Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations Mike Lewis on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

Allow traceroute

Status
Not open for further replies.

151569

IS-IT--Management
Feb 4, 2006
38
BR
Hello

I need help for configuration, permit access from network internal for network external any host, for use tool traceroute, how make this ?

Thanks.

 
I have PIX 515 ... you know ?

Thanks.
 
You could do something like this:

object-group icmp-type TRACEROUTE
icmp-object echo
icmp-object time-exceeded


access-list <ACL_name> permit icmp any <server_IP> 255.255.255.255 object-group TRACEROUTE
 
You need to add

fixup protocol icmp error

Tracert sends packets with the TTL going from 1 upwards. when the router gets a packet that it kills from the TTL being 0 it replies with a new packet. The PIX/ASA won't allow that in unless you tell it to look for packets returning but sourced from the external device.


Brent
Systems Engineer / Consultant
CCNP, CCSP
 
Thanks, Brent, I had forgotten that.

John
<lots of meaningless certifications here>
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top