NAT

symmetric NAT = Dynamic PAT (Cisco FWs)

 ASA Firewall allow traceroute

access-list outside_acl_in extended permit icmp any any time-exceeded
access-list outside_acl_in extended permit icmp any any unreachable
!
access-group outside_acl_in in interface outside

!

policy-map global_policy

 class inspection_default

  inspect icmp

  inspect icmp error