The answer to that is related to how traceroute works. By sending packets of data (ICMP) with increasing TTL values, traceroutes allow you to trace the path of data packets through a network. When a router receives such packet it has two options: - reply with "TTL expired in transit" (in this case you will see the IP of the device in traceroute) - ignore the packet and not send a reply (safer from the router/device perspective)
So the things to check on FortiGate is whether the "TTL expired in transit" packet is passed from Wan to Lan, and if there is DNAT applied to this traffic (should not be)
- Toss a 'Like' to your fixxer, oh Valley of Plenty! and chose the solution, too00oo -
Might be worth highlighting that Windows and Linux use different methods for traceroute.
Windows is ICMP only, so if the firewall policy allows service=ICMP (or ALL), it should match.
Linux uses by default UDP, incrementing the dst port per each probe, starting by default from 33434. This default behaviour matches the preconfigured service "TRACEROUTE" in FortiOS (UDP/33434-33535, so it's good for up to 101 hops). Similarly, this should be matched by a policy with service=TRACEROUTE (or ALL).
Be aware that Linux traceroute can be switched to ICMP, or to TCP (defaults to port 80), and even the starting port can be customized. So depending on how creative the person running the traceroute is, you may even need to create a custom service for this in FortiGate.
And with all that said, a policy with service=ALL should let through any traceroute attempt, of course. :)
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.