Tracert not enabled in ASA

[Herald Sison]

Hi Guys,

i have enabled the command below as what i saw from other forums but still cant get a result for tracert but i can ping successfully 8.8.8.8

ASA(config)# policy-map global_policy
ASA(config-pmap)# class class-default
ASA(config-pmap-c)# set connection decrement-ttl

i have also checked and enabled ICMP in Service Policy Rules via ASDM but still not getting a tracert results. What else do i need to do to enable tracert on my ASA? my ASA model is ASA5508.

attached is the result of my tracert from my computer connected to the network. so the setup is Computer - > Coreswitch -> ASA -> Internet.

[Herald Sison]

Hi Sir,

thank you also for your advise. The moment you mentioned access list was not pointed to outside interface that made me decide to use it and it worked. 

Then i removed this configs below and it still worked well

no icmp permit any outside
no icmp permit any echo-reply outside

and i added this config below

class-map global-class
match port udp range 33434 33464

class global-class
set connection decrement-ttl