Al deze symptomen worden gezien:
Traceroute-opdrachten die rechtstreeks zijn geïnitieerd vanaf Cisco Firewall Threat Defense (FTD)-apparaten, geven consequent alleen "* * *" terug voor alle hops bij het targeten van externe IP-adressen
ICMP-ping naar dezelfde bestemmingen is succesvol en ICMP is expliciet toegestaan in het toegangscontrolebeleid.
Dit gedrag voorkomt zichtbaarheid in padsprongen voor verkeer dat afkomstig is van het FTD-apparaat en heeft invloed op de inspanningen voor het oplossen van netwerkpadproblemen.
Voorbeeld
Ping naar de bestemming werkt:
firepower# ping 192.168.203.89 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.203.89, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/10 ms
De traceroute is niet:
firepower# traceroute 192.168.203.89 Type escape sequence to abort. Tracing the route to 192.168.203.89 1* * * 2* * * 3* * * ... 30* * * firepower#
De mogelijke oplossingen zijn afhankelijk van het doel van de geconfigureerde NAT-regel.
Als het doel was om de interne server-IP alleen voor uitgaande toegang te vertalen, kunt u de NAT-regel als unidirectioneel configureren.
Op FMC kan dit worden gedaan vanuit de NAT-regel Geavanceerde opties:
De geïmplementeerde NAT-configuratie:
firepower# show run nat nat (INSIDE,OUTSIDE) source static server_host interface unidirectional firepower#
firepower# traceroute 192.168.203.89 Type escape sequence to abort. Tracing the route to 192.168.203.89 1 192.168.201.88 2 msec 2 msec 2 msec 2 192.168.203.89 1 msec * 1 msec
Als het doel is dat de interne server van buitenaf bereikbaar is, kunt u de NAT-regel specifieker maken door het doorsturen van poorten te configureren:
De geïmplementeerde NAT-configuratie:
firepower# show run nat nat (INSIDE,OUTSIDE) source static server_host interface service SVC_25769850586 SVC_25769850587
firepower# traceroute 192.168.203.89 Type escape sequence to abort. Tracing the route to 192.168.203.89 1 192.168.201.88 2 msec 2 msec 2 msec 2 192.168.203.89 1 msec * 1 msec
Dit is te zien in Wireshark:
Schakel pakketopnamen in op de firewall-interface voor toegangsbeheer met trace om te zien hoe de firewall omgaat met de toegangspakketten:
firepower# capture CAPI trace interface OUTSIDE match ip host 192.168.203.89 host 192.168.201.100
Test met ping:
firepower# ping 192.168.203.89 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.203.89, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
Vervolgens testen met traceroute:
firepower# traceroute 192.168.203.89 Type escape sequence to abort. Tracing the route to 192.168.203.89 1* * * 2* * * 3* * * 4* * * 5* * * 6* * * 7* * * …
Controleer de inhoud van de opname:
firepower# show capture CAPI 190 packets captured 1: 13:50:27.345471 802.1Q vlan#201 P0 192.168.201.200 > 192.168.203.89 icmp: echo request 2: 13:50:27.345975 802.1Q vlan#201 P0 192.168.203.89 > 192.168.201.200 icmp: echo reply 3: 13:50:27.346219 802.1Q vlan#201 P0 192.168.201.200 > 192.168.203.89 icmp: echo request 4: 13:50:27.346600 802.1Q vlan#201 P0 192.168.203.89 > 192.168.201.200 icmp: echo reply 5: 13:50:27.346814 802.1Q vlan#201 P0 192.168.201.200 > 192.168.203.89 icmp: echo request 6: 13:50:27.347165 802.1Q vlan#201 P0 192.168.203.89 > 192.168.201.200 icmp: echo reply 7: 13:50:27.347378 802.1Q vlan#201 P0 192.168.201.200 > 192.168.203.89 icmp: echo request 8: 13:50:27.347714 802.1Q vlan#201 P0 192.168.203.89 > 192.168.201.200 icmp: echo reply 9: 13:50:27.347928 802.1Q vlan#201 P0 192.168.201.200 > 192.168.203.89 icmp: echo request 10: 13:50:27.348279 802.1Q vlan#201 P0 192.168.203.89 > 192.168.201.200 icmp: echo reply 11: 13:50:33.229724 802.1Q vlan#201 P0 192.168.201.200.49168 > 192.168.203.89.33434: udp 0 12: 13:50:33.232562 802.1Q vlan#201 P0 192.168.201.88 > 192.168.201.200 icmp: time exceeded in-transit 13: 13:50:36.220279 802.1Q vlan#201 P0 192.168.201.200.49168 > 192.168.203.89.33435: udp 0 14: 13:50:36.222827 802.1Q vlan#201 P0 192.168.201.88 > 192.168.201.200 icmp: time exceeded in-transit 15: 13:50:39.220172 802.1Q vlan#201 P0 192.168.201.200.49168 > 192.168.203.89.33436: udp 0 16: 13:50:39.222675 802.1Q vlan#201 P0 192.168.201.88 > 192.168.201.200 icmp: time exceeded in-transit 17: 