what cli command to allow does 'ip ttl reaches zero' drop count ??

[KiCheon.Lee]

Hello

FW tust interface don't reply to traceroute.

traceroute reply traffic drop by 'ip ttl reaches zero' drop count.

what cli command to allow does 'ip ttl reaches zero' drop count ??

[Phoenix]

Hello Cheon,

Is ping enabled for the interface through interface management profile. Traceroute uses icmp to calculate the hops.

Thanks

[KiCheon.Lee]

Hello Phoenix,

I made ping is enabled for the interface through interface management.

Also I made all allowed security rule.

FW configuration is no problem.

I have seen dropped pcap file.

TTL value in dropped request packet was 1.

This value was not zero.

Why was this traceroute request packet dropped??

Thanks.

[Phoenix]

Hello Cheon,

The counter "ip ttl reaches zero" indicates that the packet reaching the device has value ttl 0. This indicating that the packet sent has low ttl value. OR there is a routing loop where they ttl is reducing as it is looping.

If we can take packet capture on the device one hop before PAN and look at capture details for header information we should be seeing what ttl value is set on the packet before reaching the firewall.

Thanks