spoof log

ohassairi · ‎05-19-2010

hello

i am getting this log message from ASA5520 :

Deny IP spoof from (Cicso_Works) to 10.162.50.70 on interface inside

Notes:

-cisco_works is in inside interface

-10.162.50.70 is the IP of one interface (one DMZ) in ASA

i can't understand why am i getting this message!

Jennifer Halim · ‎05-19-2010

Since 10.162.50.70 is supposed to be connected to DMZ interface as advised, and you are actually getting the traffic on inside interface of the ASA, that is why you are getting the spoof error message. Traffic sourced from 10.162.50.70 should only go inbound towards the ASA DMZ interface, not any other interfaces.

Hope that answers your question.

ohassairi · ‎05-19-2010

you said:

1-Since 10.162.50.70 is supposed to be connected to DMZ interface

->actually this IP is the IP of the DMZ interface itself and not of one PC connected to DMZ

2-Traffic sourced from 10.162.50.70 should only go inbound towards the ASA DMZ interface,

-> according to the syslog msg, the traffic is sourced from cisco_works and not 10.162.50.70!

i can't understand your explanaition :-(

Jennifer Halim · ‎05-20-2010

It seems that there might be some routing loop that is causing packet that is sourced from the ASA DMZ interface to arrive on the inside interface instead.

Most times it is caused by routing loop in your network.