topic Reverse Path Check in Network Security

Reverse Path Check

central_bank — Tue, 12 Mar 2019 00:09:01 GMT

Hi,

I am getting following maessage on my ASA %ASA-1-106021: Deny UDP reverse path check from 192.168.1.220 to 10.192.0.249 on interface inside.

192.168.1.220 is not there in my network and I have enabled the RPF on ASA so it is obious that it is getting blocked..

My challenge is to find out the actual souce device for 192.168.1.220 and to block these logs from reflecting. I tried following but could not succeed,

1) Applied ACL on interface interface in line 1 denying all traffic from 192.168.1.220 to 10.192.0.249 (Outside), but still RPF message continues with no hits on this ACL. I am wondering if ACL comes first or RPF

2) Connected sniffer in the vlan of Inside interface but could not get any logs for these two IPs.

Reverse Path Check

Julio Carvajal — Mon, 15 Oct 2012 17:23:19 GMT

Hello Shivaji,

1) Yes, the route-lookup goes first than the ACL.

What is on the internal network, what other device?

Any other question..Sure..Just remember to rate all of my answers.

Julio

Reverse Path Check

central_bank — Tue, 16 Oct 2012 07:34:32 GMT

But how do I find out the actual source. 192.168.x.x is not used in my network.

I tried using Sniffer but that did not show up anything with this IP address.

Shivaji

Reverse Path Check

Julio Carvajal — Tue, 16 Oct 2012 12:13:13 GMT

Hello Shivaji,

I know what you mean but if the ASA reports it. that means it is happening.

Someone is using that Ip on your internal network.....

Can you provide me the captures you applied on your ASA?

Any other question..Sure..Just remember to rate all of my answers.