05-19-2010 01:34 AM - edited 03-11-2019 10:47 AM
hello
i am getting this log message from ASA5520 :
Deny IP spoof from (Cicso_Works) to 10.162.50.70 on interface inside
Notes:
-cisco_works is in inside interface
-10.162.50.70 is the IP of one interface (one DMZ) in ASA
i can't understand why am i getting this message!
05-19-2010 01:40 AM
Since 10.162.50.70 is supposed to be connected to DMZ interface as advised, and you are actually getting the traffic on inside interface of the ASA, that is why you are getting the spoof error message. Traffic sourced from 10.162.50.70 should only go inbound towards the ASA DMZ interface, not any other interfaces.
Hope that answers your question.
05-19-2010 09:31 PM
you said:
1-Since 10.162.50.70 is supposed to be connected to DMZ interface
->actually this IP is the IP of the DMZ interface itself and not of one PC connected to DMZ
2-Traffic sourced from 10.162.50.70 should only go inbound towards the ASA DMZ interface,
-> according to the syslog msg, the traffic is sourced from cisco_works and not 10.162.50.70!
i can't understand your explanaition :-(
05-20-2010 12:51 AM
It seems that there might be some routing loop that is causing packet that is sourced from the ASA DMZ interface to arrive on the inside interface instead.
Most times it is caused by routing loop in your network.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide