topic Re: Allow Check Point to accept and respond to traceroute in General Topics

Allow Check Point to accept and respond to traceroute

Mike_Jensen — Thu, 28 May 2020 17:49:07 GMT

I know that by default Check Point will not accept a traceroute, whether it is the RFC standard or the Microsoft bastardized version.

For routing and latency troubleshooting purposes what is the best way to allow a Check Point appliance to accept and send the response to a traceroute, whether it is the UDP or Microsoft version? I see the tracerroute object is for the UNIX UDP standard. I have a utility that installs in MS Windows that will do a UDP traceroute but it doesn't follow the RFC UDP ports. Any suggestions?

Re: Allow Check Point to accept and respond to traceroute

PhoneBoy — Thu, 28 May 2020 19:45:24 GMT

Windows traceroute is ICMP-based with a short TTL.
That means allowing ICMP Echo Request in the policy.

Re: Allow Check Point to accept and respond to traceroute

Mike_Jensen — Thu, 28 May 2020 20:31:40 GMT

Do I allow the icmp echo requests to the actual IP on the firewall itself, even if that is not the destination of the trace? Same thing for the UDP traceroute.

Re: Allow Check Point to accept and respond to traceroute

PhoneBoy — Thu, 28 May 2020 20:50:08 GMT

Just the destination of the actual traceroute in either case.