Solved: IP Spoofing Issue in Cisco ACI Leaf Switches

LakshmiPrabu · ‎04-19-2017

Issue description

We have a Bridge Domain for a /21 subnet which hosts a lot of VMs, Monitoring hosts, Jump Servers and so on.

The servers in the subnet were reported with inconsistency while pinging and all the other servers monitored by the monitoring hosts in this subnet seems be failing.

ACI support team figured out this to be an IP spoofing issue. One of the VM Mac was found to be reporting with multiple IP address (even from other Bridge Domains)

The fix provided was clearing the MAC cache with the command : vsh -c 'clear system internal epm endpoint key vrf NAME ip 10.X.X.X and by enabling Enforce Subnet Check for IP learning

My questions for this discussion are

1. How would that IP spoofing be identified in the APIC

2. On a command perspective how was the IP address corresponding to the MAC be found

3. In the command vsh -c 'clear system internal epm endpoint key vrf NAME ip 10.X.X.X - 10.x.x.x would be all the 100+ IPs found on this MAC be cleared or is it the EPG that is being referred.

Joseph Young · ‎04-20-2017

I don't think this would actually be considered spoofing. Usually spoofing would refer to a device that is actually configured with another device's address. In your scenario (correct me if I'm wrong) it sounds like we just learned an IP address in an EPG and BD that it shouldn't appear in. A BD with unicast routing enabled and 'enforce subnet check' NOT enabled will learn every single source IP address for each packet that it receives. So, let's say you have a load-balancer or firewall that receives traffic and sends it back to the fabric to the final destination in the same bridge domain...you would now overwrite the original mac address for the endpoint with the load-balancer/firewall mac. This is a pretty common problem and can be avoided most commonly by doing things like...

1. enforce subnet check

2. disable unicast routing for bridge domains that don't actually need to route traffic

View solution in original post

Joseph Young · ‎04-20-2017

I don't think this would actually be considered spoofing. Usually spoofing would refer to a device that is actually configured with another device's address. In your scenario (correct me if I'm wrong) it sounds like we just learned an IP address in an EPG and BD that it shouldn't appear in. A BD with unicast routing enabled and 'enforce subnet check' NOT enabled will learn every single source IP address for each packet that it receives. So, let's say you have a load-balancer or firewall that receives traffic and sends it back to the fabric to the final destination in the same bridge domain...you would now overwrite the original mac address for the endpoint with the load-balancer/firewall mac. This is a pretty common problem and can be avoided most commonly by doing things like...

1. enforce subnet check

2. disable unicast routing for bridge domains that don't actually need to route traffic