Ineffective IP spoofing protection

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Ineffective IP spoofing protection

L4 Transporter

I have IP spoofing protection enabled on PaloAlto but it is not effective due to the following reason:


My external Interface IP is . The spoofed attacks are coming from a fictitious source IP for e.g. destined to server). As per Palo's IP spoofing definition, this is not blocked because is routable over that interface. I am considering to write an ACL on the neighboring router that says block all inbound connections with source IP in subnet. 


Has anyone implemented this? Am I right in my approach?




Hi @SThatipelly 

I made a short test (as so far I have never seen such a spoofing attack - or missed it when it happened 😛 ).

The setup is a pa-220 with a default route towards the internet. Then I have an internal interface with a public /24 IP range. The first test was without a zone protection. This traffic was allowed - as I expected - but the connection would never work as the destination server would send the response not back to the firewall as it would be an answer to an IP from the network where the server is located. So this scenario is only a problem because of DoS attacks or vulnerabilities that could be exploited with a single packet.

The next test was with the option enabled to drop spoofed IP address. This connections were dropped with the reason spoofed IP address. Then I also added the option for strict IP address check, but compared to the second test, this made no difference in my situation. Here is a screenshot that shows the dropped packets in the threat log (the first 4 or 5 were only with drop for spoofed IP addresses enabled):


So this option definately will work to drop connections from spoofed IP addresses and as long as the route table is correct (as I assume because otherwise you would have other problems in your network) it shouln't cause any issues.


@vsys_remo I greatly appreciate you taking time to test this. I see that is working just as described which is great however I have a concern here. So, some of my DMZ servers are in that public IP range and also a neighboring public router(outside the firewall) that has the  IP in that same public IP range. so, let's say there is a packet from that public router( destined to SNMP server( Does the IP spoofing prevent that traffic? if so, is there a way I can exclude that rather than putting in an additional security policy?

They are in the same IP range but in different subnets, right? For example you have the public IP range The subnet between your router and the firewall is and the servers are located in Or at least something similar?

Nope, they are in same IP range and subnet. My Outside interface is a /24 which hosts the public routers and public IPs for the DMZ servers. This is what throwing me off on the protection steps I need to take.


Should I simply put in a rule saying that traffic from all but few 1.2.3.x should be blocked to on firewall?

So you have this network between the router and the firewall and use the IPs for destination NAT to the servers which have private IP addresses?

Now I think I understand your problem and in this case - if you do not want to change a little bit in your setup - the ACL on the router probably is the best option with the downside that then you don't see these dropped connections in the threat log.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!