Table of Contents
Advertisement
22-2
C
22: IPS
HAPTER
EC
CLI Commands
Enable Command
enable ip security_option
C
OMMANDS
The enable ip_security option command has the following parameters.
drop_all_fragoffset1
drop_tcp_fragoffset1
disallow_all_header_options
disallow_source_route_options
This security feature also syslogs the event when the packet is dropped. See the
show packet_logging settings command for accounting data.
Disallow and drop commands work in conjunction with each other. The
disallow_source_route_options command is a subset of the
disallow_all_header_options command. If you enable the source route
command you must disable the all header command. But, enabling the more
inclusive all header value renders the source route command unnecessary
whether enabled or not. The same logic holds true for drop commands.
Each parameter of the enable ip_security option command allows global
filtering of all IP packets containing the following datagram fields. These datagram
fields, when found, cause the packet to be dropped.
fragment offset=1
partial TCP headers
all header options
source route options
fragment offset=1
Packets with an offset equal to one are discarded in accordance with RFC
1858. Some routers that may be used on the same network with the
OfficeConnect Gateway may be configured to filter out specific traffic. In
some cases these routers will not apply the filter correctly for IP packets with
an offset of 1. To avoid this limitation in the filtering mechanism, packets of
this type can be discarded. Of the two drop commands, this is the highest
level of security. The default is enabled
partial TCP headers (offset=1)
Protocol field in the IP packet header (in this case, TCP). Packets of this type
can be discarded. Lower level of security than All fragmented packets
(Drop_all_fragoffset1). The default is enabled
all header options
All choices in the IP Options field of the IP header. IP options may be
generated as an attack to get past routing tables. To avoid this limitation in
security, packets of this type can be discarded. Of the two disallow
commands, this is the highest level of security. The default is disabled
.
.
.
Advertisement
Table of Contents
