topic Re: Support on PA for UNIX-Syle tracerouts in General Topics

Support on PA for UNIX-Syle tracerouts

bbivolaku — Fri, 17 Dec 2010 15:04:51 GMT

Does PA support unix-style tracerouts. I have enabled ICMP and PING, but tracerouts from unix hosts through palo alto are still being denied. Looking at this a little bit further, we noticed that windows-style tracerouts use ICPMP echo requests and rely on ICMP destination unreachables ,messages, but unix-style tracerouts send UDP packets with higher end ports, and rely on ICMP port unreachanbel messages.

Re: Support on PA for UNIX-Syle tracerouts

kbrazil — Fri, 17 Dec 2010 17:09:46 GMT

Hi there,

The firewall can allow both ICMP and UDP traceroutes through. For Windows traceroute you would need to allow the 'ping' application. For Unix traceroute your outbound policy will need to be a bit more relaxed since there is no specific traceroute App-ID yet. When I allow all traffic through the firewall, Unix UDP traceroutes show up as "insufficient-data" in the logs.

You could manually allow Unix traceroute by configuring a Security Policy to allow UDP ports 33434 to 33534.

By default, the firewall will respond with the ICMP TTL Expired message for traceroute. You can suppress these messages with a Zone Protection profile.

Cheers,

Kelly

Re: Support on PA for UNIX-Syle tracerouts

msnazel — Thu, 20 Oct 2011 20:13:28 GMT

As the last response to this was in Dec 2010, are there any plans to support traceroute on unix with an App-ID anytime soon?

Re: Support on PA for UNIX-Syle tracerouts

gswcowboy — Sat, 22 Oct 2011 05:47:30 GMT

Hi,

I believe there will be a separate App-ID for traceroute including UDP. Please defer to your Sales SE to determine ETA/Roadmap.

Regards,

Renato