replies where comming from intermediate carrier hops with source address that is not routable accross firewall interface therefore they were dropped by "IP reverse path" feature and we could not see intermediate hops on the traceroute, only first and last. After "IP reverse path" was disabled on the transit/external interface traceroute started working. This is not a recommended practice but it was needed to get traceroute working in my case.
no ip verify reverse-path interface INTERFACE_NAME
HTH
Angel,
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide