Showing results for 
Search instead for 
Did you mean: 
Cisco Community November 2020 Spotlight Award Winners

Traceroute hops within the inside network are hidden from an outside user, when the nailed option is used for a static on ASA


What is traceroute?

Traceroute is a network diagnostic tool originally written by Van Jacobson to determine whether routing problems exist on the network. Traceroute can be used to determine which path IP packets are taking to get from your computer to the remote computer. Traceroute shouldn't be used on a network without routers. It is not really useful unless there are at least two routers in the network.

Traceroute was designed to reveal when network failures such as routing loops and black holes occur and shows roughly where those failures exist.

Windows uses an ICMP-only traceroute-like utility called 'tracert'.

UNIX, Linux and BSD based systems use a UDP-based traceroute

Core issue

This happens when you convert the ASA config from nat 0 to statics, the traceroute behavior changes from outside to inside. The destination IP address is seen for each hop.


Nat 0 shows all the hops along the path, but statics, with the nailed option or not, shows the same IP address for each hop. In order to get the statics to show each hop, issue the inspect icmp error command.

Content for Community-Ad