Cisco ASA 5505 Configuration Manual page 824

IP Options Inspection
Fields
•
Modes
The following table shows the modes in which this feature is available:
Firewall Mode
Routed
•
IP Options Inspection
This section describes the IP Options inspection engine. This section includes the following topics:
•
•
•
•
•
IP Options Inspection Overview
Each IP packet contains an IP header with the Options field. The Options field, commonly referred to as
IP Options, provide for control functions that are required in some situations but unnecessary for most
common communications. In particular, IP Options include provisions for time stamps, security, and
special routing. Use of IP Options is optional, and the field can contain zero, one, or more options.
You can configure IP Options inspection to control which IP packets with specific IP options are allowed
through the adaptive security appliance. Configuring this inspection instructs the adaptive security
appliance to allow a packet to pass or to clear the specified IP options and then allow the packet to pass.
IP Options inspection can check for the following three IP options in a packet:
•
•
•
Cisco ASA 5500 Series Configuration Guide using ASDM
37-40
Add—Opens the Add Policy Map dialog box for the inspection.
Security Context
Transparent Single
• •
IP Options Inspection Overview, page 37-40
Configuring IP Options Inspection, page 37-41
Select IP Options Inspect Map, page 37-42
IP Options Inspect Map, page 37-43
Add/Edit IP Options Inspect Map, page 37-43
End of Options List (EOOL) or IP Option 0—This option, which contains just a single zero byte,
appears at the end of all options to mark the end of a list of options. This might not coincide with
the end of the header according to the header length.
No Operation (NOP) or IP Option 1—The Options field in the IP header can contain zero, one, or
more options, which makes the total length of the field variable. However, the IP header must be a
multiple of 32 bits. If the number of bits of all options is not a multiple of 32 bits, the NOP option
is used as "internal padding" to align the options on a 32-bit boundary.
Router Alert (RTRALT) or IP Option 20—This option notifies transit routers to inspect the contents
of the packet even when the packet is not destined for that router. This inspection is valuable when
implementing RSVP and similar protocols require relatively complex processing from the routers
along the packets delivery path.
Chapter 37 Configuring Inspection of Basic Internet Protocols
Multiple
Context System
—
•
OL-20339-01