Traceroute "Deny inbound icmp"

[Delmiro Campelo]

Hi,

I'm having difficulties with getting traceroute to work from inside to outside. Regular pings work fine, but not traceroute. I thought the icmp inspection would allow alll icmp traffic, I have icmp inspection on globally as well as inside interface.

Commands:

policy-map global_policy-map

class global_class-map

  inspect icmp

  inspect icmp error

policy-map inside_policy-map

class inside_class-map

  inspect icmp

  inspect icmp error

service-policy global_policy-map global

service-policy inside_policy-map interface inside

icmp permit any outside

Here is the output:

On the Real-Time Log Viewer:

3

Deny inbound icmp src outside:4.69.150.77 dst inside:10.0.1.68 (type 11, code 0)

Thanks for your help

Delmiro

[Julio Carvajal · Accepted solution]

Hello Delmiro,

I would guess you already have an ACL on the outside interface of your ASA to allow some traffic from OUT to IN right?

Well let's say that the ACL is called Outside_In

Perfom the following to make this happen

access-list Outside_In permit icmp any any eq time-exceeded

Then give it a try and let us know

[Delmiro Campelo]

Thank you that worked perfectly! I have a  question, I thought that ICMP inspection would dynamically open up the necessary for port all icmp traffic?

[Julio Carvajal]

Hello Delmiro,

Amazing to hear that I could help someone else

Let me explain you this:

ICMP inspection : This command will convert the ICMP protocol into a stateful protocol but it will work with the basic icmp echo and echo reply , it will check the ICMP ID and place it into it's stateful table waiting for a reply...

In our scenario we are sending from a windows machine ICMP echo paquets with a TTL of 1 and keeps growing as it keeps moving BUT the reply will be an ICMP unreachable which the ASA will not be expecting then dropping it..

Hope that you could understand, if you do not have any other question please mark it as answered

If not let me know an I will do it one more time

Remember to rate all of the helpful posts ( by marking the stars at the left 5 being amazing 1 being the worst answer ever )

Regards,

[Delmiro Campelo]

I appreciate your help, it makes sense now, thanks.

[Julio Carvajal]

Sure Delmiro,

Have a good one