To use trace route it would be as follows:
Windows: open command prompt and type in C:\> traceroute -d IP.add.re.ss (the -d stops dns resolution)
Linux (mileage may vary): open up a terminal and type in ~]$ tracepath IP.add.re.ss
(Tracepath is one of many free tracing utilities)
If your IT team is opening up a port for 3299, then you have an ACL or a firewall rule blocking this by default. My question is why is your IT team blocking access to the SAP Router from the LAN, it doesn't make sense on blocking everything. Do they close it after your test is successful?