Hi everybody
Last week we encountered a serious problem with our Nexus 7000-environment. Some 3rd-party Service-Provider had their IP-Packets fragmented although the Don't Fragment Bit was set. When our N7K began to silently drop these packets silently, troubleshooting was very hard, until we found out about the "Hardware IP Verify Fragment"-Feature.

To prevent further problems of this kind, we decided disable not only the Fragment-Verification, but all the others hardware ip-tests as well: In our network we have the policy, that we do not manipulate nor even drop traffic if there is no need to do so. Before we do so, we just wanted to ask three things:
- Is there any configuration on the Nexus (NX-OS 4.2(2a)) for not dropping any packets silently? The fragment-verification-thing would not have been as bad as it was, if the N7K had warned us about violated IP-Standards or anything like this. Without any notification we had to find out about the fragmentation, find out about the hardware ip verify-feature AND switch to the default-vdc as the hardware-verify-settings- and -counters can only be seen from this vdc.
- Are there any other filters on the Nexus enabled per Default which alter the traffic-forwarding compared to the behavior of the cat6500-Platform? (e.g. some "software ip verify"?)
- If we disable all the Verifications below, do we shoot ourselves into the foot? Are any of those tests vital for a stable network, or are they all just some "nice to filter out to save on our ressources and provide a little bit more security"-filters?

Thanks a lot in advance & greetings from Berne
Mullzk

n91003# sh hardware forwarding ip verify

IPv4 and v6 IDS Checks         Status     Packets Failed
-----------------------------+---------+------------------
address source broadcast       Enabled    0             
address source multicast       Enabled    0             
address destination zero       Enabled    234665        
address identical              Enabled    419           
address reserved               Enabled    116           
address class-e                Disabled   --
checksum                       Enabled    0             
protocol                       Enabled    0             
fragment                       Disabled   --
length minimum                 Enabled    0             
length consistent              Enabled    0             
length maximum max-frag        Enabled    0             
length maximum udp             Disabled   --
length maximum max-tcp         Enabled    0             
tcp flags                      Disabled   --
tcp tiny-frag                  Enabled    0             
version                        Enabled    0             
-----------------------------+---------+------------------
IPv6 IDS Checks                Status     Packets Failed
-----------------------------+---------+------------------
length consistent              Enabled    0             
length maximum max-frag        Enabled    0             
length maximum udp             Disabled   --
length maximum max-tcp         Enabled    0             
tcp tiny-frag                  Enabled    0             
version                        Enabled    0             
n91003#