Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

You may experience some slow load times, errors, and slight inconsistencies. We ask for your patience as we finalize the launch. Thank you.

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our beta test area to get started.

New Member

Land Attack False Positive for Internal Hosts

Hello all...

I have two hosts on "inside" networks. One is a jabber server, and the other a client trying to connect to that server.

The jabber server's IP address is 192.168.100.19, and the client has a DHCP assigned address of 192.168.150.19. Other clients on the 150.X have no trouble getting to the jabber server.

When I try to connect to the server, I see an xlate opened in the live log, but I also get the following message: "Deny IP due to Land Attack from <server name> to <server name>".

Obviously the firewall's confused about the source IP address and port of the requests. If I manually assign a different IP address to the client it can connect. I guess I could clear the xlate table to remedy this issue, but has this happened to anyone else, and can anyone suggest what might cause this?

A bug in version 8.2(3) perhaps?

Thanks!

Dan

  • Firewalling
Everyone's tags (3)
1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: Land Attack False Positive for Internal Hosts

We should jump into conclusions about bugs yet.

Is the firewall translating the client to the servers ip address 192.168.100.19?

Is the response from the server flagged as LAND attack?

You need to first identify which packet is flagged as land attack and if it is normal. For example if the client was translated to the servers ip address then the response might indeed be flagged as LAND attack, because the LAN checks are before the NAT.

I hope it helps.

PK

3 REPLIES
Cisco Employee

Re: Land Attack False Positive for Internal Hosts

We should jump into conclusions about bugs yet.

Is the firewall translating the client to the servers ip address 192.168.100.19?

Is the response from the server flagged as LAND attack?

You need to first identify which packet is flagged as land attack and if it is normal. For example if the client was translated to the servers ip address then the response might indeed be flagged as LAND attack, because the LAN checks are before the NAT.

I hope it helps.

PK

New Member

Re: Land Attack False Positive for Internal Hosts

That was it! I had a nat rule with a typo that was translating the client address to the server address.

Thanks for the assist...

Dan

Cisco Employee

Re: Land Attack False Positive for Internal Hosts

Glad we got it.

Take care,

PK

4981
Views
0
Helpful
3
Replies