How to enable full traceroute in ASA?

[getaway51]

How to enable traceroute traffic flow for all directions & interfaces in ASA Version 9.1(7) ? 

The reason was traceroute frm PC meet with *** time-out when it reaches firewall.

[johnlloyd_13]

hi,

allow ICMP unreachable and time-exceeded on your 'outside' ACL.

sample would be:

access-list OUTSIDE_IN extended permit icmp any any unreachable
access-list OUTSIDE_IN extended permit icmp any any time-exceeded

[Marvin Rhoads]

..and make sure you "inspect icmp" in your class-map that's referenced in your active policy-map.

https://packetu.com/2009/10/09/traceroute-through-the-asa/

[getaway51]

You meant the cmd below still not sufficient to allow traceroute? wht others needed?

//create an ACL that permits the incoming ICMP
access-list outside_access_in remark ICMP type 11 for Windows Traceroute
access-list outside_access_in extended permit icmp any any time-exceeded
access-list outside_access_in remark ICMP type 3 for Cisco and Linux
access-list outside_access_in extended permit icmp any any unreachable

//bind the ACL to the outside interface
access-group outside_access_in in interface outside

[Marvin Rhoads]

Your class map needs to include icmp inspection.

If there's any access-list applied to the inside interface it must also allow icmp.

[getaway51]

is there any examples of config i can refer to? 

[Marvin Rhoads]

Yes - please see the link I provided in my reply date 9-25-2018.

[getaway51]

"Your class map needs to include icmp inspection". I am not sure how to check in the present config what it meant by "class map" here. I have read thru the blog but not sure abt the icmp inspection except from the access list config.

How class map config enabled for traceroute? How does it normally configured? Any example/sample config for be great.

[Rob Ingram]

ASA(config)# fixup protocol icmp
 OR
ASA(config)# policy-map global_policy
ASA(config-pmap)# class default-inspection-class
ASA(config-pmap-c)# inspect icmp

[mkazam001]

policy-map global_policy
 class inspection_default
  inspect icmp

policy-map global_policy
 class class-default
  set connection decrement-ttl
access-list OUTSIDE-IN extended permit icmp any any time-exceeded
access-list OUTSIDE-IN extended permit icmp any any unreachable
access-group OUTSIDE-IN in interface OUTSIDE

hope that helps.

azam