spoof log

Unanswered Question
May 19th, 2010
User Badges:
  • Silver, 250 points or more

hello


i am getting this log message from ASA5520 :

Deny IP spoof from (Cicso_Works) to 10.162.50.70 on interface inside


Notes:

-cisco_works is in inside interface

-10.162.50.70 is the IP of one interface (one DMZ) in ASA


i can't understand why am i getting this message!

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Jennifer Halim Wed, 05/19/2010 - 01:40
User Badges:
  • Cisco Employee,

Since 10.162.50.70 is supposed to be connected to DMZ interface as advised, and you are actually getting the traffic on inside interface of the ASA, that is why you are getting the spoof error message. Traffic sourced from 10.162.50.70 should only go inbound towards the ASA DMZ interface, not any other interfaces.


Hope that answers your question.

ohassairi Wed, 05/19/2010 - 21:31
User Badges:
  • Silver, 250 points or more

you said:


1-Since 10.162.50.70 is supposed to be connected to DMZ interface

->actually this IP is the IP of the DMZ interface itself and not of one PC connected to DMZ

2-Traffic sourced from 10.162.50.70 should only go inbound towards the ASA DMZ interface,

-> according to the syslog msg, the traffic is sourced from cisco_works and not 10.162.50.70!


i can't understand your explanaition :-(

Jennifer Halim Thu, 05/20/2010 - 00:51
User Badges:
  • Cisco Employee,

It seems that there might be some routing loop that is causing packet that is sourced from the ASA DMZ interface to arrive on the inside interface instead.

Most times it is caused by routing loop in your network.

Actions

This Discussion