Support on PA for UNIX-Syle tracerouts

cancel
Showing results for 
Search instead for 
Did you mean: 

Support on PA for UNIX-Syle tracerouts

Not applicable

Does PA support unix-style tracerouts. I have enabled ICMP and PING, but tracerouts from unix hosts through palo alto are still being denied. Looking at this a little bit further, we noticed that windows-style tracerouts use ICPMP echo requests and rely on ICMP destination unreachables ,messages, but unix-style tracerouts send UDP packets with higher end ports, and rely on ICMP port unreachanbel messages.

1 ACCEPTED SOLUTION

Accepted Solutions

L4 Transporter

Hi there,

The firewall can allow both ICMP and UDP traceroutes through.  For Windows traceroute you would need to allow the 'ping' application.  For Unix traceroute your outbound policy will need to be a bit more relaxed since there is no specific traceroute App-ID yet.  When I allow all traffic through the firewall, Unix UDP traceroutes show up as "insufficient-data" in the logs.

You could manually allow Unix traceroute by configuring a Security Policy to allow UDP ports 33434 to 33534.

By default, the firewall will respond with the ICMP TTL Expired message for traceroute.  You can suppress these messages with a Zone Protection profile.

Cheers,

Kelly

View solution in original post

3 REPLIES 3

L4 Transporter

Hi there,

The firewall can allow both ICMP and UDP traceroutes through.  For Windows traceroute you would need to allow the 'ping' application.  For Unix traceroute your outbound policy will need to be a bit more relaxed since there is no specific traceroute App-ID yet.  When I allow all traffic through the firewall, Unix UDP traceroutes show up as "insufficient-data" in the logs.

You could manually allow Unix traceroute by configuring a Security Policy to allow UDP ports 33434 to 33534.

By default, the firewall will respond with the ICMP TTL Expired message for traceroute.  You can suppress these messages with a Zone Protection profile.

Cheers,

Kelly

View solution in original post

As the last response to this was in Dec 2010, are there any plans to support traceroute on unix with an App-ID anytime soon?

Hi,

I believe there will be a separate App-ID for traceroute including UDP. Please defer to your Sales SE to determine ETA/Roadmap.

Regards,

Renato

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!