topic Re: Can IP Source Guard Stop Spoofing in Network Access Control

Can IP Source Guard Stop Spoofing

mario3 — Sat, 29 Aug 2020 01:47:32 GMT

I am using 802.1x but I am able to spoof a printer port using my laptop. It was suggested that I try using IP source guard. Has anyone used IP source guard to address spoofing?

Re: Can IP Source Guard Stop Spoofing

Marcelo Morais — Sun, 30 Aug 2020 01:37:36 GMT

Hi @mario3

please take a look at Information About IP Source Guard.

Filtering on trusted IP and MAC address bindings helps prevent attacks that rely on spoofing attacks, in
which an attacker uses the IP address of a valid host to gain unauthorized network access. To circumvent
IP Source Guard, an attacker would have to spoof both the IP address and the MAC address of a valid
host.

Hope this helps.

Re: Can IP Source Guard Stop Spoofing

Mike.Cifelli — Sun, 30 Aug 2020 15:24:23 GMT

I am able to spoof a printer port using my laptop.

-Is your printer port also setup for 8021x or just mab or both?

Not sure if the provided pdf provides your source guard options, but here they are:

Source IP Address filter: ip traffic is filtered based on its source IP. Only traffic with a source IP address that matches the IP source binding entry Is permitted.
Source IP and MAC address filter: IP traffic is filtered based on its source IP address and MAC address.

Re: Can IP Source Guard Stop Spoofing

mario3 — Mon, 31 Aug 2020 13:02:57 GMT

Hello Mike,

The port is configured with both MAB and 802.1x.