The Wake-on-LAN discussion we had a while ago brought us nowhere; there's simply no way to generate UDP packets on the router. I thought I could use Application Performance Monitor's Tcl scripts to generate the packet, but it looks like APM has been removed from recent IOS releases (and it's not clear whether you can use APM without a peer router).

The discussion nonetheless had an interesting side effect. Robert Turnšek sent me an interesting trick: with static ARP you can generate layer-2 broadcasts with a layer-3 unicast packet.

Let's assume your LAN has IP prefix 10.2.3.0/24 and you want to use 10.2.3.77 as the IP address that will generate MAC-layer broadcasts (you need to give this address to a WOL program). Configure arp 10.2.3.77 FFFF.FFFF.FFFF and you're done.

You might wonder how this technique differs from directed subnet broadcast. The important difference is that although every IP host on the subnet will receive the layer-2 broadcast, they will ignore the packet since it's not addressed to them. This solution is thus not vulnerable to the smurf attack.