Cannot run tracert behind ASA

[danno74]

We have been unable to run a tracert from behind our ASA box since we switched over to it. Anything I can do to rememedy that? Thanks.

 

[KiscoKid]

Add the following to the ACL that sits on the outside interface:

access-list outside_in permit icmp any host any time-exceeded

You confirm the name of the ACL applied to the outside interface using the 'show access-group' command.

 

[danno74]

I get this when I check:

asa-01# show access-group
^
ERROR: % Invalid input detected at '^' marker.
asa-01#

What's up?

 

[danno74]

Sorry, the carrot is under the g, didn't format right in post.

 

[KiscoKid]

Maybe that command has changed on the ASA, try 'show running' instead. It will list the entire config and there should be an entry for the access-group in there.

 

[danno74]

Sorry, I'm fairly new to this within the last year, so bear with me.

The only group settings in the show run are the following:

tunnel-group (where each peer is listed)
isakmp policy 1 group 2
isakmp policy 2 group 2
isakmp policy 3 group 1
group-lock none
group-policy DfltGrpPolicy attributes (bunch listed under that indented)

That's it.

I might not have a outside ACL group setup. Can I just enter what you have above, or does it need a group name?

 

[KiscoKid]

Yes you will create a group when you enter the command i listed above. In my example, the group is called outside_in but youcan call it whatever you prefer.

 

[danno74]

I get this error, must not translate over to the ASA:

mmri-asa-01(config)# access-list outside_in permit icmp any host any time-exce$

access-list outside_in permit icmp any host any time-exceeded
^
ERROR: % Invalid input detected at '^' marker.
mmri-asa-01(config)#

 

[danno74]

I get this error, must not translate over to the ASA:

asa-01(config)# access-list outside_in permit icmp any host any time-exce$

access-list outside_in permit icmp any host any time-exceeded
^
ERROR: % Invalid input detected at '^' marker.
asa-01(config)#

 

[danno74]

This is what another tech told me to do:

access-list outside-acl extended permit icmp any any echo-reply

access-list outside-acl extended permit icmp any any time-exceeded

access-list outside-acl extended permit icmp any any unreachable



access-group outside-acl in interface outside.

I did this but then he told me there was a problem:

Please issue the following command:



show sysopt



It appears that you don’t have the following enabled:



sysopt connection permit-ipsec



This command bypasses ACLs for IPSec traffic. In fact please delete the command: “access-group outside-acl in interface Outside” until this is done. Otherwise, new tunnels will be unable to form.

I told him he lost me...

 

[danno74]

Anyone know how to do this? I never got it to work. Thanks.

 

[Supergrrover]

danno,
Give this a try.

Make an object group (looks nicer than so many ACL lines)

object-group icmp-type icmp_messages
description ICMP group type to include PING responses
icmp-object echo-reply
icmp-object unreachable
icmp-object time-exceeded

fixup protocol icmp error (allows NATing of icmp error messages)

access-list outside-in extended permit icmp any host [External IP] object-group icmp_messages

access-group outside-in in interface outside

I tested this and it works on my ASA. Hope this helps


Brent
Systems Engineer / Consultant
CCNP

 

[NetworkGhost]

Supergrrover's post should work for you. Is this traffic coming through a tunnel? On the Pix and ASAs applying a access-list to an interface does not kill ipsec connections for that interface. They are implied allows if enabled unlike routers.

 

[CHOUM]

Hello,

Supergrrover is good but just a tip it it don't work:

replace:
access-list outside-in extended permit icmp any host [External IP] object-group icmp_messages

by :
access-list outside-in extended permit icmp any host [External NAT IP(s)] object-group icmp_messages

My best regards


CHOUM

PIX 501/515
ASA 5510