Deny IP teardrop fragment

[Jon Are Endrerud]

Hey everyone.

Running ipsec between several locations.Getting the following on all remote Cisco ASA's.

 Deny IP teardrop fragment (size = 744, offset = 0) from 10.150.0.2 to 10.150.4.x

The 10.150.4.x is Aruba access points and the 10.150.0.2 is the Aruba controller. Everything works fine, but I am wondering about these denies. Can it be because the traffic between the access point and controller are already encrypted ?

Thanx in advance for any feedback.

UPDATE: attached wireshark log: teardrop-capture.zip

Jon

[Vibhor Amrodia]

Hi,

Here is more information on this issue:-

http://www.cisco.com/c/en/us/td/docs/security/asa/syslog-guide/syslogs/logmsgs.html#pgfId-4768988

It is sometimes necessary to break up large packets of data into smaller
fragments before they can be sent across the network.  Each of these
fragments contains information that describes their position in the
original, unfragmented packet, so that when the fragmented data arrives
at its destination it can all be re-assembled in the proper order.  In a
teardrop attack, that positional information is deliberately falsified
so that the fragments overlap.  This can make some machines crash,
thereby causing a denial of service.  

Do you have any Audit signatures enabled on the ASA device ?

show run | in ip audit

Thanks and Regards,

Vibhor Amrodia

[Jon Are Endrerud]

No audit on either sides of the ipsec.

[Vibhor Amrodia]

Hi,

In that case , i think you might need to capture the traffic for these host which are showing up in the logs and verify the issue.

Thanks and Regards,

Vibhor Amrodia

[Jon Are Endrerud]

Wireshark cap. is attached to orginal post. I see the packets, but not sure what to make of it.

[rjanssen]

This discussion is already a few years old, but I wonder if you have ever found a solution for this. We have a similar problem between Huawei access points and controller.

[kerstin-534]

enabling netflow exporter to exporter address behind ipsec tunnel also produces tons of syslogs on remote asa. What's going on ?