On (2014-04-18 16:40 +0000), Robert Williams wrote: > I’ve got a 6500/720 which needs to have IP Options enabled; I need to secure > it as best as possible as it will be globally reachable on some of its > interfaces. It has a very comprehensive CoPP on it which protects it just > fine at the moment, but IP Options opens up a new attack vector.
I believe you need to use 'mls rate-limit unicast ip options', of course it will break your IP options dependent service earlier, but at least your whole network won't be dead. -- ++ytti _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
