Wake on LAN - IP directed-broadcast

[gmayan]

I'm wondering what's the best way to mitigate having the "ip directed-broadcast" enable on the LAN interface in a multi-site private network.

We need to enable this to implement Wake On LAN, but want to minimize security threats as much as possible.

Regards.

[s.jankowski]

The ip directed-broadcast interface command controls the explosion of directed broadcasts when they reach their target subnets. The command affects only the final transmission of the directed broadcast on its ultimate destination subnet. It does not affect the transit unicast routing of IP directed broadcasts.

If directed broadcast is enabled for an interface, incoming IP packets whose addresses identify them as directed broadcasts intended for the subnet to which that interface is attached will be exploded as broadcasts on that subnet. If an access list has been configured with the ip directed-broadcast command, only directed broadcasts that are permitted by the access list in question will be forwarded; all other directed broadcasts destined for the interface subnet will be dropped.

[gmayan]

Thanks for your response. Configuring an ACL is one option to minimize this threat, is that sufficient?.

The ACL can restrict by IP, protocol and port utilized by the magic packet.

Any other idea?. Thanks.