I am trying to prevent a Cisco 2911 router's IP address from appearing in an inbound traceroute. I have configured the line:
no ip unreachables
on the Internet-facing interface, and while this successfully prevents a response to a traceroute probe when the destination is the router itself, it does NOT prevent the router from showing up in a traceroute to hosts behind the router. I am desiring to prevent the router from showing up not only in the typical, standard ICMP traceroutes but also 'tcptraceroute' and anything else that would completely trace the route into the network and to the destination.
I am vaguely aware of some kind of access list configuration whereby one would block the ICMP unreachables (and others) and then apply it to the interface, with perhaps trusted hosts added as exceptions. If this is indeed the way to do this, how would I configure my Cisco?
Has anyone implemented something similar to this and, if so, how? If not, how would you propose to do this?