topic Re: Allowing the PAN to respond to tracert in General Topics https://live.paloaltonetworks.com/t5/general-topics/allowing-the-pan-to-respond-to-tracert/m-p/25468#M18569 <HTML><HEAD></HEAD><BODY><P>Also, make sure you are not suppressing any ICMP messages with a Zone Protection profile.</P><P></P><P>Cheers,</P><P></P><P>Kelly</P></BODY></HTML> Tue, 04 Oct 2011 22:29:57 GMT kbrazil 2011-10-04T22:29:57Z Allowing the PAN to respond to tracert https://live.paloaltonetworks.com/t5/general-topics/allowing-the-pan-to-respond-to-tracert/m-p/25464#M18565 <HTML><HEAD></HEAD><BODY><P>I'm able to ping the interface and don't see any denies in the log, but when I traceroute through the PA-500 it does not respond.</P><P></P><P>The rest of the hops do respond, just not the PAN itself.</P></BODY></HTML> Mon, 03 Oct 2011 23:20:08 GMT https://live.paloaltonetworks.com/t5/general-topics/allowing-the-pan-to-respond-to-tracert/m-p/25464#M18565 bjdraw 2011-10-03T23:20:08Z Re: Allowing the PAN to respond to tracert https://live.paloaltonetworks.com/t5/general-topics/allowing-the-pan-to-respond-to-tracert/m-p/25465#M18566 <HTML><HEAD></HEAD><BODY><P>are you allowing both of the following applications in your security policy: ICMP and ping </P><P></P><P>-Benjamin</P></BODY></HTML> Mon, 03 Oct 2011 23:23:41 GMT https://live.paloaltonetworks.com/t5/general-topics/allowing-the-pan-to-respond-to-tracert/m-p/25465#M18566 bpappas 2011-10-03T23:23:41Z Re: Allowing the PAN to respond to tracert https://live.paloaltonetworks.com/t5/general-topics/allowing-the-pan-to-respond-to-tracert/m-p/25466#M18567 <HTML><HEAD></HEAD><BODY><P>The policy between the two zones in question are any application, any port.</P></BODY></HTML> Tue, 04 Oct 2011 15:12:37 GMT https://live.paloaltonetworks.com/t5/general-topics/allowing-the-pan-to-respond-to-tracert/m-p/25466#M18567 bjdraw 2011-10-04T15:12:37Z Re: Allowing the PAN to respond to tracert https://live.paloaltonetworks.com/t5/general-topics/allowing-the-pan-to-respond-to-tracert/m-p/25467#M18568 <HTML><HEAD></HEAD><BODY><P>What is your management policy for either interface?&nbsp; If there is no management policy in place for an interface, IIRC it won't respond to ping or any other ICMP messages.</P></BODY></HTML> Tue, 04 Oct 2011 21:21:04 GMT https://live.paloaltonetworks.com/t5/general-topics/allowing-the-pan-to-respond-to-tracert/m-p/25467#M18568 bradenmcg 2011-10-04T21:21:04Z Re: Allowing the PAN to respond to tracert https://live.paloaltonetworks.com/t5/general-topics/allowing-the-pan-to-respond-to-tracert/m-p/25468#M18569 <HTML><HEAD></HEAD><BODY><P>Also, make sure you are not suppressing any ICMP messages with a Zone Protection profile.</P><P></P><P>Cheers,</P><P></P><P>Kelly</P></BODY></HTML> Tue, 04 Oct 2011 22:29:57 GMT https://live.paloaltonetworks.com/t5/general-topics/allowing-the-pan-to-respond-to-tracert/m-p/25468#M18569 kbrazil 2011-10-04T22:29:57Z Re: Allowing the PAN to respond to tracert https://live.paloaltonetworks.com/t5/general-topics/allowing-the-pan-to-respond-to-tracert/m-p/25469#M18570 <HTML><HEAD></HEAD><BODY><P>It was my zone protection, I unchecked "Suppress ICMP TTL expired error" and tracert works end to end.</P><P></P><P></P><P>Thanks!</P></BODY></HTML> Wed, 05 Oct 2011 22:07:14 GMT https://live.paloaltonetworks.com/t5/general-topics/allowing-the-pan-to-respond-to-tracert/m-p/25469#M18570 bjdraw 2011-10-05T22:07:14Z