topic FPR-1010 - IPspoof in Network Security

FPR-1010 - IPspoof

Jon Are Endrerud — Thu, 05 Mar 2020 13:01:36 GMT

Im in the process of replacing 5505 and 5506 with FPR-1010. (code: 6.5.0.4).

When running IPsec between two subnets for example:

FPR-2130 subnet 10.0.0.0/23 <-------> 10.199.24.0/24 (FPR-1010 has IP .1 (BV1) and .2 (MNGT).

I cannot access the unit itself (.1.2), all other IPs in the subnet is reachable. The error is:

Deny IP spoof from (10.0.0.x) to 10.199.24.1 on the interface outside

Can anyone help me get around this ?

Re: FPR-1010 - IPspoof

Marvin Rhoads — Thu, 05 Mar 2020 14:21:40 GMT

Is the 1010 in transparent mode?

Re: FPR-1010 - IPspoof

Jon Are Endrerud — Fri, 06 Mar 2020 13:37:49 GMT

No routed mode.

Re: FPR-1010 - IPspoof

Marvin Rhoads — Sat, 07 Mar 2020 10:55:41 GMT

Ah - so you are trying to reach the Firepower inside and management addresses from the remote end of the site-site VPN? That's generally not possible since the traffic needs to come from one of the inside networks. Otherwise the Firepower would be sending it's own replies through itself - which is roughly what the log message is telling you.

Re: FPR-1010 - IPspoof

Jon Are Endrerud — Tue, 10 Mar 2020 12:07:20 GMT

Used the MNGT gateway with defined gateway unique gw instead of data interface gateway. This gives access to SSH and HTTPS.