Not applicable
Created on 05-05-2010 10:29 PM
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Blocking Traffic from Spoofed IP Address
Hi,
I have a 200A running at my gateway. My network is set up with a mix of static and dynamic IP addresses. Only static IP addresses are able to access the Internet, with policies at the Firewall controlling the access too.
I have came across some IP addresses are being spoofed to access the Internet. That IP address is a valid IP in my network but the user is out of town. Usually, these spoofed IP addresses generate a lot of sessions (800+) and eats up all the bandwidth.
How am I able to trace the problem and/or stop the spoofing of the IP addresses?
6 REPLIES 6
Not applicable
Created on 05-06-2010 12:43 AM
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try Identity Based Policies that way you dont relay in the IP to block Internet Access.
Also, are you in an AD Domain?? Because depending of how you have configured Dinamic Updates in the DNS server you should check the Reverse Zone to see the names of the computer for the spoofed IP.
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you sure that user isn' t firing off some P2P program in his/her absence? Have you physically checked the workstation when this occurs?
Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com
Bob - self proclaimed posting junkie!See my Fortigate related scripts
at: http://fortigate.camerabob.com
Not applicable
Created on 05-12-2010 10:26 PM
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
To Unai,
Yes, I am in an AD Domain. How do I go about checking it?
To Rwpatterson,
I am sure because the user always brought his notebook along with him whenever he is out of town.
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Go to your DNS server, in the Reverse Lookup Zones, select your subnet and there search the IP.
But like I said before it depends on how you have it configured.
Not applicable
Created on 05-13-2010 06:26 PM
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Unai,
I have checked. That IP address is tagged to the correct hostname. What does this indicates then? Do I need to recreate the PTR record?
Not applicable
Created on 05-14-2010 12:56 PM
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
To locate the machine check the ARP tables on the device that is providing the gateway to the subnet (not sure if this is your Fortigate or not). Then with the MAC address you get from the ARP table you should be able to find what switch port the device is connected to (assuming you have managed switches). Then you can trace the cable, find the machine and punch the user.
If you want to stop other people using the IP address for internet access you could just add a static arp entry onto the gateway for the subnet which maps to the legitimate MAC address.