pix 7.0 traceroute problems

[wkw]

Hiya,

I've upgraded to pix v7.0(1) and after that, i've been having this problem of being unable to traceroute out of my WAN connection. The pix hooks up to the internet, and when i do a ping from inside to outside external ip addresses, it works, but traceroute will return unreachable after the pix hop. Traceroute to the border router immediately after the pix works. Checking at the logs indicated ICMP Time exceeded packet logs:

%PIX-4-400015: IDS:2005 ICMP time exceeded from xxx to yyy outside

I have already explicitly allow access-list out_in line 12 extended permit icmp any xxx 255.255.255.224 time-exceeded

to allow time-exceeded icmp packets to come in, but to no avail. Any suggestions? Inspect icmp is on as well

[gfullage]

The log message you're seeing is a PIX IDS message specifically, so you have the "ip audit" functionality enabled within the PIX config. This may be configured to drop signature 2005 which is a time-exceeded message.

Try something like:

ip audit signature 2005 disable

and see if that helps.

Signature 2005 is an Informational level alert only (see http://www.cisco.com/univercd/cc/td/doc/product/multisec/asa_sw/v_70/syslog/saslmsgs.htm#wp2266061), so this might imply that you have enabled the dropping of informational level alerts with the following:

ip audit info action alarm drop

where the default for this type of alert is only to alert on them. See http://www.cisco.com/univercd/cc/td/doc/product/multisec/asa_sw/v_70/cref_txt/gl.htm#wp1411995 for details.

[wkw]

I tried what you advised, unfortunately it did not work. Here's a sample of a traceroute in my case:

Tracing route to www.l.google.com [64.233.189.104]

over a maximum of 30 hops:

1 2 ms 1 ms 1 ms 172.18.xxx.xxx

2 1 ms 1 ms 1 ms 172.16.xxx.xxx -> next hope is firewall and then ISP router

3 * * * Request timed out.

4 * * * Request timed out.

5 * * * Request timed out.

6 * * * Request timed out.

7 * * * Request timed out.

8 * * * Request timed out.

9 * * * Request timed out.

10 * * * Request timed out.

11 * * * Request timed out.

12 * * * Request timed out.

13 * * * Request timed out.

14 * * * Request timed out.

15 161 ms 162 ms 163 ms 64.233.189.104

Trace complete.

[rsmith · Accepted solution]

Straight from Cisco TAC:

To permit traceroute

through PIX under 7.0 code, we need to add "inspect icmp error" in PIX configuration. Please

implement following commands in PIX configuration mode-

--> policy-map global_policy

--> class inspection_default

--> inspect icmp error

--> write mem

Hope this works for you also!

[wkw]

Cool! Your tip worked! Thanks a lot!

[jlphillips41]

Good reply! Brief, concise, not wordy or argumentative.