How to allow outbound traceroute

[David Kozinn <david @ monygmc . mony . com>]

(I hope this hasn't come up recently, I lost a bundle of messages from the
list recently.)

I'd like to configure a Cisco 2501 so that it will allow a traceroute to
function from a bastion host (on the internal side of the firewall, of
course) without allowing incoming traceroutes, pings, or anything else that
can be used to probe the internal network. Is it actually possible to do
this and if so, can someone give me a shove in the right direction?

Thanks....
-- 
 David Kozinn                   dkozinn @
 csc .
 com / david @
 mony .
 com
 Computer Sciences Corporation  Under contract to Mutual of New York
 Technology Management Group    +1-201-907-6990