Can ASA increase TTL of packets it forwards?

[sasha]

Hello. Can ASA increase TTL of multicast packets while forwarding them? Sender is on the outside interface, it sends multicast with TTL = 1, receivers are all over the rather complicated inside network. ASA passes the multicast, but hext hop router discards them due to expired TTL.

Btw, I'm NOT talking about "set connection decrement-ttl" . Is there some feature that sets TTL to a given value?

ASA version is 9.13(1)2. Thanks and best regards.

[Kasun Bandara]

i dont think that is possible. you can take a packet capture before and after ASA to find TTL values and adjust multicast application accordingly. to more troubleshooting steps check below links.

https://community.cisco.com/t5/security-knowledge-base/asa-pix-fwsm-multicast-tips-and-common-problems/tac-p/4055648#toc-hId-1855988261

https://www.cisco.com/c/en/us/support/docs/ip/ip-multicast/16450-mcastguide0.html#ttlthreshold

[balaji.bandi]

how about adding in the class map as the example below :

ASA(config)#policy-map global_policy
ASA(config-pmap)#class class-default
ASA(config-pmap-c)#set connection decrement-ttl

If ASDM

1. Firewall > Service Policy Rules
2. Edit class-default
3. Go to the Connection Settings tab
4. Under Time to Live > Check “Decrement time to live for a connection”
5. OK & Save

 https://www.cisco.com/c/en/us/td/docs/security/asa/asa96/configuration/firewall/asa-96-firewall-config/conns-connlimits.html

[Marvin Rhoads]

Confirming @balaji.bandi 's answer works for at least some traffic. I have done it often for the use case of icmp ttl used in traceroute. Not sure about multicast though.

[sasha]

Dear Marvin, with all respect, confirming both You and @balaji.bandi didn't see the following sentence in my initial post:

> I'm NOT talking about "set connection decrement-ttl" .

I need to increase TTL, not decrement it... Any ideas? Thanks and best regards.

[sasha]

I've just edited the topic title ("modify" -> "increase") to avoid such misunderstandings. BR.