Fragmentation Question

[gshipley () neohapsis com (Greg Shipley)]

Okay, assuming that Dragon and NFR are the only two Network-based
Intrusion Detection systems that do packet re-assembly, I've been trying
to think through a solution for people wanting to use other ID products
(RealSecure, NetRanger, etc.) and still allow them to be useful.  I see a
few options:

1. Deny all fragments into the network.  I see this is a bad idea, but I
do wonder, how many "natural" fragmented packets appear natively on the
Internet.  I would imagine a fair amount, but I don't have the slightest
idea how to hunt down statistics on this.

2. Have some perimeter device re-assemble fragmented packets BEFORE they
get to the IDS.  Two options: the router, or the firewall, yeah?  Now, in
a multi-homed, multi-router environment, IMHO, forcing re-assembly is NOT
an option (fragmented packets could come in from two or more directions).  
This leaves the firewall, and I'm not even going to open the can of worms
surrounding firewall load balancing.

So let's assume a single firewall.  Who does this?  I did some digging
with Checkpoint, and they do (ready for this?) "virtual packet
re-assembly."  That is, according to their documentation, they will
re-assemble the packet for purposes of inspection, but then transmit the
fragments back out of the interface.  So fragments in -> fragments out.  
I opened a trouble ticket with them, and the answer I got back was "No, we
don't do packet re-assembly - can't be done."  Does anyone else have any
info on this?

I did some digging through Cisco's PIX documentation (v4.x), and found a
bunch of things talking about packet fragmentation.  I found a way to deny
all fragmented packets, but I did NOT find a way to force re-assembly.
Does anyone know if the PIX can?  If so, how?  I tried to open a TAC case
but they wouldn't let me without a PIX serial number.  I tried to explain
that it was a, uh, pre-sales question but that didn't seem to work.

Ugh.

So what are our options?  Is there anything I'm missing here?

-Greg