Annoying spoof log messages because facing a Checkppoint
One of our customers have an ASA facing a Checkpoint HA cluster. Looks like the Checkpoint cluster is using ip messages sourced from 0.0.0.0 to the network address on udp port 8116 to keep track of eachothers interfaces. This traffic is interpreted by the ASA like a spoof attack.
Since this traffic is sent with a packet rate of about one every 0.1 sec the logs in the ASA are filled upp with spoof alarms (message
I do not want to filter out all spoof alarms but I would like to get rid of alarms triggered by this traffic. Is there any way to tweak the spoof detection to not trigger by this specific traffic or to filter away syslog messages based on the message text?
This message is generated when a packet arrives at the security appliance interface that has a destination IP address of 0.0.0.0 and a destination MAC address of the security appliance interface. In addition, this message is generated when the security appliance discarded a packet with an invalid source address, which may include one of the following or some other invalid address:
•Loopback network (127.0.0.0)
•Broadcast (limited, net-directed, subnet-directed, and all-subnets-directed)
•The destination host (land.c)
To further enhance spoof packet detection, use the icmp command to configure the security appliance to discard packets with source addresses belonging to the internal network, because the access-list command has been deprecated and is no longer guaranteed to work correctly.
Recommended Action Determine if an external user is trying to compromise the protected network. Check for misconfigured clients.
It could be a virus attack or it could be that someone is trying to compromise the network by sending traffic using a soofed ip address. The best way would be take sniffer so that you could see the MAC address of the faulty machine/source.
Also, if you want to disable this log message, you can do that as well, as follows:
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
[toc:faq]Introduction:This document describes details on how NAT-T
works.Background:ESP encrypts all critical information, encapsulating
the entire inner TCP/UDP datagram within an ESP header. ESP is an IP
protocol in the same sense that TCP and UDP are I...