Blocking Traffic from Spoofed IP Address

[#1]

Hi, I have a 200A running at my gateway. My network is set up with a mix of static and dynamic IP addresses. Only static IP addresses are able to access the Internet, with policies at the Firewall controlling the access too. I have came across some IP addresses are being spoofed to access the Internet. That IP address is a valid IP in my network but the user is out of town. Usually, these spoofed IP addresses generate a lot of sessions (800+) and eats up all the bandwidth. How am I able to trace the problem and/or stop the spoofing of the IP addresses?

[#2]

Try Identity Based Policies that way you dont relay in the IP to block Internet Access. Also, are you in an AD Domain?? Because depending of how you have configured Dinamic Updates in the DNS server you should check the Reverse Zone to see the names of the computer for the spoofed IP.

[rwpatterson]

Are you sure that user isn' t firing off some P2P program in his/her absence? Have you physically checked the workstation when this occurs?

[#4]

To Unai, Yes, I am in an AD Domain. How do I go about checking it? To Rwpatterson, I am sure because the user always brought his notebook along with him whenever he is out of town.

[#5]

Go to your DNS server, in the Reverse Lookup Zones, select your subnet and there search the IP. But like I said before it depends on how you have it configured.

[#6]

Hi Unai, I have checked. That IP address is tagged to the correct hostname. What does this indicates then? Do I need to recreate the PTR record?

[#7]

Hi, To locate the machine check the ARP tables on the device that is providing the gateway to the subnet (not sure if this is your Fortigate or not). Then with the MAC address you get from the ARP table you should be able to find what switch port the device is connected to (assuming you have managed switches). Then you can trace the cable, find the machine and punch the user. If you want to stop other people using the IP address for internet access you could just add a static arp entry onto the gateway for the subnet which maps to the legitimate MAC address.