topic Re: Why does the Selective-ACK-Permitted option is enabled by de in Network Security

Why does the Selective-ACK-Permitted option is enabled by default?

Eric Archambault — Mon, 11 Mar 2019 17:02:37 GMT

Hi,

On FWSM running 3.2 OS, the sysopt connectione tcp sack-permitted is enabled by default. Because of the tcp randomization that is enabled too by default the tcp selective acknowledge feature is not usefull. I'm planning too disable the tcp-sack using the no sysopt command. Usually, OS default configuration are consistant. Am I missing something here?

Thanks!

Re: Why does the Selective-ACK-Permitted option is enabled by de

Kureli Sankar — Thu, 28 Jan 2010 14:32:36 GMT

Yes it is enabled by default.

http://www.cisco.com/en/US/docs/security/fwsm/fwsm32/command/reference/s8.html#wp2736408

Command Default

This command is enabled by default, and the Selective-ACK-Permitted option remains intact.

This is a security feature so, it is enabled by default. You can turn it off by adding the keyword "norandomseq" in the tail end of the static command as well.

-KS