Re: PIX 515E & LAND ATTACK

choosak_b · ‎03-10-2005

Hi Gurus,

How can I solve LAND ATTACK?

Can I bypass this attack in PIX 515E?

Regards,

Choosak B.

2005-03-10 14:08:26 Local4.Info 203.101.1.9 Mar 10 2005 14:02:20: %PIX-6-106100: access-list acl_allowall permitted tcp outside/202.44.1.1(42954) -> inside/203.101.10.67(3308) hit-cnt 1 (first hit)

2005-03-10 14:08:26 Local4.Info 203.101.1.9 Mar 10 2005 14:02:20: %PIX-6-302013: Built inbound TCP connection 1256417 for outside:202.44.1.1/42954 (202.44.1.1/42954) to inside:192.168.10.67/3308 (203.101.10.67/3308)

2005-03-10 14:08:36 Local4.Info 203.101.1.9 Mar 10 2005 14:02:30: %PIX-6-302013: Built outbound TCP connection 1256426 for outside:203.101.10.67/3308 (203.101.10.67/3308) to inside:192.168.10.67/60687 (203.101.10.67/60687)

2005-03-10 14:08:36 Local4.Critical 203.101.1.9 Mar 10 2005 14:02:30: %PIX-2-106017: Deny IP due to Land Attack from 203.101.10.67 to 203.101.10.67

2005-03-10 14:08:40 Local4.Critical 203.101.1.9 Mar 10 2005 14:02:34: %PIX-2-106017: Deny IP due to Land Attack from 203.101.10.67 to 203.101.10.67

2005-03-10 14:08:46 Local4.Info 203.101.1.9 Mar 10 2005 14:02:40: %PIX-6-302014: Teardown TCP connection 1256426 for outside:203.101.10.67/3308 to inside:192.168.10.67/60687 duration 0:00:10 bytes 0 TCP Reset-I

2005-03-10 14:08:46 Local4.Critical 203.101.1.9 Mar 10 2005 14:02:40: %PIX-2-106017: Deny IP due to Land Attack from 203.101.10.67 to 203.101.10.67

2005-03-10 14:08:51 Local4.Info 203.101.1.9 Mar 10 2005 14:02:45: %PIX-6-106015: Deny TCP (no connection) from 202.44.1.1/42954 to 203.101.10.67/3308 flags ACK on interface outside

jmia · ‎03-10-2005

Choosak,

Firstly explanation on error log : 2-106017 (You probably have looked this up) :

Error Message:

%PIX-2-106017: Deny IP due to Land Attack from IP_addr to IP_addr

Explanation:

This message appears when PIX Firewall receives a packet with the IP source address equal to the IP destination, and the destination port equal to the source port. This indicates a spoofed packet designed to attack systems. This attack is referred to as a Land Attack.

Recommended Action:

If this message persists, an attack may be in progress. The packet does not provide enough information to determine where the attack originates.

Now, you can try to mitigate this attack by adding the following on your pix config - in config mode add:

ip verify reverse-path interface outside

You should have a default route command on your outside interface i.e. route outside 0.0.0.0 0.0.0.0 <--- your outside internet facing router.

You'll find this out by checking your configuration or type sho route on your pix.

I hope this helps out and let me know if you need further help.

Jay

jaime.pedraza · ‎03-16-2005

When you do NAT, it can cause this kind of errors, i.e.: if you send a ping from a host pointing to the NAT address of the same host in the firewall, the PIX will translate the address and will find the source and destination addresses and ports, the same. This problem isn't easy at all to identify.

Verify if this is not your case.

Jaime