Allowing Traceroutes

[khurram]

I want to be able allow trace routes into our network since we have so many public IP's. It makes troubleshooting a lot easier. But at the same time, I don't want to get hit with a massive amount of ICMP packets that could result in a DOS attack.

Any ideas on how to configure the access-lists? Thanks.

 

[yizhar]

HI.

Do some reading about ICMP code and type, so you can limit those in your ACL.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[Iota]

Well.. Typically, your inside network uses a non-routable ip address block, i.e. 10/192/172,etc. I don't see how traceroutes will get past your firewall.

Iota