topic is there any effect in in Network Security

anti spoofing

John — Tue, 12 Mar 2019 07:12:51 GMT

what is the best practice for implementing the anti spoofing in inside or outside? what would be cause if we implemented?

You may check the link from

Syed Taukir — Fri, 29 Jan 2016 02:52:05 GMT

You may check the link from the post

https://supportforums.cisco.com/discussion/10436756/asa-spoofing

http://www.cisco.com/c/en/us/support/docs/ip/access-lists/13608-21.html#anc104

--For ACL's they have to be applied from outside to inside denying RFC1918.

--IP Source guard, DAI and other features need to be applied on the inside.

--For uRPF and ACL logging (ACL log keyword), they require special CPU processing and are process switched by the CPU.

HTH

Syed

Can you give us a hint what

Philip D'Ath — Fri, 29 Jan 2016 02:55:53 GMT

Can you give us a hint what kind of device you have?

ASA 5500 Firewall

John — Fri, 29 Jan 2016 03:56:23 GMT

ASA 5500 Firewall

I usually enable it on all

Philip D'Ath — Fri, 29 Jan 2016 04:02:06 GMT

I usually enable it on all interfaces with:

ip verify reverse-path interface <interface>

what would be the impact in

John — Tue, 09 Feb 2016 03:02:08 GMT

what would be the impact in our network infrastracture if we run this command?

ip verify reverse-path interface <interface>

It will drop traffic coming

Philip D'Ath — Tue, 09 Feb 2016 03:05:18 GMT

It will drop traffic coming in from that interface that does not have an IP address coming from that subnet, or that would be routed via that subnet.

is there any effect in

John — Tue, 09 Feb 2016 03:22:07 GMT

is there any effect in resources like memory and cpu utilization?. is their any documents?

The impact is pretty much

Philip D'Ath — Tue, 09 Feb 2016 03:29:35 GMT

The impact is pretty much unmeasurable. I always use it.

Here is the manual entry for it:

http://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/I-R/cmdref2/i3.html#pgfId-1915749

Hi John,

mvsheik123 — Tue, 09 Feb 2016 03:38:08 GMT

Hi John,

Enabling this feature should not cause any cpu/memory usage hike. However, per Cisco doc, it may drop legitimate traffic.I never noticed any -ve impact thoughssues though. Check the below link...

http://www.cisco.com/c/en/us/about/security-center/unicast-reverse-path-forwarding.html

hth