ACL Selective IP Options Drop

Written by Rene Molenaar on 05 October 2011. Posted in Security

Scenario:

You are the security office for the national security team in the Netherlands. One of your routers has a very high CPU load and after looking closely you can see it's spending a lot of cycles processing IP packets with special options. Since this isn't normal you decide to implement some filtering.

Goals:

All IP addresses have been preconfigure for you.
Configure router Trash so it drops IP packets with the timestamp option.
Configure router Trash so it drops IP packets with the loose source option.

IOS:

c3725-adventerprisek9_ivs-mz.124-15.T13

Topology:

IP Options Drop

Video Solution:

You need to register to download the GNS3 Topology File. (Registration is Free!)

Related Articles: Basic Zone Based Firewall
Standard Access-List
Dynamic Access List - Lock and Key
Time Based Access-List
Access-List Logging

Only registered users can write comments!

Comments (1)

jerome3079
2011-11-06 04:48:51

solution 1:
ip option drop
solution 2:
ip access-list ext abc
deny ip any any option trace route
permit ip any any
int fax/x
ip access-group abc in

my question to you:
after using ip option drop can we still allow only say ip option trace route?

Thanks

Master CCNA

Master CCNP SWITCH

Master CCNP ROUTE