Skip to main content
A
Anonymous_User
Contributor
May 6, 2010
Question

Blocking Traffic from Spoofed IP Address

  • May 6, 2010
  • 5 replies
  • 4087 views
Hi, I have a 200A running at my gateway. My network is set up with a mix of static and dynamic IP addresses. Only static IP addresses are able to access the Internet, with policies at the Firewall controlling the access too. I have came across some IP addresses are being spoofed to access the Internet. That IP address is a valid IP in my network but the user is out of town. Usually, these spoofed IP addresses generate a lot of sessions (800+) and eats up all the bandwidth. How am I able to trace the problem and/or stop the spoofing of the IP addresses?

    5 replies

    A
    Anonymous_UserAuthor
    Contributor
    May 6, 2010
    Try Identity Based Policies that way you dont relay in the IP to block Internet Access. Also, are you in an AD Domain?? Because depending of how you have configured Dinamic Updates in the DNS server you should check the Reverse Zone to see the names of the computer for the spoofed IP.
    rwpatterson
    rwpatterson
    New Member
    May 6, 2010
    Are you sure that user isn' t firing off some P2P program in his/her absence? Have you physically checked the workstation when this occurs?
    A
    Anonymous_UserAuthor
    Contributor
    May 13, 2010
    To Unai, Yes, I am in an AD Domain. How do I go about checking it? To Rwpatterson, I am sure because the user always brought his notebook along with him whenever he is out of town.
    A
    Anonymous_UserAuthor
    Contributor
    May 13, 2010
    Go to your DNS server, in the Reverse Lookup Zones, select your subnet and there search the IP. But like I said before it depends on how you have it configured.
    A
    Anonymous_UserAuthor
    Contributor
    May 14, 2010
    Hi Unai, I have checked. That IP address is tagged to the correct hostname. What does this indicates then? Do I need to recreate the PTR record?
    A
    Anonymous_UserAuthor
    Contributor
    May 14, 2010
    Hi, To locate the machine check the ARP tables on the device that is providing the gateway to the subnet (not sure if this is your Fortigate or not). Then with the MAC address you get from the ARP table you should be able to find what switch port the device is connected to (assuming you have managed switches). Then you can trace the cable, find the machine and punch the user. If you want to stop other people using the IP address for internet access you could just add a static arp entry onto the gateway for the subnet which maps to the legitimate MAC address.
    Terms & ConditionsAccessibility statement