Land Attack False Positive for Internal Hosts

[remitprosupport]

Hello all...

I have two hosts on "inside" networks. One is a jabber server, and the other a client trying to connect to that server.

The jabber server's IP address is 192.168.100.19, and the client has a DHCP assigned address of 192.168.150.19. Other clients on the 150.X have no trouble getting to the jabber server.

When I try to connect to the server, I see an xlate opened in the live log, but I also get the following message: "Deny IP due to Land Attack from <server name> to <server name>".

Obviously the firewall's confused about the source IP address and port of the requests. If I manually assign a different IP address to the client it can connect. I guess I could clear the xlate table to remedy this issue, but has this happened to anyone else, and can anyone suggest what might cause this?

A bug in version 8.2(3) perhaps?

Thanks!

Dan

[Panos Kampanakis · Accepted solution]

We should jump into conclusions about bugs yet.

Is the firewall translating the client to the servers ip address 192.168.100.19?

Is the response from the server flagged as LAND attack?

You need to first identify which packet is flagged as land attack and if it is normal. For example if the client was translated to the servers ip address then the response might indeed be flagged as LAND attack, because the LAN checks are before the NAT.

I hope it helps.

PK

[remitprosupport]

That was it! I had a nat rule with a typo that was translating the client address to the server address.

Thanks for the assist...

Dan

[Panos Kampanakis]

Glad we got it.

Take care,

PK