CCIE - Internetwork Expert's Online Community

Hello,

 

this solution works for me (the traceroute hits R5 on Fa0/1):

 

************************************************

!
interface FastEthernet0/1
 ip address 156.1.58.5 255.255.255.0
 ip nat outside

!

ip nat inside source list NAT interface Loopback0 overload

!

ip access-list extended NAT
 permit icmp any any port-unreachable
 permit icmp any any time-exceeded

**********************************************

 

Correct me if I am wrong?

 

Thanks,

Michael

The solution works for me as well.

Actually I do not know why

１）permit icmp any any port-unreachable

２）permit icmp any any time-exceeded

instead of

３）permit icmp any any

I think ”permit icmp any any” is enough

Do anybody know why, thanks？

permit icmp any any is enough, but the question asks to allow traceroute.
When you allow ICMP, a lot more is allowed besides traceroute.

The port-unreachable (end-point) and time-exceeded (TTL expired) are
necessary for traceroute to work and the only correct answer for the
question.


Rick Mur
CCIE #21946 (R&S)
CCNP, CCIP, JNCIA-ER, MCSE
rick@rickmur.com


On 8 Dec 2008 05:26:15 -0800
yknife wrote:

Actually I do not know why
１）permit icmp any any port-unreachable
２）permit icmp any any time-exceeded
instead of
３）permit icmp any any
I think icmp any any is enough
Do anybody know why, thanks？


"Internetwork Expert - The Industry Leader in CCIE Preparation
http://www.internetworkexpert.com

Subscription information may be found at:
http://www.ieoc.com/forums/ForumSubscriptions.aspx
"

Thanks,

Have found

http://www.cisco.com/en/US/products/sw/iosswrel/ps1831/products_tech_note09186a00800a6057.shtml#traceroute

Doesn't it say at the beginning of the lab "Do not use any policy routing unless otherwise specified"?  I guess I need a definition of exactly what that means.  This seems to me like the source guide is breaking the rules.