ASA and traceroute

By default ASA does not decrease the TTL field, hence is not visible in traceroute output. This is how to change this behaviour :

asa# conf t
asa(config)# icmp unreachable rate-limit 10 burst-size 5
asa(config)# policy-map global_policy
asa(config-pmap)#
asa(config-pmap)#  class class-default
asa(config-pmap-c)# set connection decrement-ttl

The result:

asa# sh run
. . .
icmp unreachable rate-limit 10 burst-size 5
. . .
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  . . .
  inspect icmp
  inspect sunrpc

 class class-default
  set connection decrement-ttl

service-policy global_policy global
. . .

Sources:
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml
http://packetu.com/content/view/50/

Leave a Reply

Your email address will not be published. Required fields are marked *