topic IP spoof question cisco ASA in Network Security

IP spoof question cisco ASA

giuseppe parlato — Tue, 12 Mar 2019 02:32:21 GMT

I got the following,

Deny IP spoof from (0.1.0.4) to 10.1.1.101 on interface intranet

Traffic has correctly been denied but ip verify reverse-path is not configured on intranet interface to prevent ip spoofing. So, how did the ASA denied ip spoofing ? does it means unicast RPF is not necessary ?

Thank you

IP spoof question cisco ASA

Julio Carvajal — Thu, 29 Aug 2013 22:40:04 GMT

Hello,

This is not related to the RPF Check per se;

%PIX|ASA-2-106016: Deny IP spoof from (IP_address) to IP_address on 
interface interface_name.

This message is generated when a packet arrives at the security appliance interface that has a destination IP address of 0.0.0.0 and a destination MAC address of the security appliance interface. In addition, this message is generated when the security appliance discarded a packet with an invalid source address, which can include one of the following or some other invalid address:
- Loopback network (127.0.0.0)
- Broadcast (limited, net-directed, subnet-directed, and all-subnets-directed)
- The destination host (land.c)
In order to further enhance spoof packet detection, use the icmp command to configure the security appliance to discard packets with source addresses belonging to the internal network. This is because the access-list command has been deprecated and is no longer guaranteed to work correctly.Recommended Action: Determine if an external user is trying to compromise the protected network. Check for misconfigured clients.

For more information about Core and Security Networking follow my website at http://laguiadelnetworking.

Any question contact me at jcarvaja@laguiadelnetworking.com

Cheers,

Julio Carvajal Segur

IP spoof question cisco ASA

giuseppe parlato — Fri, 30 Aug 2013 07:07:56 GMT

Correctly I would have had a different message for ip spoofing with RPF. Is RPF still adviced to be configured ?

IP spoof question cisco ASA

giuseppe parlato — Fri, 30 Aug 2013 07:18:58 GMT

Let me add..

1. couldn't find explenation for,

In order to further enhance spoof packet detection, use the icmp command to configure the security appliance to discard packets with source addresses belonging to the internal network. This is because the access-list command has been deprecated and is no longer guaranteed to work correctly.

2. 106016 log message is related to a check which is not configurable right ?

Thank you

IP spoof question cisco ASA

Julio Carvajal — Sun, 01 Sep 2013 07:38:46 GMT

You got it .

It's always good to add more security to your Firewalls so RPF is a good deal.

For more information about Core and Security Networking follow my website at http://laguiadelnetworking.

Any question contact me at jcarvaja@laguiadelnetworking.com

Cheers,

Julio Carvajal Segura

IP spoof question cisco ASA

Julio Carvajal — Sun, 01 Sep 2013 07:41:18 GMT

Hello,

1) That means that you can configure the ASA to deny ICMP packets (using the ICMP syntax) comming on the outside interface from source IP addresses from the internal side (as this is certanly never expected).

2)Exactly,

Hey my man! Remember to rate all of my answers. We are helping for free and some kudos are really appreciated

For more information about Core and Security Networking follow my website at http://laguiadelnetworking.

Any question contact me at jcarvaja@laguiadelnetworking.com

Cheers,

Julio Carvajal Segura

IP spoof question cisco ASA

giuseppe parlato — Mon, 02 Sep 2013 15:03:18 GMT

Thanks a lot