how to detect or block hidden source ip(of DDoS) in Firepower.

[rockbd]

Dear All

I am not good in networking terms so please forgive if i am wrong.

I am a application owner. Last couple of days my application got DDoS attack (as per my network team). But the problem is they can't block it in the cisco firewall (firepower OS) because when they try to find the source IP they are getting 

10.x.x.x, 172.16.x.x, 172.31.x.x, 192.168.x.x which is private IP.

So my query is how to get the source where the original request is generate or how can i block this type of attack.

Thanks in advance.

[rais]

Edited: ISPs drop RFC1918 destined traffic ( not sourced )

If incoming traffic is sourced from RFC1918 space, that should be easier to be blocked incoming from the internet. 

HTH.

[rockbd]

Thanks for the reply.

How to block RFC1918 traffic can you please tell me.

also can you tell what are the other way to block those kind a IP.

[rais]

A simple solution is an ACL, but it may not be sufficient to block the attack effectively.  Talking to your ISP is the key to solving this issue.

HTH.

[MHM Cisco World]

ASA do NAT to these Private Address? change the NAT table and see the original Public IP before NAT.