Cisco 3750 Switch does not allow ICMP traffic

[Edward M.]

Dear All, 

I am junior network administrator and pretty new in cisco networking world.

I'm not quite sure why my Cisco 3750 switch do not pass the ICMP/traceroute traffic.

I have ASA Firewall A which is connected to ASA Firewall B through a Cisco Switch between which does routing for LANs behind the firewalls. The routing and required ACLs are configured on both firewalls, and there is no ACL configured on the switch. 

I have one Windows VM running behind Firewall B and I can access the LAN and ping nodes behind firewall A from the VM, 

but when I trace route the same nodes, it stocks on Cisco switch and it does not pass it to firewall A as next hop.

Appreciate your advise and help.

Thanks

Ed

[Elliot Dierksen]

If you see the IP of the 3750, that means it responded. By default, ASA firewalls do not respond/participate to traceroute requests. You would also need to make sure that the lower security interface of the ASA permits ICMP unreachable for traceroute to work correctly through it.

[Edward M.]

Dear Elliot, Thanks for your reply.

I do see the 3750 IP in trace route output,  and I assume that it has passed the firewall B already even though I don't see the FW B interface IP.

I have also ACLs on both interface of FW A allowing ICMP traffic for both ping and traceroute, but still no joy.

[Elliot Dierksen]

It isn't traceroute that you need to allow, it is time-exceeded. I mispoke in the first post. The response in trace route is a time-exceeded ICMP packet which must be explicitly permitted in the ACL of the lower security interface.

[Edward M.]

Thanks Ellliot,

I added the  icmp/time-exceeded to the ACL on all interfaces of FW A.

So I have icmp, icmp/time-exceeded, icmp/traceroute, icmp/unreachable but still no joy.

[Elliot Dierksen]

In the asa's, do "debug icmp trace" and see what output you get. Have a CLI session open to both ASA's that are part of the path. That should give you an idea what is happening.