1

Is there an any option in cisco Router we can restrict MTU size to something smaller? default is 1514 but for experiment i want to allow 512 only and if packet if bigger than 512 discard them.

9
  • Do you want to restrict packets sent or received?
    – Ron Trunk
    Commented Apr 3, 2016 at 16:43
  • A router will normally fragment unless the DF bit is set in the packets.
    – Ron Maupin
    Commented Apr 3, 2016 at 16:44
  • Received, but i thought MTU is sent on Interface then why you asking send or receive.. doesn't it work both way?
    – Satish
    Commented Apr 3, 2016 at 16:44
  • The sender is the one which controls the DF bit.
    – Ron Maupin
    Commented Apr 3, 2016 at 16:45
  • In short there is no way we can say only and only allow 512 bytes and drop rest????????
    – Satish
    Commented Apr 3, 2016 at 16:46

1 Answer 1

3

You can do this with policy based routing, although this is an example of filtering any packet bigger than 512 bytes, it does not make your router fragment packets to 512 bytes.

ip access-list extended Filter
 permit ip any any

router-map Filter
 match ip address Filter
 match length 1 512
 set interface Null0

On the inbound interface:

ip policy route-map filter

This method will only work on inbound traffic coming in through the interface you have set the policy on

If you want to filter outbound traffic from the router, instead of an interface level command, use the following global command:

ip local policy route-map filter

You can also match only certain traffic by modifying what the access-list matches, or if using the global level command, and you want to filter outbound traffic only on a certain interface, you can do an extra match <out-bound interface> command in the route map

6
  • You should also explain that this will cause process routing, which will slow things, and drive up the router CPU utilization.
    – Ron Maupin
    Commented Apr 3, 2016 at 17:27
  • Cool! atleast there is an way to do that...! Bravo.
    – Satish
    Commented Apr 3, 2016 at 17:46
  • I have tried your solution but but somehow its sending all packet to Null0 even smaller packet too.
    – Satish
    Commented Apr 25, 2016 at 19:52
  • 1
    Hey Satish, Yup, the command match length 1 512 will match anything between 1 and 512 bytes, adjust the two values to get your min and max desired packet size match. I think I misunderstood your initial request when I wrote that :) Commented Apr 27, 2016 at 4:50
  • I am sending 20000 bytes packet but that policy not matching.. something weird going on.. did you test this solution before?
    – Satish
    Commented May 12, 2016 at 17:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.