From: Ahsan Mohiuddin (ahsan.mohiuddin@yahoo.com)
Date: Sun Mar 16 2008 - 05:15:56 ART
Mike,
there is no need to allow UDP inbound. If the UDP port numbers you mentioned are allowed outbound, cisco traceroute will invoke 1) icmp time-exceeded response from transit router(s) and, 2) an icmp port-unreachable response from destination.
So, even for Cisco's UDP-based implementation of traceroute, you just need to ensure that these two icmp type codes are allowed inbound i.e. time-exceed and port-unreachable.
HTH,
Ahsan
Mike Haddad <mike.haddad@hotmail.com> wrote:
Hello,
I know that traceroute varies depening on the platform used. Some platform
use ICMP and some others use UDP as in cisco routers. THe issue is if I was
requested to allow traceroute inbound what should I choose UDP or ICMP?
ICMP ACL:
permit icmp any any time-exceeded
permit icmp any any port-unreachable
The above will allow traceroute Inbound and outbound
UDP AC:
Permit udp any any range 33434 33464
The above will allow traceroute Inbound and outbound using UDP
I appreciate your clarification and please correct me if I am incorrect,
Regards,
This archive was generated by hypermail 2.1.4 : Tue Apr 01 2008 - 07:53:53 ART