topic Re: Forbidden IP Option in General Topics

Forbidden IP Option

Brad_Armstrong1 — Wed, 08 Nov 2017 15:30:55 GMT

We are dropping icmp traffic, in tracker says "ip option: 131, message_info: Forbidden IP Option". How to I allow this traffic. This is R74.47 GAIA. Thanks.

Re: Forbidden IP Option

PhoneBoy — Wed, 08 Nov 2017 18:59:30 GMT

I assume you mean R75.47

Solution is described in the following SK: “Forbidden IP option” drop log in SmartView Tracker for ICMP packets with IP Options

Re: Forbidden IP Option

Brad_Armstrong1 — Wed, 08 Nov 2017 19:20:17 GMT

Yes, typo, meant R75.47 GAIA. I saw that SK article but don't quite understand, could you explain? Thanks.

Re: Forbidden IP Option

PhoneBoy — Wed, 08 Nov 2017 21:19:41 GMT

The TL;DR: We block packets with IP Options by default.

To allow ICMP packets with IP Options to pass, you need to change the kernel variable described in the SK.

This will allow the packets to pass.

Re: Forbidden IP Option

Brad_Armstrong1 — Wed, 08 Nov 2017 21:55:51 GMT

Sorry my England is not great. I follow sk but doesn't seem to be working. Can you give me the commands you would use to do this? Thanks.

Re: Forbidden IP Option

PhoneBoy — Thu, 09 Nov 2017 22:19:48 GMT

The exact commands are documented in the SK.

If you're having issues, I recommend engaging with our TAC: Contact Support | Check Point Software

Re: Forbidden IP Option

Hugo_vd_Kooij — Fri, 10 Nov 2017 09:29:18 GMT

I am not sure if TAC will take a ticket on R75.47 anymore.

It is unsupported for while now.

Re: Forbidden IP Option

PhoneBoy — Fri, 10 Nov 2017 16:08:00 GMT

"Best effort" support for sure but the process described in the SK is fairly generic.