Filtering IP packets that contain IP options using ACL

Question

Is it smart to have ACE

#deny ip any any option any-options

enabled as part of hardening the router?

Is there some legitimate traffic that use IP options? Or should I use selective drop?

Answer 1

Is it smart to drop IP options as part of hardening the router?

Yes, as long as you don't need them. Most people don't need IP options.

Is there some legitimate traffic that use IP options? Or should I use selective drop?

The most common usages for IP options are listed on Cisco's site: IGMPv2 and MPLS-TE with RSVP.

I seem to remember you asking about hardening an internet router in the past. It's usually very safe to drop IP options on internet-facing routers.