unicast rpf

[suthomas1]

Hi,

if we enable unicast rpf on asa 5585x, does it mean ip spoofing is enabled? How do we verify this?

is there any other anti spoof mechanisms available in this firewall.

Thanks in advance!

[Jouni Forss · Accepted solution]

Hi,

You use the following command

ip verify reverse-path interface

It will mean that the in addition to the normal route lookup with regards to the destination IP address, the ASA will also check its routing table for the source IP address. If it doesnt find a route for the source IP address through the interface which the packet entered in, it will drop it.

After enabling the above command for some interface you can use the following command to verify the statistics

show ip verify statistics

The ASA will also generate log messages from these dropped packets

- Jouni

[suthomas1]

Thanks. Do we have any other anti spoof mechansims availabe in asa.

[Jouni Forss]

Hi,

Here is some document even though a bit older one.

http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a00809763ea.shtml

Also you could take a look at this discussion (I have not read it through myself but seems to relate to the subject)

https://supportforums.cisco.com/thread/2152269

Seems the ASA Configuration Guide doesnt provide that much specific information in itself

http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/protect_tools.html

- Jouni