Is it smart to have ACE
#deny ip any any option any-options
enabled as part of hardening the router?
Is there some legitimate traffic that use IP options? Or should I use selective drop?
Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this communityIs it smart to drop IP options as part of hardening the router?
Yes, as long as you don't need them. Most people don't need IPv4 Options.
Is there some legitimate traffic that use IP options? Or should I use selective drop?
The most common usages for IP options are listed on Cisco's site: IGMPv2 and MPLS-TE with RSVP.
If you feel like reading a lot, RFC 7126 offers a pretty comprehensive list of IPv4 Options usage if you're worried about dropping or ignoring IPv4 Options.
I seem to remember you asking about hardening an internet router in the past. It's usually very safe to drop IP options on internet-facing routers.