ASA8.2(4) - permit IP option 7

Igor Urosevic — Tue, 12 Mar 2019 00:12:14 GMT

How to configure ASA not to drop packets with ip option 7 (record route)?

According to the docs, ip inspect ip option will drop all ip option packets except 0,1,and 20 (EOOL, NOP, or RTRALT):

If an IP header contains additional options other than EOOL, NOP, or RTRALT, regardless of whether the ASA is configured to allow these options, the ASA will drop the packet. "

Also, policy-map type inspect ip-options treats only these 3.

Tnx!

BR,

Igor

ASA8.2(4) - permit IP option 7

Julio Carvajal — Sat, 27 Oct 2012 19:52:34 GMT

Hello Igor,

See what you mean, been there!!

But the ASA was built-in as a security box and that is why will only allow those 3 ip options you let us know if configured. ( as a security design meassure).

So no way to allow the record-route option...

If you do not have any other question, please mark it as answered

Regards,

topic ASA8.2(4) - permit IP option 7 in Network Security

ASA8.2(4) - permit IP option 7

ASA8.2(4) - permit IP option 7