I put in the SNAT you suggested. It stops the tracert at the ASG, but then they go nowhere. I do have a packet fileter rule that says Lab Network (Any) -> Any