Your concern is common. You can't replace the * for the first time because it has to do with the resolution of IP to Mac address. It will be gone on the second run of traceroute.

The * provides the information that the ping was not successful but on the second try it goes beyond the destination.

This is a normal behavior of the traceroute.

I cannot get your questions about the result of the traceroute

What do you need to accomplished? The result is normal for me.

The * * is the indication of unsuccessful ping.

This is the normal behavior of how the Address Resolution Protocol functions.

In order to allow the Sangfor IAM internal IP to be displayed in the traceroute instead of "*", you need to configure the Sangfor IAM device to respond to ICMP Time Exceeded messages. By default, many network devices, including firewalls and security devices, are configured to not respond to these messages for security reasons.

To allow the Sangfor IAM internal IP to appear in the traceroute output, you'll need to follow these steps:

1) Log in to the Sangfor IAM management interface.
2) Navigate to the configuration settings related to ICMP.
3) Look for settings related to "ICMP Time Exceeded" or "ICMP Unreachable" messages.
4) Enable the option to respond to ICMP Time Exceeded messages. This will allow the device to send back the necessary information for traceroute.
5) Save the configuration changes and apply them.

After making these changes, perform a traceroute from the client PC to an internet site again. You should now see the Sangfor IAM internal IP instead of "*".

Please check the PC's firewall if it was turned on.

check if the antivirus is blocking its connectivity.