Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

Silver

spoof log

hello

i am getting this log message from ASA5520 :

Deny IP spoof from (Cicso_Works) to 10.162.50.70 on interface inside

Notes:

-cisco_works is in inside interface

-10.162.50.70 is the IP of one interface (one DMZ) in ASA

i can't understand why am i getting this message!

3 REPLIES
Cisco Employee

Re: spoof log

Since 10.162.50.70 is supposed to be connected to DMZ interface as advised, and you are actually getting the traffic on inside interface of the ASA, that is why you are getting the spoof error message. Traffic sourced from 10.162.50.70 should only go inbound towards the ASA DMZ interface, not any other interfaces.

Hope that answers your question.

Silver

Re: spoof log

you said:

1-Since 10.162.50.70 is supposed to be connected to DMZ interface

->actually this IP is the IP of the DMZ interface itself and not of one PC connected to DMZ

2-Traffic sourced from 10.162.50.70 should only go inbound towards the ASA DMZ interface,

-> according to the syslog msg, the traffic is sourced from cisco_works and not 10.162.50.70!

i can't understand your explanaition :-(

Cisco Employee

Re: spoof log

It seems that there might be some routing loop that is causing packet that is sourced from the ASA DMZ interface to arrive on the inside interface instead.

Most times it is caused by routing loop in your network.

181
Views
0
Helpful
3
Replies