Revisited, public servers, protocol and port restriction on outside interface

[miles0001]

Hi folks,

Recently, I got help by Jouni restricting port access from the outside. Previously, I allowed IP, and ICMP from outside, and for example traceroute displayed the router names/addresses. After only allowing those ports open that correspond to internal servers, traceroute stopped working.

How can I get traceroute information, while locking down all irrelevant ports?

Best regards,

Peter

[Jouni Forss · Accepted solution]

Hi,

You could start by checking if you have the following configurations

Issue the following command to see what inspections you have enabled

show run policy-map

Check if you have any "icmp" related inspections enabled. If not, then add the following to the same section where the rest of them are

inspect icmp error

inspect icmp

Also add the following statements to your ACL that is attached to your "outside" interface ACL

access-list OUTSIDE-IN line 1 remark Allow ICMP Return messages

access-list OUTSIDE-IN line 2 permit icmp any any unreachable

access-list OUTSIDE-IN line 3 permit icmp any any time-exceeded

Naturally your "outside" interface ACL was named differently so use that name instead. I inserted "line" numbers as I typically keep these rules at the very top of the ACL.

You might notice on the traceroutes taken from a host that the ASA will still not show up in the traceroute. There is a configuration that will allow the ASA to show up in traceroutes also but I dont typically enable it myself.

- Jouni

[miles0001]

Thanks! Now it's working nicely!

Have a nice day :-)

Peter