ASA Traceroute

[jay_7301]

Hi,

I'm unable to traceroute through a CISCO ASA 5505. We want to be able to trace to websites for diagnostic purposes for example 8.8.8.8. The following commands we currently have on the firewall are

access-list outside_in extended permit icmp any any time-exceeded
access-list outside extended permit icmp any host (outside public ip ) time-exceeded
icmp unreachable rate-limit 1 burst-size 1
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
inspect icmp

Cisco Adaptive Security Appliance Software Version 9.1(7)4

tracing from the asa sourcing from the outside interface is successful, however tracing from the internal network isn't

Any recommendations would be great

Thanks

[Marvin Rhoads]

Paul Stewart wrote a blog post a number of years ago that's still valid:

http://www.packetu.com/2009/10/09/traceroute-through-the-asa/

From what you posted you should also include decrement-ttl at a minimum. If that doesn't fix it, tell us more specifically what failure you are seeing and we can go from there.