Allow Check Point to accept and respond to traceroute

[Mike_Jensen]

I know that by default Check Point will not accept a traceroute, whether it is the RFC standard or the Microsoft bastardized version.

For routing and latency troubleshooting purposes what is the best way to allow a Check Point appliance to accept and send the response to a traceroute, whether it is the UDP or Microsoft version?  I see the tracerroute object is for the UNIX UDP standard.  I have a utility that installs in MS Windows that will do a UDP traceroute but it doesn't follow the RFC UDP ports.  Any suggestions?

[PhoneBoy]

Windows traceroute is ICMP-based with a short TTL.
That means allowing ICMP Echo Request in the policy.

[Mike_Jensen]

Do I allow the icmp echo requests to the actual IP on the firewall itself, even if that is not the destination of the trace?  Same thing for the UDP traceroute.

[PhoneBoy]

Just the destination of the actual traceroute in either case.