Technical Tip: How to allow traceroute from Linux or MacOS system
Description
This article provides background on ICMP and UDP traceroute functionality in the FortiGate and explains why the FortiGate cannot be tracerouted from a MacOS or a Linux Operating System.
Scope
All FortiGate users.
Solution
The FortiGate is designed to only allow ICMP when 'set allowaccess ping' is configured in the interface settings. As a result, traceroutes with UDP packets destined for the interface of the FortiGate are dropped when a standard traceroute from Linux or MacOS is performed.
It is possible to traceroute to the FortiGate from a Windows PC (uses ICMP based traceroute), but not from a Linux or a MacOS machine. Both Linux and MacOS use a UDP-based traceroute by default.
ICMP must be used for a FortiGate to reply to a traceroute request. In Linux, the 'traceroute -I' command should be used to enable ICMP-based traceroute. 'set allowaccess ping' should also be configured on the FortiGate interface:
It is possible to traceroute to the FortiGate from a Windows PC (uses ICMP based traceroute), but not from a Linux or a MacOS machine. Both Linux and MacOS use a UDP-based traceroute by default.
ICMP must be used for a FortiGate to reply to a traceroute request. In Linux, the 'traceroute -I' command should be used to enable ICMP-based traceroute. 'set allowaccess ping' should also be configured on the FortiGate interface:
config system interface
edit "mgmt1"
set vdom "InternetNAT"
set ip 192.168.182.155 255.255.254.0
set allowaccess ping https ssh snmp http telnet
set type physical
set alias "Test purpose Management"
next
end
edit "mgmt1"
set vdom "InternetNAT"
set ip 192.168.182.155 255.255.254.0
set allowaccess ping https ssh snmp http telnet
set type physical
set alias "Test purpose Management"
next
end
