06-26-2021 11:38 AM
I have IP spoofing protection enabled on PaloAlto but it is not effective due to the following reason:
My external Interface IP is 18.104.22.168/24 . The spoofed attacks are coming from a fictitious source IP for e.g. 22.214.171.124 destined to 126.96.36.199(web server). As per Palo's IP spoofing definition, this is not blocked because 188.8.131.52 is routable over that interface. I am considering to write an ACL on the neighboring router that says block all inbound connections with source IP in 184.108.40.206/24 subnet.
Has anyone implemented this? Am I right in my approach?
06-28-2021 11:26 AM
I made a short test (as so far I have never seen such a spoofing attack - or missed it when it happened 😛 ).
The setup is a pa-220 with a default route towards the internet. Then I have an internal interface with a public /24 IP range. The first test was without a zone protection. This traffic was allowed - as I expected - but the connection would never work as the destination server would send the response not back to the firewall as it would be an answer to an IP from the network where the server is located. So this scenario is only a problem because of DoS attacks or vulnerabilities that could be exploited with a single packet.
The next test was with the option enabled to drop spoofed IP address. This connections were dropped with the reason spoofed IP address. Then I also added the option for strict IP address check, but compared to the second test, this made no difference in my situation. Here is a screenshot that shows the dropped packets in the threat log (the first 4 or 5 were only with drop for spoofed IP addresses enabled):
So this option definately will work to drop connections from spoofed IP addresses and as long as the route table is correct (as I assume because otherwise you would have other problems in your network) it shouln't cause any issues.
06-28-2021 12:24 PM
@vsys_remo I greatly appreciate you taking time to test this. I see that is working just as described which is great however I have a concern here. So, some of my DMZ servers are in that public IP range and also a neighboring public router(outside the firewall) that has the IP in that same public IP range. so, let's say there is a packet from that public router(220.127.116.11) destined to SNMP server(18.104.22.168). Does the IP spoofing prevent that traffic? if so, is there a way I can exclude that rather than putting in an additional security policy?
06-28-2021 12:55 PM
They are in the same IP range but in different subnets, right? For example you have the public IP range 22.214.171.124/24. The subnet between your router and the firewall is 126.96.36.199/28 and the servers are located in 188.8.131.52/26. Or at least something similar?
06-28-2021 01:03 PM
Nope, they are in same IP range and subnet. My Outside interface is a /24 which hosts the public routers and public IPs for the DMZ servers. This is what throwing me off on the protection steps I need to take.
Should I simply put in a rule saying that traffic from all but few 1.2.3.x should be blocked to 184.108.40.206/24 on firewall?
06-28-2021 01:41 PM
So you have this network between the router and the firewall and use the IPs for destination NAT to the servers which have private IP addresses?
Now I think I understand your problem and in this case - if you do not want to change a little bit in your setup - the ACL on the router probably is the best option with the downside that then you don't see these dropped connections in the threat log.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!