Deny IP due to Land Attack from IP address to IP address

mburguk1000 — Tue, 12 Mar 2019 06:53:43 GMT

We have been getting these errors from our firewall which is a ASA 5515 running version 9.1.2 software and the appliance which address is refeerenced is a Ironport. When the call was rasied with Cisco Tac they have sent a article that is relevant to a ASA

Please see below

https://supportforums.cisco.com/document/54791/asapixfwsm-deny-ip-due-land-attack-messages

<162>%ASA--106017: Deny IP due to Land Attack from IP address to IP address

Any one else experienced these issues

ASA would classify traffic as

Rishabh Seth — Mon, 16 Nov 2015 11:18:04 GMT

ASA would classify traffic as LAND attack traffic if it sees source IP and destination IP same in the IP header.

Do you see the error for legitimate traffic or is it actual LAND attack traffic?

Also check if you have some misconfigured nat statement that might translate the traffic and result in same source IP and destination IP.

Thanks,

topic Deny IP due to Land Attack from IP address to IP address in Network Security

Deny IP due to Land Attack from IP address to IP address

ASA would classify traffic as