Solved: TCP Out-of-Order Packet support

ROBERTO TACCON · ‎06-02-2009

Hi to all,

the Cisco IOS ZONE BASED Firewall support the feature "TCP Out-of-Order Packet support" ?

https://www.cisco.com/en/US/docs/ios/sec_data_plane/configuration/guide/sec_out_order_fwall.html#wp1049430

Regards

Roberto Taccon

zenon_electronics · ‎11-02-2009

Hi Roberto,

In the new IOS 15.0(M) ZBF already supports out-of-order TCP packets

look here:

http://www.cisco.com/en/US/customer/docs/ios/sec_data_plane/configuration/guide/sec_zone_polcy_firew.html

Regards,

Tihomir Yosifov

View solution in original post

plumbis · ‎06-02-2009

This should be supported as documented with the "ip inspect tcp reassembly" command but be aware this could cause performance issues with a large number of fragmented packets.

ROBERTO TACCON · ‎06-03-2009

Hi Pete,

thanks for the reply BUT:

1) CAN YOU CONFIRM THAT ON THE LATEST IOS VERSION THE FEATURE IS AVAILABLE / WHICH ONE / ARE THERE ANY DOCS ?

2) as indicated on the docs (for the IOS 12.4T) the Zone-based policy firewall does NOT support IT:

Restrictions for TCP Out-of-Order Packet Support for Cisco IOS Firewall and Cisco IOS IPS:

â€¢The feature is enabled by default. The user must explicitly disable it. To disable TCP out-of-order packet buffering and reassembly, issue the ip inspect tcp reassembly queue length 0 command.

â€¢Zone-based policy firewall is not supported. Only Cisco IOS IPS and Cisco IOS Firewall application inspection can support out-of-order TCP packets.

https://www.cisco.com/en/US/docs/ios/sec_data_plane/configuration/guide/sec_out_order_fwall.html#wp1049430

Regards,

Roberto Taccon

zenon_electronics · ‎11-02-2009

Hi Roberto,

In the new IOS 15.0(M) ZBF already supports out-of-order TCP packets

look here:

http://www.cisco.com/en/US/customer/docs/ios/sec_data_plane/configuration/guide/sec_zone_polcy_firew.html

Regards,

Tihomir Yosifov