1

Can someone enlighten me on how the below is possible?

I have a remote site, L2 connection to HQ. Clients are configured like this...

  • Client (rc01) IP address 10.1.1.1/24
  • Gateway 10.1.1.254/24 (The catch: I have no access or control of this device)

HQ Edge firewall details...

  • internal 192.168.1.1/24
  • external 100.1.0.1/30

HQ example server...let's call it hq01

  • 192.168.1.2/24
  • Gateway 192.168.1.1/24

When I run a tracert from rc01 -> hq01 the first response is from hq01. But if I do the reverse (hq01 -> rc01) the first response is from the internal interface of the hq firewall as expected.

How is rc01 finding hq01 without first going through a gateway?

Improve this question
1
  • 2
    because your gateway is a firewall, and it isn't messing with TTL. (firewalls are known to do this crap to "hide")
    – Ricky
    Jul 7, 2015 at 3:59

1 Answer 1

Reset to default
2

Firewalls can be setup to not decrement the ttl(time to live) as a weak security feature, to make them invisible. This is the default on the ASA.

Explanation for your scenario,

The FW(10.1.1.254) has a interface in the server range 192.168.1.0/24. Then traceroute with ttl=1 will hit hq01 and get a response as FW delivers packet to directly connected subnet without decrementing the ttl.

In the reverse direction your server hq01 uses a real router, and sees it as the first hop, the FW is again hidden (no ttl decrement) and you see the pc next.

Traceroute Overview

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.