1

Kind of an odd question, I know.

Is it possible to replace the source IP address in outbound ICMP "Time Exceeded" packets on a Cisco 2911 router? I have multiple IPs bound to the primary interface, as well as IPs on the secondary interface that act as gateway IPs for the local network that the router also responds to on the Internet.

What I'd like to do is replace the source IP address in outbound ICMP "Time Exceeded" packets so that, when a traceroute is conducted, the IP address I wish to appear to the Internet as (a secondary interface's IP address) is shown. For instance, when a traceroute is done to any machine on our network, the IP 1.2.3.4 is shown as one of the hops as that's the primary GigabitEthernet0/0 interface's IP address. I would like 2.3.4.5 to show instead (an IP assigned to GigabitEthernet0/1 and reachable from the Internet). The only way I can think of doing this is to alter the IP address in the outbound packet.

Does Cisco have this functionality? Is it possible to alter that IP in transit, for a particular type of packet?

Thank you in advance!

5
  • 1
    Changing an IP address is known as NAT (Network Address Translation), and changing a source address is source NAT. What you really want to do is to send it out the alternate interface, using source NAT for that interface. – Ron Maupin Sep 3 '16 at 4:04
  • You probably need a combination of PBR (policy based routing) and NAT, maybe even using a loopback interface to put the 'Nat inside' on. Don't do it. It's ugly and it's going to confuse everyone doing a traceroute, which might be your intention, but consider that it will also confuse the network admins that you peer with, your colleagues, maybe even yourself in a few years when you will have forgotten you did this :) Or the TAC engineer or consultant you bring in to troubleshoot a problem in your network. – hertitu Sep 3 '16 at 6:17
  • But if I did want to achieve this, how would I go about it? In the case of sending out the alternate interface - how would I do this? I know how to do such things with iptables / pf etc but not under Cisco. I am something of a Cisco neophyte. And to @hertitu: lol yes it would be confusing, but I don't necessarily intend to confuse as I do want to present our own network IP than the one assigned by our ISP. We have BGP an announce a few prefixes, and all of our IPs are on the secondary interface, so responses come from our assigned IP not our own ARIN prefixes we have on the other interface... – Brendan Sep 3 '16 at 7:22
  • Brendan: could you possibly add a figure and maybe config snippets for better clarity? I do not get the use case yet. However I would really think twice and possibly double check the current design before introducing such "strange" configurarion. – waza-ari Sep 4 '16 at 10:57
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 14 '17 at 22:07
1

Don't do it - see my comment. ;-)

But if you really really must, I think this is possible by using a combination of PBR and NAT, i.e. a variation on NAT on a stick but with a local policy (cfr Policy Based Routing) since the unreachables are locally generated. As you said it is an odd question so forgive me for not being 100% sure this will work, please consider this just as food for thought/experimentation. One particular thing I'm not sure of is where to put the "nat inside" and "nat outside":

  • inside on the WAN interface, outside on the loopback
  • inside on the loopback, outside on the WAN
  • inside on one loopback, outside on another loopback (requiring 2 clauses in the PBR routemap, one to move from WAN to first loopback, second to move from first loopback to other loopback).
1
  • Okay I'll have to look into this as I'm not too familiar with either. Again I'm a Cisco neophyte, being much more familiar with pf & iptables, but if this can be done it'd be wonderful. I'm looking at the PBR & Nat on a Stick documentation at Cisco right now – Brendan Sep 5 '16 at 15:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.