4

Is it smart to have ACE

#deny ip any any option any-options

enabled as part of hardening the router?

Is there some legitimate traffic that use IP options? Or should I use selective drop?

5

Is it smart to drop IP options as part of hardening the router?

Yes, as long as you don't need them. Most people don't need IP options.

Is there some legitimate traffic that use IP options? Or should I use selective drop?

The most common usages for IP options are listed on Cisco's site: IGMPv2 and MPLS-TE with RSVP.

I seem to remember you asking about hardening an internet router in the past. It's usually very safe to drop IP options on internet-facing routers.

| improve this answer | |
  • Yes I did, thanks for the answer. One more question. I guess that this ACL and command "Router(config)# ip options drop" have the same effect? – John Jul 25 '18 at 19:36
  • An ACL can be selectively applied. That command is global. Normally I jus configure ip options drop – Mike Pennington Jul 25 '18 at 19:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.