Forum Discussion

cjbarr1234's avatar
cjbarr1234
Icon for Altostratus rankAltostratus
Apr 27, 2017

IP-Source Routing Enabled - Vulnerability

Hey guys... Are we vulnerable at all to this?   https://www.rapid7.com/db/vulnerabilities/generic-ip-source-routing-enabled   IP Source Routing Enabled Source routing is a feature of the IP pr...
AFM
application delivery
LTM
security
Chris_Grant's avatar
Chris_Grant
Icon for Employee rankEmployee
Apr 29, 2017

https://support.f5.com/csp/article/K10191

 

The BigIP will drop any packet that arrives with IP Options unless you have explicitly enabled them:

 

The IP drop counter increments when a packet contains an IP option. If the TM.AcceptIPOptions BigDB key is set to enable, the system accept IPv4 packets with IP options.

 

So unless you explicitly tell the BigIP otherwise it will not accept packets that use Source Routing. Fastl4 does not change this.