Created On 09/25/18 19:50 PM - Last Updated 02/08/19 00:05 AM

Method of Allowing Ping through the Firewall in Windows 10 For allowing ping from the Firewall in Windows 10, you need to proceed as follows: Type control panel in the search section of your taskbar and click on the search result to launch a new control panel window. There is no 'blocking' of traceroute, tracepath, tracert or whatever the tool gets called. These commands work by setting the TTL/hoplimit of the packet to a specific value and then expect the host to send an ICMP unreachable back if the TTL/hoplimit expired (i.e. Decremented to zero). Once you've enabled these types of packets for incoming traffic in your firewall (s), you'll see that your traceroute will now function as it should. If your firewall does not allow you to configure accepting specific types of ICMP packets, try allowing incoming ICMP packets altogether (if that's not too much of a compromise for you).

A.tcptraceroute command can bypass the most common firewall filters. Basically traceroute sends out either UDP (ports 33434 to 33523) or ICMP ECHO packets with a TTL of one, and increments the TTL until the destination has been reached. The Palo Alto Networks firewall currently has an App-ID for traceroute (IPv4), so it can allow ICMP, UDP and TCP probes through the firewall based on the application.

Symptom

Symptoms

Allow Traceroute Through Asa Firewall

This article discusses the issue of traceroute being dropped by the firewall due to application of a 'Zone Protection' profile with specific options.

Traceroute failing to show any hops between the source and destination except the destination,
the firewall and the hops preceeding the firewall:

Allow Traceroute Through Firewall Configuration

Traffic for concerned source and destination hosts can be seen as 'ping' and 'traceroute' in the traffic logs with action as 'allow.'

Diagnosis

The behaviour of hops timing out is seen because the firewall is dropping the 'TTL exceeded in Transit' message (Type:11, Code:0) from these hops.

The option configured under Zone Protection profile which is applied on the Untrust Zone is 'Discard ICMP embedded with error message,' therefore the behaviour is expected. This can be seen under the following hierarchy:
Network > Zone Protection Profile > Packet Based Attack Protection > ICMP Drop > Discard ICMP embedded with error message

The packet drops can be seen in global counters as: Packets dropped: Zone protection option 'discard-icmp-error'

Note that 27 packets are being dropped, 3 packets per 9 hops.

Resolution
Enable

Allow ICMP error packets so the source receives them to populate the intermediate hops. Uncheck the option 'Discard ICMP embedded with error message' under the Zone Protection Profile:

Enable Traceroute Through Firewall

Attachments