Running an ASA5505. Version 9.1.1. I have the following in the configuration.. Using PAT (And some static NATs inside but not shown here). object network obj_any subnet 0.0.0.0 0.0.0.0 access-list outside_in extended permit icmp any any echo-reply access-list outside_in extended permit icmp any any time-exceeded object network obj_any nat (inside,outside) dynamic interface policy-map global_policy class inspection_default inspect icmp Ping is working just fine, but when I run a tracert I get the most bizarre responses I've ever seen. They all reply with the same hostname and ip address for every hop though the ping times seem to be working now (before I had nothing but asterisks until the final hop).. Here's an example: Tracing route to yahoo.com [206.190.36.45] over a maximum of 30 hops: 1 1 ms <1 ms <1 ms ir1.fp.vip.gq1.yahoo.com [206.190.36.45] 2 4 ms 4 ms 4 ms ir1.fp.vip.gq1.yahoo.com [206.190.36.45] 3 5 ms 5 ms 5 ms ir1.fp.vip.gq1.yahoo.com [206.190.36.45] 4 65 ms 66 ms 63 ms ir1.fp.vip.gq1.yahoo.com [206.190.36.45] 5 67 ms 63 ms 63 ms ir1.fp.vip.gq1.yahoo.com [206.190.36.45] 6 63 ms 63 ms 63 ms ir1.fp.vip.gq1.yahoo.com [206.190.36.45] 7 62 ms 65 ms 63 ms ir1.fp.vip.gq1.yahoo.com [206.190.36.45] 8 62 ms 69 ms 62 ms ir1.fp.vip.gq1.yahoo.com [206.190.36.45] 9 67 ms 69 ms 67 ms ir1.fp.vip.gq1.yahoo.com [206.190.36.45] 10 67 ms 68 ms 67 ms ir1.fp.vip.gq1.yahoo.com [206.190.36.45] 11 68 ms 122 ms 67 ms ir1.fp.vip.gq1.yahoo.com [206.190.36.45] 12 69 ms 75 ms 68 ms ir1.fp.vip.gq1.yahoo.com [206.190.36.45] 13 68 ms 74 ms 74 ms ir1.fp.vip.gq1.yahoo.com [206.190.36.45] 14 151 ms 97 ms 76 ms ir1.fp.vip.gq1.yahoo.com [206.190.36.45] Trace complete. Is there any good reason for this happening from a (mostly) factory default ASA5505 config? What is the point of a trace route that doesn't help you trace the route? lol.. Any help would be great, I don't use it everyday but tracert is a basic tool everyone should be able to use and right now mine is broken. ----EDIT to add my solution---- I basicly did (added) the following and tracert replies are looking better now: policy-map global_policy class inspection_default inspect icmp error class class-default set connection decrement-ttl access-list outside_in extended permit icmp any any unreachable icmp unreachable rate-limit 10 burst-size 5 Thanks.
... View more