13:50:42.220157 802.1Q vlan#201 P0 192.168.201.200.49168 > 192.168.203.89.33437: udp 0 18: 13:50:42.220737 802.1Q vlan#201 P0 192.168.203.89 > 192.168.201.200 icmp: 192.168.203.89 udp port 33437 unreachable 19: 13:50:45.220264 802.1Q vlan#201 P0 192.168.201.200.49168 > 192.168.203.89.33438: udp 0 20: 13:50:45.220752 802.1Q vlan#201 P0 192.168.203.89 > 192.168.201.200 icmp: 192.168.203.89 udp port 33438 unreachable 21: 13:50:48.220157 802.1Q vlan#201 P0 192.168.201.200.49168 > 192.168.203.89.33439: udp 0 22: 13:50:48.220645 802.1Q vlan#201 P0 192.168.203.89 > 192.168.201.200 icmp: 192.168.203.89 udp port 33439 unreachable 23: 13:50:51.220157 802.1Q vlan#201 P0 192.168.201.200.49168 > 192.168.203.89.33440: udp 0 24: 13:50:51.220645 802.1Q vlan#201 P0 192.168.203.89 > 192.168.201.200 icmp: 192.168.203.89 udp port 33440 unreachable 25: 13:50:54.220264 802.1Q vlan#201 P0 192.168.201.200.49168 > 192.168.203.89.33441: udp 0 26: 13:50:54.220752 802.1Q vlan#201 P0 192.168.203.89 > 192.168.201.200 icmp: 192.168.203.89 udp port 33441 unreachable 27: 13:50:57.220157 802.1Q vlan#201 P0 192.168.201.200.49168 > 192.168.203.89.33442: udp 0 28: 13:50:57.220645 802.1Q vlan#201 P0 192.168.203.89 > 192.168.201.200 icmp: 192.168.203.89 udp port 33442 unreachable
Traceer de ingangen ICMP-pakketten van de ping-test.
Pakket #2 is het antwoord op de ICMP ping verzoek verzonden in Pakket #1.
firepower# show capture CAPI packet-number 2 trace 190 packets captured 2: 13:50:27.345975 802.1Q vlan#201 P0 192.168.203.89 > 192.168.201.200 icmp: echo reply … Phase: 4 Type: FLOW-LOOKUP Subtype: Result: ALLOW Elapsed time: 488 ns Config: Additional Information: Found flow with id 143799, using existing flow … Phase: 6 Type: ADJACENCY-LOOKUP Subtype: Resolve Nexthop IP address to MAC Result: ALLOW Elapsed time: 1952 ns Config: Additional Information: Found adjacency entry for Next-hop 0.0.0.0 on interface identity Adjacency :Active MAC address 0000.0000.0000 hits 483359 reference 2 Result: input-interface: OUTSIDE(vrfid:0) input-status: up input-line-status: up output-interface: NP Identity Ifc Action: allow Time Taken: 18056 ns 1 packet shown
De belangrijkste punten van het spoor zijn:
Traceer de ingangen ICMP pakketten van de traceroute test.
Pakket #12 is het antwoord van de transit host:
firepower# show capture CAPI packet-number 12 trace
190 packets captured
12: 13:50:33.232562 802.1Q vlan#201 P0 192.168.201.88 > 192.168.201.200 icmp: time exceeded in-transit
Phase: 3
Type: UN-NAT
Subtype: static
Result: ALLOW
Elapsed time: 6344 ns
Config:
nat (INSIDE,OUTSIDE) source static server_host interface
Additional Information:
NAT divert to egress interface INSIDE(vrfid:0)
Untranslate 192.168.201.200/49168 to 192.168.200.50/49168
Phase: 7
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Elapsed time: 97 ns
Config:
access-group CSM_FW_ACL_ global
access-list CSM_FW_ACL_ advanced permit ip any any rule-id 268436480
access-list CSM_FW_ACL_ remark rule-id 268436480: ACCESS POLICY: mzafeiro_empty - Default
access-list CSM_FW_ACL_ remark rule-id 268436480: L4 RULE: DEFAULT ACTION RULE
Additional Information:
This packet will be sent to snort for additional processing where a verdict will be reached
Phase: 18
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Elapsed time: 16104 ns
Config:
Additional Information:
New flow created with id 143805, packet dispatched to next module
Phase: 20
Type: SNORT
Subtype: identity
Result: ALLOW
Elapsed time: 39496 ns
Config:
Additional Information:
user id: no auth, realm id: 0, device type: 0, auth type: invalid, auth proto: basic, username: none, AD domain: none,
src sgt: 0, src sgt type: unknown, dst sgt: 0, dst sgt type: unknown, abp src: none, abp dst: none, location: none
Result:
input-interface: OUTSIDE(vrfid:0)
input-status: up
input-line-status: up
output-interface: INSIDE(vrfid:0)
output-status: up
output-line-status: up
Action: allow
Time Taken: 158341 ns
In dit geval wordt het probleem veroorzaakt door deze statische NAT-regel:
firepower# show run nat nat (INSIDE,OUTSIDE) source static server_host interface
| Revisie | Publicatiedatum | Opmerkingen |
|---|---|---|
1.0 |
09-Apr-2026
|
Eerste vrijgave |