In following scenarios Security Level 50 (dmz-1) to Security level 75 (dmz-2) traceroute not working. I think traceroute use specific port for unreachable function but in following scenario i don't know which udp port it's going to pick.

enter image description here

I have following config

access-list DMZ-1-IN extended permit icmp any any unreachable
access-list DMZ-1-IN extended permit icmp any any time-exceeded
access-list DMZ-1-IN extended permit icmp any any traceroute
access-group DMZ-1-IN in interface dmz-1
class class-default
  set connection decrement-ttl


Here are the logs

Oct 20 2017 09:47:04: %ASA-4-106023: Deny udp src dmz-1: dst dmz-1: by access-group "DMZ-1-IN" [0x0, 0x0]
Oct 20 2017 09:47:04: %ASA-4-106023: Deny udp src dmz-2: dst dmz-2: by access-group "DMZ-1-IN" [0x0, 0x0]
  • One question: are you able to do this from inside interface? Please add two lines below and try again: access-list DMZ-1-IN extended permit icmp any any echo-reply ! icmp unreachable rate-limit 50 burst-size 6. When you traceroute again from dmz-1 host, check for your firewall logs with command show logging | i dmz-1_host_IP_address to see if the ASA denies/blocks traceroute traffic from that dmz-1 host or not.
    – Hung Tran
    Oct 20 '17 at 13:10
  • @HungTran ASA denying because traceroute because it is using random UDP port and in my access list only specific ports are allowed, if i do permit udp any any then it works! so it's clear you need to open udp port range for it, but if i use traceroute -p 80 <ip> it works, because port 80 is opened.
    – Satish
    Oct 20 '17 at 13:49
  • I can able to traceroute from dmz-2 to dmz-1 because higher security level to lower is pretty much open path.
    – Satish
    Oct 20 '17 at 13:51
  • Did you try to traceroute from Cisco devices or from laptop/PC?
    – Hung Tran
    Oct 20 '17 at 14:18
  • And please share the denied/dropped block messages related to this.
    – Hung Tran
    Oct 20 '17 at 15:17

Yes, you need to update your ACL to allow more UDP ports covering the traceroute packets from Unix-like Operating system.

According to the Wikipedia Page for Traceroute:

  • On Unix-like Operating Systems, traceroute sends (by default) a sequence of UDP packets with destination port range: 33434 - 33534.
  • On Windows Operating Systems, traceroute sends ICMP echo requests instead of UDP packets. That is why when you traceroute from a Windows host, you do not face this issue.

So, you need to update your ACL with the following rule to allow destination UDP ports when tracerouting from your Linux/Unix/like hosts and servers:

access-list DMZ-1-IN extended permit udp any any range 33434 33534

I hope it is helpful and answers your question.

  • Bravo! Just test it and it works!
    – Satish
    Oct 20 '17 at 18:00
  • @Satish Glad to hear it works. We know that it is a bit tricky!
    – Hung Tran
    Oct 20 '17 at 18:08


The two requirements are:

  • Inspect ICMP from the inside -> outside
  • Allow ICMP time-exceeded inbound from outside

    access-list OUTSIDE_IN remark * ALLOW ICMP BASED TRACEROUTE * access-list OUTSIDE_IN extended permit icmp any any time-exceeded

    access-group OUTSIDE_IN in interface Outside

    class-map inside-inspection match default-inspection-traffic

    policy-map inside-policy class inside-inspection inspect icmp

    service-policy inside-policy interface Inside

The following example permits host or hosts on subnet to receive echo-reply messages at the outside interface:

 hostname(config)# icmp permit host echo outside 
 hostname(config)# icmp permit echo outside 
 hostname(config)# icmp permit any unreachable outside

This is an example from https://www.cisco.com/c/en/us/td/docs/security/asa/asa82/command/reference/cmd_ref/i1.html#wp1697623

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.