Pix - performing traceroute command

May 08, 2007 6 Replies
A

Hi,



I have the following setup:



PIX/ASA firewall on public IP address - shielding several other public addresses. Gateway is through another subnet, which has a router to the outside.



In the former firewall, I could do the following:



traceroute ping.aaisp.net.uk: [...]



1 pippin.hodgsonfamily.org (IP of firewall)
2 merry.hodgsonfamily.org (ip of router)
3 Router belonging to the ISP.

I have enabled the inspect ICMP command in the software, and can ping to outside hosts, but traceroutes fail at the first hop (timed-out).



Any suggestions? Thanks. Andrew.


Vote
Twitter Facebook LinkedIn
M

allow inbound ICMP (permit icmp ACL and access-group) and check your log

HTH Martin

Vote
Twitter Facebook LinkedIn
L

Allow icmp unreachable, time-out, parameter-problem, source-quench, and some necessary types more on the outside interface. Newer versions should contain a icmp traceroute option. But notice, that denying icmp is a excellent way to kill a lot of other IP based protocols in several corner cases.

Vote
Twitter Facebook LinkedIn
A

I thought this was what the inspect icmp was going to do - it does it for pings - allows inbound connections on an outbound request to that IP.

Andrew.

Vote
Twitter Facebook LinkedIn
L

It seems not enough. Source-Quench, time-out, Unreachable, Parameter-Problem should be allowed too. inspect icmp checks the content of the icmp payload to detect a known flow.

Vote
Twitter Facebook LinkedIn
W

Source-Quench is unauthenticated, and could be used as part of a Denial of Service attack.

Vote
Twitter Facebook LinkedIn
L

A lot of useful communication is not authenticated in the internet.

Vote
Twitter Facebook LinkedIn

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required