Traceroute on VPN client to internal IP - weird behaviour

[Difan Zhao]

Hi experts,

I have configured the 5510 with RA IPSec VPN. The ASA is running code 8.4(5) . Everything works but the (windows) traceroute behaviour is strange. The number of replies (unreachable mesg) is consistent however they all appear to be from the target IP... Here is an example

c:\Users\xxx> tracert -d 10.80.0.11

Tracing route to 10.80.0.11 over a maximum of 30 hops

1     16ms     27ms     14ms  10.80.0.11

2     19ms     15ms     14ms  10.80.0.11

3     14ms     23ms     17ms  10.80.0.11

Trace complete

Then I logged in every routers/switches in the path and run debug ICMP. They are all sending the unreachable messages from their own IP address. I also confirmed this by capturing the packets on the ASA inside interface. It seems that the ASA somehow convert those IPs to the target IP. I think it is to protect the internal routing structure from the outside.. Anyway to disable this behaviour?

I have tried "set connection decrement-ttl" but doesn't help. I have also tried to add a nat "nat (outside,inside) source static VPN-SUBNET VPN-SUBNET" and that doesn't help either...

Thanks,

[Julio Carvajal · Accepted solution]

Hello,

Can you add the following command:

fixup protocol icmp-error

Clear local-host

And then let me know

If that don't do it then you are going to take a look at this:

CSCtj50797 - Traceroute to or through ASA always shows destination IP

Regards

[Difan Zhao]

works like charm

Thanks!

[Julio Carvajal]

Hello Difan,

My pleasure to hear,

Amazing to hear that the fixup protocol icmp-error did it

Regards

[Difan Zhao]

That command is automatically converted to

  inspect icmp error

under the default policy-map

[Julio Carvajal]

Hello,

Exactly

But it's easier to add just that command instead of 3 right ?

Regards