Cisco Nexus 7000 Series - Configuring IP Directed Broadcasts

Send document comments to nexus7k-docfeedback@cisco.com.
2-14
Cisco Nexus 7000 Series NX-OS Unicast Routing Configuration Guide, Release 4.x
OL-20002-02
Chapter 2 Configuring IPv4
Configuring IPv4
Use the show hardware forwarding ip verify command to display the IP packet verification
configuration.
Configuring IP Directed Broadcasts
An IP directed broadcast is an IP packet whose destination address is a valid broadcast address for some
IP subnet, but which originates from a node that is not itself part of that destination subnet.
A device that is not directly connected to its destination subnet forwards an IP directed broadcast in the
same way it would forward unicast IP packets destined to a host on that subnet. When a directed
broadcast packet reaches a device that is directly connected to its destination subnet, that packet is
"exploded" as a broadcast on the destination subnet. The destination address in the IP header of the
packet is rewritten to the configured IP broadcast address for the subnet, and the packet is sent as a
link-layer broadcast.
If directed broadcast is enabled for an interface, incoming IP packets whose addresses identify them as
directed broadcasts intended for the subnet to which that interface is attached will be exploded as
broadcasts on that subnet.
To enable IP directed broadcasts, use the following command in interface configuration mode:
hardware ip verify length {consistent |
maximum {max-frag | max-tcp | udp} |
minimum}
Performs the following IDS checks on the IP address:
• consistent—Drops IP packets where the Ethernet
frame size is greater than or equal to the IP packet
length plus the Ethernet header.
• maximum max-frag—Drops IP packets if the
maximum fragment offset is greater than 65536.
• maximum max-tcp—Drops IP packets if the TCP
length is greater than the IP payload length.
• maximum udp—Drops IP packets if the IP payload
length is less than the UDP packet length.
• minimum—Drops IP packets if the Ethernet frame
length is less than the IP packet length plus four
octets (the CRC length).
hardware ip verify tcp tiny-frag Drops TCP packets if the IP fragment offset is 1, or if the
IP fragment offset is 0 and the IP payload length is less
than 16.
hardware ip verify version Drops IP packets if the ethertype is not set to 4 (IPv4).
Command Purpose
Command Purpose
ip directed-broadcast Enables the translation of a directed broadcast to physical
broadcasts