Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
New Member

What does IP Options: "Router Alert" specify?

We have a client using a Tanberg video device to connect to a Polycom through our ASA.

We are seeing error messages as follows:

(IPs have been changed)

%ASA-6-106012: Deny IP from 192.168.18.20 to 172.22.54.29, IP options: "Router Alert"

Anybody have any experience with this particular error?

Is it a false alarm? Should I (or can I)

allow this traffic from a trusted host inside our network?

Thanks for any info-

Lynne

3 REPLIES
Cisco Employee

Re: What does IP Options: "Router Alert" specify?

Lynne,

106012

Error Message %PIX|ASA-6-106012: Deny IP from IP_address to IP_address, IP options hex.

Explanation This is a packet integrity check message. An IP packet was seen with IP options. Because IP options are considered a security risk, the packet was discarded.

Recommended Action Contact the remote host system administrator to determine the problem. Check the local site for loose source routing or strict source routing.

http://www.cisco.com/en/US/docs/security/asa/asa70/system/message/logmsgs.html#wp1279793

Regards,

Arul

*Pls rate if it helps*

New Member

Re: What does IP Options: "Router Alert" specify?

Is it possible to disable the packet integrity check on

an ASA 5510 - or at least prevent the check from specific sources

- and if so, how?

I am getting these errors from our campus to campus video conferencing using Polycoms and I simply want this security check out of the picture for these connections.

Thanks, Forrest

Cisco Employee

Re: What does IP Options: "Router Alert" specify?

Forrest,

     We started seeing this problem more and more, so we changed the ASA code accordingly. Starting in version 8.2(2) the ASA gained the ability to have the configuration specify how it should treat ip options like router alert.

See the release notes for 8.2(2) here:

http://www.cisco.com/en/US/docs/security/asa/asa82/release/notes/asarn82.html#wp424893

And the configuration guide section on ip options shows how to configure the ASA:

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/inspect_basic.html#wp1548725

An upgrade to version 8.2(4) would do the trick.

If you plan upgrade to version 8.3, please read and understand this document first:

https://supportforums.cisco.com/docs/DOC-12690

After the upgrade, the policy-map configuration would look like below (the new config is the 'inspect ip-options' command:

ASA# sh run policy-map

...

!

policy-map global_policy

class inspection_default

...

  inspect ip-options

...

!

Sincerely,

     Jay

10107
Views
0
Helpful
3
Replies
CreatePlease to create content