topic Strange Entries in ARP Table in Network Security

Strange Entries in ARP Table

sabinj — Mon, 11 Mar 2019 22:27:18 GMT

I need some advice on this topic. I am seeing strange entries in my ARP table on my ASA 5510. We do not use any static ARP on the firewall at all. There are several dynamic arp entries being created that are not local to my network, yet they show up on the Management(Inside) interface. I am pretty new to this so I may just not fully understand how/why a dynamic ARP entry is create on the inside interface of my firewall. I see all of my local IP's in this table, but am concerned with the ones that are not local.

Strange Entries in ARP Table

Julio Carvajal — Thu, 09 Feb 2012 22:26:28 GMT

Hello,

Can you confirm if you do not have any static arp configured on your asa:

-Show run arp

Also you said its on your managment interface, where is this port on the ASA going to ( connected to)?

Regards,

Julio

Strange Entries in ARP Table

Marvin Rhoads — Thu, 09 Feb 2012 23:48:54 GMT

Besides defined static ARPs, the ASA will also add arp entries for xlates (NATs).

Strange Entries in ARP Table

sabinj — Fri, 10 Feb 2012 01:22:14 GMT

Yes I can confirm that there are no static arps configured.

sho run arp: no results returned

We don't NAT to any of the addresses that are showing up in the ARP table, they are addresses that are completely foreignto the networks that we access on our known networks.

Strange Entries in ARP Table

sabinj — Fri, 10 Feb 2012 01:30:22 GMT

Whats more troubling is the fact they are showing up on my inside interface.

Strange Entries in ARP Table

Julio Carvajal — Fri, 10 Feb 2012 01:37:01 GMT

Hello,

So they are showing up on the inside and also managment interface? Right?

Re: Strange Entries in ARP Table

sabinj — Fri, 10 Feb 2012 01:50:19 GMT

Hello, In our setup the management interface is also the inside interface. We do not dedicate an interface to management only.

Re: Strange Entries in ARP Table

Julio Carvajal — Fri, 10 Feb 2012 02:03:00 GMT

Hello,

Hmmm, is the ASA the only path to get in or get out of your network?

Regards,

Julio

Re: Strange Entries in ARP Table

sabinj — Fri, 10 Feb 2012 02:10:24 GMT

Hello,

Yes that is correct.

Thanks,

Sabin

Re: Strange Entries in ARP Table

Julio Carvajal — Fri, 10 Feb 2012 17:37:03 GMT

Hello,

If I were in your place I would start inmediatly to investigate what is going on in here because looks like there are devices on the internal network that do not belong to your company, if you have their ip addresses I would definitly shun them

Regards,

Let me know what you find out!

Strange Entries in ARP Table

Richard Burts — Fri, 10 Feb 2012 17:46:33 GMT

Are you doing anything that might use Reverse Route Injection?

Can you show us the routes configured on the ASA?

HTH

Rick

Strange Entries in ARP Table

sabinj — Fri, 10 Feb 2012 21:48:09 GMT

Hello Richard,

We had reverse route injection selected on our L2L cryptomap rule. It really was not needed so I disabled it. However I still am getting some of the addresses popping up. I did a lookup on them and most are coming back as the following..

Reverse lookup for addresses below: .deploy.akamaitechnologies.com

23.1.217.83 whois = Domain Name: AKAMAITECHNOLOGIES.COM

65.197.244.80 whois = Domain Name: AKAMAITECHNOLOGIES.COM

65.197.244.82 whois = Domain Name: AKAMAITECHNOLOGIES.COM

72.246.225.83 whois = AKAMAITECHNOLOGIES.COM

Apparently this AKAMAITECHNOLOGIES.COM provide deployment services and bandwidth for companies such as Microsoft and many more.

No results

206.160.105.254 whois = Sprint.com

204.95.60.12 whois = Sprint.com

112.80.48.236 whois = Something in China...Blocked this network at firewall.

Reverse lookup for addresses below: dns-redir-lb-02.tampabay.rr.com

65.32.5.112

65.32.5.111

A little more background on our setup. We have a very small network with no more than 80 connected devices. All devices have been accounted for.

We have a L2L VPN tunnel to our client (did have Reverse route injection enable/now disabled as not needed). Here we use a dynamic policy NAT to NAT our internal hosts to an address space (Provided by ISP) usable in our clients network. The nat is configured so packets destined for client network on VPN tunnel get hit a pool of addresses and the source IP is then translated.

We are also using PAT, which is used for packets not destined for the vpn tunnel (like the web).

What is most puzzling, is if I turn off the PAT and delete the dynamic policy nat, then recreate a new dynamic nat with any any to the pool of addresses, these strange addresses do not show up in ARP table.