Solved

Cisco PIX firewall  --  how can I get traceroute to function?

Posted on 2008-10-20
4
1,530 Views
Last Modified: 2012-05-05
I have  PIX with three interfaces.  The outside interface is connected to a cable modem, the dmz interface is connected to network 192.168.1.0 and the inside interface is connected to network 192.168.128.0.  My security policy is simple, unrestricted outbound access from both dmz and inside.  No access from outside to inside. Limited access from outside to dmz (only dns and http).  It's all working pretty good except I am unable to successfully initiate traceroute from a host on either the inside or dmz networks to a host on the Internet.  It seems I need to permit something inbound that I am not currently permitting.  Do I need to modify an ACL in some fashion?
0
Comment
Question by:w6hr
  • 3
4 Comments
 
LVL 10

Expert Comment

by:kyleb84
ID: 22764620
ICMP needs to be enabled inbound.
0
 
LVL 10

Expert Comment

by:kyleb84
ID: 22764640
Specifically ICMP Type 8 (echo-request) and 11 (time-exceeded)

Cisco guide on enabling pings:
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml

0
 

Author Comment

by:w6hr
ID: 22764689
Great, that works!!  Thanks
0
 
LVL 10

Accepted Solution

by:
kyleb84 earned 500 total points
ID: 22764717
w6hr,

Please close this question properly by choosing Yes to the "Is this what you were looking for?" and grading my answer.

Cheers.
KB.
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Overview The Cisco PIX 501, PIX 506e, ASA 5505 and ASA 5510 (most if not all of this information will be relevant to the PIX 515e but I do not have a working configuration handy to verify the validity) are primarily used within small to medium busi…
Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now