topic what cli command to allow does 'ip ttl reaches zero' drop count ?? in General Topics

what cli command to allow does 'ip ttl reaches zero' drop count ??

KiCheon.Lee — Thu, 28 Nov 2013 14:15:18 GMT

Hello

FW tust interface don't reply to traceroute.

traceroute reply traffic drop by 'ip ttl reaches zero' drop count.

what cli command to allow does 'ip ttl reaches zero' drop count ??

Re: what cli command to allow does 'ip ttl reaches zero' drop count ??

Phoenix — Thu, 28 Nov 2013 22:46:13 GMT

Hello Cheon,

Is ping enabled for the interface through interface management profile. Traceroute uses icmp to calculate the hops.

Thanks

Re: what cli command to allow does 'ip ttl reaches zero' drop count ??

KiCheon.Lee — Fri, 29 Nov 2013 05:34:50 GMT

Hello Phoenix,

I made ping is enabled for the interface through interface management.

Also I made all allowed security rule.

FW configuration is no problem.

I have seen dropped pcap file.

TTL value in dropped request packet was 1.

This value was not zero.

Why was this traceroute request packet dropped??

Thanks.

Re: what cli command to allow does 'ip ttl reaches zero' drop count ??

Phoenix — Fri, 29 Nov 2013 15:02:18 GMT

Hello Cheon,

The counter "ip ttl reaches zero" indicates that the packet reaching the device has value ttl 0. This indicating that the packet sent has low ttl value. OR there is a routing loop where they ttl is reducing as it is looping.

If we can take packet capture on the device one hop before PAN and look at capture details for header information we should be seeing what ttl value is set on the packet before reaching the firewall.

Thanks