43-25
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter43 Configuring Inspection of Basic Internet Protocol s
IP Options Inspection
IP Options Inspection Overview
Each IP packet contains an IP header with the Options field. The Options field, commonly referred to as
IP Options, provide for control functions that are required in some situations but unnecessary for most
common communications. In particular, IP Options include provisions for time stamps, security, and
special routing. Use of IP Options is optional, and the field can contain zero, one, or more options.
You can configure IP Options inspection to control which IP packets with specific IP options are allowed
through the ASA. Configuring this inspection instructs the ASA to allow a packet to pass or to clear the
specified IP options and then allow the packet to pass.
IP Options inspection can check for the following three IP options in a packet:
•End of Options List (EOOL) or IP Option 0—This option, which contains just a single zero byte,
appears at the end of all options to mark the end of a list of options. This might not coincide with
the end of the header according to the header length.
•No Operation (NOP) or IP Option 1—The Options field in the IP header can contain zero, one, or
more options, which makes the total length of the field variable. However, the IP header must be a
multiple of 32 bits. If the number of bits of all options is not a multiple of 32 bits, the NOP option
is used as “internal padding” to align the options on a 32-bit boundary.
•Router Alert (RTRALT) or IP Option 20—This option notifies transit routers to inspect the contents
of the packet even when the packet is not destined for that router. This inspection is valuable when
implementing RSVP and similar protocols require relatively complex processing from the routers
along the packets delivery path.
Note IP Options inspection is included by default in the global inspection policy. Therefore, the ASA allows
RSVP traffic that contains packets with the Router Alert option (option 20) when the ASA is in routed
mode.
Dropping RSVP packets containing the Router Alert option can cause problems in VoIP
implementations.
When you configure the ASA to clear the Router Alert option from IP headers, the IP header changes in
the following ways:
•The Options field is padded so that the field ends on a 32 bit boundary.
•Internet header length (IHL) changes.
•The total length of the packet changes.
•The checksum is recomputed.
If an IP header contains additional options other than EOOL, NOP, or RTRALT, regardless of whether
the ASA is configured to allow these options, the ASA will drop the packet.
Configuring an IP Options Inspection Policy Map for Additional Inspection Control
Step1 To create an IP Options inspection policy map, enter the following command:
hostname(config)# policy-map type inspect ip-options policy_map_name
hostname(config-pmap)#