Enable Traceroute on Cisco ASA.

[nilesh.dubey]

Hi,

Is there any way to enable traceroute on Cisco ASA. firmware version is 7.1.

Thanks,

Nilesh 

[Philip D'Ath]

There are two ways of doing a traceroute.  This will enable one method.

policy-map global_policy
 class inspection_default
   ...
   inspect icmp 
   inspect icmp error 
   ...

...
service-policy global_policy global

[Marvin Rhoads]

In addition to what Philip posted...

If you want the ASA to appear as a hop in the traceroute path, you also need to tell it to decrement the TTL. By default it will not do so.

ciscoasa(config)# policy-map global_policy
ciscoasa(config-pmap)# class class-default
ciscoasa(config-pmap-c)# set connection decrement-ttl