topic Cisco ASA - maximum packet size in Network Security

Cisco ASA - maximum packet size

jacques_henry696 — Mon, 11 Mar 2019 17:50:21 GMT

Hello !

Is there a way to configure my ASA so that it can block an IP packet (TCP or UDP) based on its size (total size, or even better, on the IP payload)?

Thanks!

Re: Cisco ASA - maximum packet size

Panos Kampanakis — Tue, 25 May 2010 21:45:57 GMT

You can use the "fragment chain" command.

The ASA interface has an MTU. But you can allow up to certain number of IP fragments. So for example if you use 1 then a total of 1500bytes of IP packets (header+payload) will be allowed per IP packet (even fragmented packets).

I hope it helps.

Re: Cisco ASA - maximum packet size

jacques_henry696 — Wed, 26 May 2010 06:27:05 GMT

Yes I can configure the MTU on the ASA interfaces, but the command is entered "globaly" on an interface, i.e. I mean that the command is applied for both incoming and outcoming packets. The thing is that I want to drop incoming packets on an interface which size is greater than, let's say 100 Bytes.

So with your method, do you think if I use the following commands, it will work?

#fragment chain 1 inside

#fragment size 100 inside

And even if it worked, would it be enable only for incoming packets?

Thanks!

Re: Cisco ASA - maximum packet size

Panos Kampanakis — Wed, 26 May 2010 13:20:18 GMT

I am afraid that is not something you can do on the ASA.

If you have a router then Flexible Packet Matching could very well do what you want matching on header fields and patterns in the packet.

Here is a doc that explains it http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6723/prod_white_paper0900aecd803936f6.html

I hope it helps.

Re: Cisco ASA - maximum packet size

jacques_henry696 — Wed, 26 May 2010 14:02:21 GMT

All right, so it is not possible with an ASA. Now we know it's a fact!

But many thanks for the link about FPM, I think this is exactly what I needed. I'll take a look more deeply (if I can get my hand on a valid IOS file to test it!)

Again, thank you!

Re: Cisco ASA - maximum packet size

Panos Kampanakis — Wed, 26 May 2010 14:06:38 GMT

Yup, FPM is pretty useful. Little tricky but useful as it looks deeply into the packet.