Spoofed IP address

Strict IP Address Check

Discard packets with malformed source or destination IP addresses. For example, discard packets where the source or destination IP address is the same as the network interface address, is a broadcast address, a loopback address, a link-local address, an unspecified address, or is reserved for future use.

For a firewall in Common Criteria (CC) mode, you can enable logging for discarded packets. On the firewall web interface, select

Device

Log Settings

. In the Manage Logs section, select

Selective Audit

and enable

Packet Drop Logging

.

Fragmented traffic

Discard fragmented IP packets.

IP Option Drop

Select the settings in this group to enable the firewall to drop packets containing these IP Options.

Strict Source Routing

Discard packets with the Strict Source Routing IP option set. Strict Source Routing is an option whereby a source of a datagram provides routing information through which a gateway or host must send the datagram.

Loose Source Routing

Discard packets with the Loose Source Routing IP option set. Loose Source Routing is an option whereby a source of a datagram provides routing information and a gateway or host is allowed to choose any route of a number of intermediate gateways to get the datagram to the next address in the route.

Timestamp

Discard packets with the Timestamp IP option set.

Record Route

Discard packets with the Record Route IP option set. When a datagram has this option, each router that routes the datagram adds its own IP address to the header, thus providing the path to the recipient.

Security

Discard packets if the security option is defined.

Stream ID

Discard packets if the Stream ID option is defined.

Unknown

Discard packets if the class and number are unknown.