ISR & ASR default behavior with strict and loose source routing

[riad1990new]

Hi,

Do Cisco ISR and ASR routers process IP packets with IP options for strict and loose source routing by default? For example, an external source to my network can send packets with loose source routing option and my router would actually route the traffic based on the values specified in that option's field?

If Cisco routers do process packets with these options by default, can we disable this routing feature?

And some other questions please:

1- Can we strip these IP options from packets?

2- How does this work with CEF? I would imagine that the router will not process switch packets, so it would most likely ignore the IP options fields and simply forward the packet based on the destination IP address field.

Note: I don't have access to a Cisco router to test this at the moment.

Thanks,
Riad.

[Ruben Cocheno]

@riad1990new 

Almost all routers that I've configured for customers have the Ip Source orute enabled by default, so i disable it. It is very rare to find any situation where that functionality is needed and the security implications of it are negative.

[Joseph W. Doherty · Accepted solution]

"Do Cisco ISR and ASR routers process IP packets with IP options for strict and loose source routing by default?"

I believe so, although it's the kind of option Cisco may eventually change the default.

"If Cisco routers do process packets with these options by default, can we disable this routing feature?"

Yes,

no ip source-route

(as also earlier noted by @Ruben Cocheno).

"1- Can we strip these IP options from packets?"

On a Cisco router or switch, don't believe so.

"2- How does this work with CEF? I would imagine that the router will not process switch packets, so it would most likely ignore the IP options fields and simply forward the packet based on the destination IP address field."

I've used source routing for some types of network performance analysis, it worked; believe Cisco routers it transited were CEF enabled.  Cannot say whether routers had to process switch, but for my analysis, I was only doing one packet at a time, so no discernable impact to transit routers.

[Harold Ritter]

Hi @Joseph W. Doherty ,

As far as I know, IOS-XE has

ip source-route

disabled by default for a long time.

Regards,

[Joseph W. Doherty]

Thank you.  My (dated) experience was mostly pre-XE.  Laugh, though, then default setting may have changed, as I thought it might.