Cisco Systems Add/Edit IP Options Inspect Map

47-45
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter47 Configuring Inspection of Basic Internet Protocol s
IP Options Inspection
Edit—Edits an existing IP Options inspect map. To edit an IP Options inspect map, choose the entry in
the table and click Edit.
Delete—Deletes the inspect map selected in the IP Options Inspect Maps table.
Modes
The following table shows the modes in which this feature is available:
Add/Edit IP Options Inspect Map
The Add/Edit IP Options Inspect Map lets you configure the settings for IP Options inspection maps.
Fields
•Name—When adding an IP Options inspection map, enter the name of the map. When editing a map,
the name of the previously configured map is shown.
•Description—Enter the description of the IP Options inspection map, up to 200 characters in length.
•Parameters—Select which IP options you want to pass through the ASA or clear and then pass
through the ASA:
– Allow packets with the End of Options List (EOOL) option
This option, which contains just a single zero byte, appears at the end of all options to mark the end
of a list of options. This might not coincide with the end of the header according to the header length.
– Allow packets with the No Operation (NOP) option
The Options field in the IP header can contain zero, one, or more options, which makes the total
length of the field variable. However, the IP header must be a multiple of 32 bits. If the number of
bits of all options is not a multiple of 32 bits, the NOP option is used as “internal padding” to align
the options on a 32-bit boundary.
– Allow packets with the Router Alert (RTRALT) option
This option notifies transit routers to inspect the contents of the packet even when the packet is not
destined for that router. This inspection is valuable when implementing RSVP and similar protocols
require relatively complex processing from the routers along the packets delivery path.
– Clear the option value from the packets
When an option is checked, the Clear the option value from the packets check box becomes
available for that option. Select the Clear the option value from the packets check box to clear the
option from the packet before allowing the packet through the ASA.
Modes
The following table shows the modes in which this feature is available:
Firewall Mode Security Context
Routed Transparent Single
Multiple
Context System
••••—