3

Is it smart to have ACE

#deny ip any any option any-options

enabled as part of hardening the router?

Is there some legitimate traffic that use IP options? Or should I use selective drop?

1 Answer 1

4

Is it smart to drop IP options as part of hardening the router?

Yes, as long as you don't need them. Most people don't need IPv4 Options.

Is there some legitimate traffic that use IP options? Or should I use selective drop?

The most common usages for IP options are listed on Cisco's site: IGMPv2 and MPLS-TE with RSVP.

If you feel like reading a lot, RFC 7126 offers a pretty comprehensive list of IPv4 Options usage if you're worried about dropping or ignoring IPv4 Options.

I seem to remember you asking about hardening an internet router in the past. It's usually very safe to drop IP options on internet-facing routers.

4
  • Yes I did, thanks for the answer. One more question. I guess that this ACL and command "Router(config)# ip options drop" have the same effect?
    – John
    Jul 25, 2018 at 19:36
  • An ACL can be selectively applied. That command is global. Normally I jus configure ip options drop Jul 25, 2018 at 19:50
  • @MikePennington Is it common to ignore the contents of the packets IP options, rather that drop the packets?
    – Mark
    Jan 31, 2022 at 15:03
  • I can't speak about what is or isn't common for IPv4 Options handling. I usually say drop IPv4 Options on internet-facing routers (due to the risk of DDoS against your internet-facing router's control plane). FWIW, cisco has knobs to globally "drop" or "ignore" IPv4 Options. Jan 31, 2022 at 20:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.