Filter
Top Products
17-69
User Guide for Cisco Security Manager 4.4
OL-28826-01
Chapter 17 Managing Firewall Inspection Rules
Configuring Protocols and Maps for Inspection
If you do not configure IP options inspection, the ASA device drops packets that have any options
configured, with one exception. In routed mode, packets that contain the router alert option are allowed.
(To disallow router alert packets, create an IP options map with router alert deselected, and configure an
inspection rule to inspect IP Options using the policy map.)
Tip Because the no operation (NOP) option might be used as padding to ensure proper packet-header size
and alignment, you might want to allow NOP.
For each option, you can select whether to:
• Allow—Allow the packet and do not change the IP header options field.
• Clear—Allow the packet and clear the option from the IP header options field.
If you do not select an option, the option is prohibited, and packets containing the option are dropped.
Any option not listed here also results in a dropped packet; you cannot change this behavior.
Navigation Path
Select Manage > Policy Objects, then select Maps > Policy Maps > Inspect > IP Options from the
Object Type selector. Right-click inside the work area, then select New Object, or right-click a row and
select Edit Object.
Related Topics
• Understanding Map Objects, page 6-72
• Configuring Protocols and Maps for Inspection, page 17-21
Field Reference
Table 17-40 Add and Edit IP Options Map Dialog Boxes
Element Description
Name The name of the policy object. A maximum of 128 characters is
allowed.
Description A description of the policy object.
End of Options List End of Options List (EOOL), or IP Option 0, contains just a single zero
byte and appears at the end of all options to mark the end of a list of
options. This might not coincide with the end of the header according
to the header length.
No operation No Operation (NOP), or IP Option 1, is used for padding. The Options
field in the IP header can contain zero, one, or more options, which
makes the total length of the field variable. However, the IP header must
be a multiple of 32 bits. If the number of bits of all options is not a
multiple of 32 bits, the NOP option is used as to align the options on a
32-bit boundary.
Router alert Router Alert (RTRALT), or IP Option 20, notifies transit routers to
inspect the contents of the packet even when the packet is not destined
for that router. This inspection is valuable when implementing RSVP
and similar protocols require relatively complex processing from the
routers along the packet’s delivery path.