Is it smart to have ACE
#deny ip any any option any-options
enabled as part of hardening the router?
Is there some legitimate traffic that use IP options? Or should I use selective drop?
Add a comment
|
1 Answer
Is it smart to drop IP options as part of hardening the router?
Yes, as long as you don't need them. Most people don't need IPv4 Options.
Is there some legitimate traffic that use IP options? Or should I use selective drop?
The most common usages for IP options are listed on Cisco's site: IGMPv2 and MPLS-TE with RSVP.
If you feel like reading a lot, RFC 7126 offers a pretty comprehensive list of IPv4 Options usage if you're worried about dropping or ignoring IPv4 Options.
I seem to remember you asking about hardening an internet router in the past. It's usually very safe to drop IP options on internet-facing routers.
answered Jul 25, 2018 at 19:02
-
Yes I did, thanks for the answer. One more question. I guess that this ACL and command "Router(config)# ip options drop" have the same effect?– JohnJul 25, 2018 at 19:36
-
An ACL can be selectively applied. That command is global. Normally I jus configure ip options drop Jul 25, 2018 at 19:50
-
@MikePennington Is it common to ignore the contents of the packets IP options, rather that drop the packets?– MarkJan 31, 2022 at 15:03
-
I can't speak about what is or isn't common for IPv4 Options handling. I usually say drop IPv4 Options on internet-facing routers (due to the risk of DDoS against your internet-facing router's control plane). FWIW, cisco has knobs to globally "drop" or "ignore" IPv4 Options. Jan 31, 2022 at 20:32