Tracert results always showns same IP on ASA

[ktwaddell]

Hi

I have a ASA 5505 as a default gateway to a network, whenever I tracert to outside it shows every hop ip address as the ip address I'm trying to get too, quick example

lets say I'm in a 192.168.0.0/25 network but I want to trace to 10.10.10.10

tracert 10.10.10.10

1 4ms   5ms   6ms  10.10.10.10

2 7ms 8ms 9ms 10.10.10.10

3 *

4*

5*

6 20MS 20MS 20ms 10.10.10.10

get me?

any ideas on why the asa is doing it?

Thanks

Kev

[Diego Armando Cambronero Arias]

I have never seeing such a behavior. I would try to enable icmp error inspection and maybe decrement ttl

[ktwaddell]

Hi

ok great I'll look that up and give it try tomorrow

Cheers

Kev

[anksachd]

Hi Kev,

For Outbound traceroute to work through ASA , folllowing needs to be configured :

policy-map global_policy

class inspection_default

    inspect icmp

    inspect icmp error

access-list out  extended permit icmp any any time-exceeded

access-list out  extended permit icmp any any unreachable

access-group out in interface outside

If you want to see ASA as a hop in the traceroute output :

ciscoasa(config)#policy-map global_policy

ciscoasa(config-pmap)#class class-default

ciscoasa(config-pmap-c)#set connection decrement-ttl

ciscoasa(config)#icmp unreachable rate-limit 10 burst-size 5

Regards

Ankur

[ktwaddell]

Hiya

That didn't work sadly, I got less replys but they were still all showing as the IP address I want to get too. I've just checked checked and I get the very same thing on my other ASA as well.

ok why can I insert, an image, video, url but not the config!!

how do I put a config on here??

too early for this

[mirober2]

Hi Kev,

Is the ASA running an 8.3 or 8.4 version of software? If so, this is caused by the following bug:

CSCtj50797 - Traceroute to or through ASA always shows destination IP

The bug is fixed in 8.3.2 and 8.4.1 and higher.

-Mike

[ktwaddell]

Morning All

Well that is spot the issue I'm having, i have 3 ASA's 2 with the same issue and 1 working fine, ios below

not working correctly

5505 8.4(2)

5510 8.4(1)

working fine

5510 8.2(1)

Cheers

Kev

[DaveNoonan26775]

I know this is ancient but it shows up in search results.

Someone else on CCO said that the issue was a no-nat statement with Any as the source interface.  I have inside-outside in my no-nat and am seeing this problem.  I do have Any in the default NAT statement and will try changing that later.