You've probably guessed that our current firewall configuration
is not going to allow traceroute to work.
Let's see what happens in detail.
In the previous clip, we applied a simple but highly restrictive ACL to
R3, which protects the Wired Brain Coffee server from unauthorized
traffic originated from the Globomantics client.
Let's quickly test ping to ensure it works.
Looks good.
How about Telnet?
That looks good too.
I can log in to the server without issue.
How about traceroute?
Well, this is certainly some unexpected output.
Let's examine it. First, our client sent three UDP probes
toward the server, and the first‑hop router sent three ICMP
TTL exceeded unreachables in reply.
That's good.
Next, the client sent three more UDP probes toward the
server. R3, the router with the ACL configured,
sent these weird A packets.
What does that even mean? Turns out this A is just a code for the probes I sent
were administratively blocked by a firewall filter, and the firewall was nice
enough to notify me that it dropped my traffic.
Many firewalls are configured to silently discard dropped packets,
in which case we would see asterisks and, ultimately, a
traceroute timeout, as observed in a previous module.
Let's quickly prove it by enabling ICMP debugging and kicking off another
traceroute. As expected, we see three ICMP TTL exceeded messages from our first
hop of 10.1.4.1, which is R1. We then see three admin prohibited unreachables
from our firewall at IP address 10.1.3.3.
The reason traceroute no longer works between our client and server is we
didn't permit those sneaky UDP probes across the ACL. We only permitted ICMP
echo‑request packets and TCP‑based Telnet packets.
Everything else was denied.
Perhaps this behavior is desirable in some environments.
It could very well be the case that we, as IT administrators,
determined that traceroute was a security risk and not
operationally useful in this part of the network.
Let's assume that we actually do want traceroute to work herein
keeping with our previous theme of maximizing ICMP's utility as a network operations protocol.