Cisco ASA 5506-X Configuration Manual page 296

Testing Your Configuration
Trace Routes to Hosts
If you are having problems sending traffic to an IP address, you can trace the route to the host to
determine if there is a problem on the network path.
Procedure
Step 1 Make the ASA Visible on Trace Routes, page
Step 2 Determine Packet Routes, page
Make the ASA Visible on Trace Routes
By default, the ASA does not appear on traceroutes as a hop. To make it appear, you need to decrement
the time-to-live on packets that pass through the ASA, and increase the rate limit on ICMP unreachable
messages.
Procedure
Create an L3/L4 class map to identify the traffic for which you want to customize connection settings.
Step 1
class-map name
match parameter
Example:
hostname(config)# class-map CONNS
hostname(config-cmap)# match any
For information on matching statements, see
Step 2 Add or edit a policy map that sets the actions to take with the class map traffic, and identify the class
map.
policy-map name
class name
Example:
hostname(config)# policy-map global_policy
hostname(config-pmap)# class CONNS
In the default configuration, the global_policy policy map is assigned globally to all interfaces. If you
want to edit the global_policy, enter global_policy as the policy name. For the class map, specify the
class you created earlier in this procedure.
Decrement time-to-live (TTL) on packets that match the class.
Step 3
set connection decrement-ttl
If you are editing an existing service policy (such as the default global policy called global_policy), you
Step 4
can skip this step. Otherwise, activate the policy map on one or more interfaces.
service-policy policymap_name {global | interface interface_name}
Example:
hostname(config)# service-policy global_policy global
Cisco ASA Series Firewall CLI Configuration Guide
13-8
Chapter 13
13-8.
13-9.
Identify Traffic (Layer 3/4 Class Maps), page
Troubleshooting Connections and Resources
1-13.