Symptoms

• Traceroute results return asterisks (*) instead of IP addresses or DNS names and/or reaches the default max hop count (3)

• Path analysis results return black dots and/or reaches the default max hop count (3)

Diagnosis

One or more intermediate hops discard Time Exceeded ICMP messages required for traceroute and path analysis to work.

Resolution

Allow on all intermediate devices (routers, firewalls, VPN tunnels) the ICMP Type = 1, Code = 0 traffic associated with Time Exceeded message.

Additional references

How to enable ICMP Time Exceeded messages on:

• Palo Alto VPN: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClfsCAC