Is it smart to have ACE
#deny ip any any option any-options
enabled as part of hardening the router?
Is there some legitimate traffic that use IP options? Or should I use selective drop?
Is it smart to drop IP options as part of hardening the router?
Yes, as long as you don't need them. Most people don't need IP options.
Is there some legitimate traffic that use IP options? Or should I use selective drop?
The most common usages for IP options are listed on Cisco's site: IGMPv2 and MPLS-TE with RSVP.
I seem to remember you asking about hardening an internet router in the past. It's usually very safe to drop IP options on internet-facing routers.
answered Jul 25 '18 at 19:02
-
Yes I did, thanks for the answer. One more question. I guess that this ACL and command "Router(config)# ip options drop" have the same effect? – John Jul 25 '18 at 19:36
-
An ACL can be selectively applied. That command is global. Normally I jus configure ip options drop – Mike Pennington Jul 25 '18 at 19:50
