Deny TCP reverse path check from 121.241.249.101 to 28.29.30.31 on interface inside

[shivaram840]

Hi all,

 we are facing the Ip spoofing issue and at time i was unable login to the firewall when spoofing was happend adn 121.241.249.101 and 28.29.30.31 are not my ips and anti spoofing has been enable in my firewall both inside and outside but we faced this problem,please help me out regarding this and please find the screenshot for better understanding 

With regards,

Shiv

[Divya Subramanian · Accepted solution]

Hi Shiv,

"Ip verify reverse path" checks two things:

1. is a route present for that specific source?

2. is the packet  comming on the right interface?

I would suggest to check the routing to exclude possible assymetic routing issues. If everything looks alright then it might be a real spoofing attack.

You can probably collect a capture on the inside interface to track the mac address of the spoofed ip from where the attacks are bring generated.

you have uRPF enabled on the firewall which is preventing against the spoofing attack.