November 22, 2008 03:55pm pst

1. lrmoore 4,550
2. larsga 3,000
3. Pugglewu... 2,450
4. blu 2,150
5. rjwesley 2,000
5. AdriendeC 2,000
5. mwecom... 2,000
5. fredradford 2,000
5. yuy2002 2,000
5. dkarpekin 2,000
5. giltjr 2,000
5. logic2 2,000
13. RobWill 1,500
13. sliiconman 1,500
13. PennGwyn 1,500
13. kukno 1,500
17. vjlp 1,200
18. Netman66 1,000
18. harbor235 1,000
18. rejoinder 1,000
18. dariusg 1,000
18. donmanrobb 1,000
18. RobSamp... 1,000
18. TechSoEasy 1,000
18. wjester 1,000
18. Chris-Dent 1,000

1. lrmoore 10,550
2. rafael_acc 3,005
3. larsga 3,000
4. harbor235 2,900
5. yasirirfan 2,800
6. Frabble 2,600
7. donjohnston 2,500
7. rsivanandan 2,500
9. Pugglewu... 2,450
10. PennGwyn 2,300
11. sunnycoder 2,200
12. blu 2,150
13. mikebernh... 2,075
14. leew 2,000
14. batry_boy 2,000
14. rjwesley 2,000
14. fredradford 2,000
14. yuy2002 2,000
14. dkarpekin 2,000
14. jeffkell 2,000
14. mwecom... 2,000
14. AdriendeC 2,000
14. giltjr 2,000
14. renill 2,000
14. infotactix 2,000
14. logic2 2,000
14. Dbergert 2,000
14. zyclonix 2,000

08.20.2008 at 12:05PM PDT, ID: 23664352

	[x] Attachment Details

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

9.1

How do I allow ICMP replies and traceroute in an access list?

Asked by COE-IT in Network Routers, Internet Control Message Protocol (ICMP), Cisco PIX Firewall

Tags: Cisco, Router, 2600

Experts!

I'm having a problem with one of my routers allowing ICMP ping replies and traceroute while denying all other ICMP. The router is definitely connected to the internet as my users are always able to hit web sites so that is not the problem (I'm writing this question using the internet access provided from the router). I just cannot ping anything on the net!

Even when I remove all access lists from the interfaces, I am still not able to receive ping replies when I ping an internet DNS server. I believe the problem has something to do with my NAT setup but I'm not sure.

I also tried sourcing my ping from the outside interface address of the router (which is a public address) - no luck.

My router config is pasted below. Any ideas?

Also, what is the standard ICMP access list look like for admins who want to allow incoming ICMP replies and traceroute but want to deny incoming pings and all other ICMP? I ask this because I've seen many different configs on the internet that attempt to answer that question.

Thanks!
Start Free Trial

         
           
             1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:

           
           
             Router#sh run
Building configuration...
 
Current configuration : 2749 bytes
!
! Last configuration change at 12:31:12 MST Wed Aug 20 2008
! NVRAM config last updated at 14:27:17 MST Tue Aug 19 2008
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$lebn$cH
!
clock timezone MST -7
clock summer-time MST recurring
no aaa new-model
ip subnet-zero
ip cef
!
!
ip host dns 68.87.85.98
!
!
!
!
!
!
interface FastEthernet0/0
 description - WAN Connection
 ip address dhcp
 ip access-group frontline in
 ip nat outside
 duplex auto
 speed auto
!
interface Serial0/0
 no ip address
 shutdown
!
interface FastEthernet0/1
 description - PIX Connection
 ip address 192.168.1.1 255.255.255.0
 ip access-group DENY_WEB in
 ip nat inside
 speed 100
 full-duplex
!
ip nat inside source list 1 interface FastEthernet0/0 overload
ip nat inside source static 192.168.50.2 a.a.a.a
ip http server
ip classless
ip route 0.0.0.0 0.0.0.0 a.a.a.a
ip route 192.168.50.0 255.255.255.0 192.168.1.2
!
!
!
ip access-list extended DENY_WEB
 permit tcp any any eq www time-range BUSINESS_HOURS
 deny   tcp any any eq www
 permit ip any any
ip access-list extended frontline
 permit icmp any any echo-reply
 permit icmp any any time-exceeded
 permit icmp any any unreachable
 permit icmp any any source-quench
 deny   icmp any any log-input
 deny   tcp any any eq 1024
 deny   tcp any any eq 1025
 deny   tcp any any eq 1026
 deny   tcp any any eq 1027
 deny   tcp any any eq 1028
 deny   tcp any any eq 1029
 deny   tcp any any eq 1030
 deny   tcp any any eq 1720
 deny   tcp any any eq 5000
 deny   tcp any any eq www
 deny   udp any any eq 80
 deny   udp any any eq 0
 deny   tcp any any eq 0
 deny   udp any any eq 21
 deny   tcp any any eq ftp
 deny   tcp any any eq smtp
 deny   tcp any any eq finger
 deny   tcp any any eq telnet
 deny   tcp any any eq pop3
 deny   tcp any any eq ident
 deny   tcp any any eq nntp
 deny   udp any any eq 135
 deny   udp any any eq netbios-ss
 deny   tcp any any eq 143
 deny   tcp any any eq 389
 deny   tcp any any eq 443
 deny   tcp any any eq 1002
 permit tcp host x.x.x.x host 192.168.50.2 eq 22
 permit tcp host x.x.x.x host 192.168.50.2 eq 22
 permit tcp host x.x.x.x host 192.168.50.2 eq 22
 deny   tcp any any eq 22
 deny   udp any any eq 22
 permit ip any any
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 1 permit 192.168.50.0 0.0.0.255
!
line con 0
 logging synchronous
line aux 0
line vty 0 4
 password 7 
 login
!
time-range BUSINESS_HOURS
 periodic daily 7:30 to 21:05
!
!
end
 
Router#
           
         

Keywords: How do I allow ICMP replies and tracer…

	Title
1	Traceroute returning same destination …
2	traceroute
3	ISA Server and outbound ICMP
4	IPTABLES and TRACEROUTE
5	ping and traceroute
6	Traceroute problem

Loading Advertisement...

20081112-EE-VQP-44 / EE_QW_2_20070628

How do I allow ICMP replies and traceroute in an access list?

Asked by COE-IT in Network Routers, Internet Control Message Protocol (ICMP), Cisco PIX Firewall

Tags: Cisco, Router, 2600

About this solution